Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quick VPN Setup with AWS Lightsail and WireGuard

mcoliver.substack.com

Post reply on HN
Print view View original

51–60 of 78 posts

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#51

Post by aborsy »

mcoliver wrote: post #27
giobox wrote: post #26

I've long given up hosting my own VPN on VPC/cloud providers as means of cheap and quick "browser in another country" hack - so many things block access to known VPC/cloud IP address ranges, especially AWS, and I was previously an advocate for just throwing up a cheap self-run VPN container somewhere too. The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a r…

Fair comment on getting a residential IP. I'm not necessarily looking down on commercial VPN providers. I do think a lot of their users don't understand the transfer of trust they are engaging in. As long as you understand that then great. Another benefit is that your traffic can be pooled with other users coming from an exit IP which can be useful (as opposed from a single endpoint you control as I wrote about in th…

But there is also the transfer of trust to the VPS provider, no?

The cloud provider may have a less favorable privacy policy.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#52

Post by aborsy »

I’m curious, if we have a hub and spoke vpn, could we have peer to peer end to end encryption, with the exchange between them facilitated by an untrusted hub on a cloud instance?

So, the phone wants to connect to a media server at home. In hub and spoke vpn, both connect to a vpn server. The problem is, the traffic decrypted on VPS. I want the packers from phone go to vps then to home, with end to end encryption. The VPS acts as a relay.

The connection between peers need not be direct (peer to peer). The traffic could go through the central hub if needed. I just don’t want the hub to access the decrypted traffic.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#53

Post by no_time »

aborsy wrote: post #52

I’m curious, if we have a hub and spoke vpn, could we have peer to peer end to end encryption, with the exchange between them facilitated by an untrusted hub on a cloud instance? So, the phone wants to connect to a media server at home. In hub and spoke vpn, both connect to a vpn server. The problem is, the traffic decrypted on VPS. I want the packers from phone go to vps then to home, with end to end encryption. The…

You basically described Tor.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#54

Post by justinludwig »

thatcherc wrote: post #14

Fairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the V…

Is this what you're looking for?:

https://www.procustodibus.com/blog/2022/06/multi-hop-wiregua...

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#55

Post by aborsy »

no_time wrote: post #53
aborsy wrote: post #52

I’m curious, if we have a hub and spoke vpn, could we have peer to peer end to end encryption, with the exchange between them facilitated by an untrusted hub on a cloud instance? So, the phone wants to connect to a media server at home. In hub and spoke vpn, both connect to a vpn server. The problem is, the traffic decrypted on VPS. I want the packers from phone go to vps then to home, with end to end encryption. The…

You basically described Tor.

Mesh VPN is one way. The VPS node will be the coordination server.

Tor is another, onion layers of tunnels.

But maybe there is an easy networking solution, like creating a route table on VPS implementing a relay or STUN server , that says traffic coming from the peers public key is exchanged on VPS server.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#56

Post by pluto_modadic »

aborsy wrote: post #52

I’m curious, if we have a hub and spoke vpn, could we have peer to peer end to end encryption, with the exchange between them facilitated by an untrusted hub on a cloud instance? So, the phone wants to connect to a media server at home. In hub and spoke vpn, both connect to a vpn server. The problem is, the traffic decrypted on VPS. I want the packers from phone go to vps then to home, with end to end encryption. The…

mesh VPNs (tailscale, zerotier) are what you want :) tailscale will do the hole punching for you. :)

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#57

Post by vegardx »

josephh wrote: post #37

Does anyone know the latest on having WG support dynamically assigned IP for peers? There have been some work done[1], but it seems to have stalled for quite some time. 1. https://github.com/WireGuard/wg-dynamic

The stateless nature of Wireguard makes it kind of hard to implement. Having something DHCP-esque makes sense when you have an external mechanism for authentication, like most traditional VPN software does, but with Wireguard you have to exchange public keys with peers that communicate with each other, so you might as well just set up the IP at the same time.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#58

Post by IceWreck »

giobox wrote: post #26

I've long given up hosting my own VPN on VPC/cloud providers as means of cheap and quick "browser in another country" hack - so many things block access to known VPC/cloud IP address ranges, especially AWS, and I was previously an advocate for just throwing up a cheap self-run VPN container somewhere too. The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a r…

Another reason to host your own VPN is that you want all your devices to be on the same network.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#59

Post by Nux »

harry8 wrote: post #38
Nux wrote: post #16

Earlier quoted context omitted.

What is an sbc and the phone's relation to it?

SBC - Single Board Computer. Raspberry Pi most famous example? https://en.wikipedia.org/wiki/Single-board_computer In this instance consider the SBC a lightweight, low-power, always on server sitting behind his/her router.

I thought it's a VOIP SBC, but don't know how those work to fully understand his issue, hence my question.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#60

Post by candiodari »

aborsy wrote: post #52

I’m curious, if we have a hub and spoke vpn, could we have peer to peer end to end encryption, with the exchange between them facilitated by an untrusted hub on a cloud instance? So, the phone wants to connect to a media server at home. In hub and spoke vpn, both connect to a vpn server. The problem is, the traffic decrypted on VPS. I want the packers from phone go to vps then to home, with end to end encryption. The…

In professional settings what you're describing is more-or-less what DMVPN provides.
Post reply on HN