Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Quick VPN Setup with AWS Lightsail and WireGuard

mcoliver.substack.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#71

Post by AviationAtom »

LeoPanthera wrote: post #50
giobox wrote: post #26

I've long given up hosting my own VPN on VPC/cloud providers as means of cheap and quick "browser in another country" hack - so many things block access to known VPC/cloud IP address ranges, especially AWS, and I was previously an advocate for just throwing up a cheap self-run VPN container somewhere too. The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a r…

> The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a residential IP in the target country This is almost always not true. There are "residential" VPN providers, but they are scammy AF. The only way to get access to a true residential IP is via some proxy/gateway software run by a customer of a real home ISP. These are usually obtained via botnets of infecte…

I'd dispute that most access is obtained through botnets. I see it as generally obtained through the user themselves. I will agree that the provider may not be clearly notifying the user what they are agreeing to by utilizing their software, hiding it in their lengthy Terms of Service, but the user is agreeing to it by installing their software and accepting their ToS.

This was a huge controversy not long ago. The biggest issue I see from it is that it opens the user up to a fair amount of legal liability for what other users of the VPN service do while connected to the VPN service. If the user failed to understand what they agreed to in installing the VPN service and agreeing to it then it can make for some very awkward conversations when law enforcement comes knocking.

As a cybersecurity person I also think users fail to understand what information they are potentially making available to some rando running the VPN software on their PC. I can (and have before) see any traffic that you are sending through that VPN, and potentially tamper with that traffic. If you thought Nord or PIA could not be trusted with your traffic then how do you feel about Joe Random being able to see and tamper with your traffic?

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#72

Post by AviationAtom »

aborsy wrote: post #51
mcoliver wrote: post #27

Earlier quoted context omitted.

Fair comment on getting a residential IP. I'm not necessarily looking down on commercial VPN providers. I do think a lot of their users don't understand the transfer of trust they are engaging in. As long as you understand that then great. Another benefit is that your traffic can be pooled with other users coming from an exit IP which can be useful (as opposed from a single endpoint you control as I wrote about in th…

But there is also the transfer of trust to the VPS provider, no? The cloud provider may have a less favorable privacy policy.

I think you touch on a valid point: we should be focusing less on where our traffic egresses and more on ensuring all of our traffic is end-to-end encrypted as much as possible, as well as ensuring any "meta data" (i.e. DNS) is encrypted too.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#73

Post by AviationAtom »

jwsteigerwalt wrote: post #69

“why they felt the anonymous VPN operator was more trustworthy than a regulated ISP”: - the VPN operator has never had an employee visit your home. - the VPN operator did not require any type of credit check and/or require extensive personal information. - the barriers to change VPN operator are substantially lower. I’m not a huge fan of the VPN operators, but there are real differences in the trust required with eac…

You not giving any personal data to Mullvad, only sending Bitcoin, doesn't really change that they can still potentially see any of your traffic entering and exiting their infrastructure, to include being able to connect your residential IP to a currently active session.

Tor isn't much better, as security services have been able to gain enough control or surveillance ability to match traffic as it ingresses and egresses Tor, to then identify where the traffic originated from.

With enough of a tinfoil hat you can perpetually be paranoid and chasing "anonymity" for a long while. It's really about what you're trying to conceal and what effort you put in to securing the infrastructure at the beginning and end of an end-to-end encrypted session, as well as the level of security of the end-to-end encrypted session itself.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#74

Post by giobox »

LeoPanthera wrote: post #50
giobox wrote: post #26

I've long given up hosting my own VPN on VPC/cloud providers as means of cheap and quick "browser in another country" hack - so many things block access to known VPC/cloud IP address ranges, especially AWS, and I was previously an advocate for just throwing up a cheap self-run VPN container somewhere too. The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a r…

> The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a residential IP in the target country This is almost always not true. There are "residential" VPN providers, but they are scammy AF. The only way to get access to a true residential IP is via some proxy/gateway software run by a customer of a real home ISP. These are usually obtained via botnets of infecte…

> This is almost always not true.

If you read my statement, "they can give you a residential IP in the target country" - I never said this was universal.

Some private VPN companies will offer you a residential IP or dedicated IP, sometimes for additional fee - I'm paying for such a service right now. I perhaps should have broadened statement to "dedicated IP" etc, but it remains true you can get a far more "useable" IP from some private VPN providers.

One such example - and I know from my own testing this dedicated IP has far fewer issues with region locked content such as the BBC iPlayer or Netflix, where as almost every IP AWS has assigned me, including elastic IPs, has been blocked in the last few years:

˜ https://nordvpn.com/features/dedicated-ip/

Same thing, different vendor:

- https://www.privateinternetaccess.com/vpn-features/dedicated...

And another...

- https://surfshark.com/dedicated-ip

etc etc

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#75

Post by giobox »

AviationAtom wrote: post #72
aborsy wrote: post #51

Earlier quoted context omitted.

But there is also the transfer of trust to the VPS provider, no? The cloud provider may have a less favorable privacy policy.

I think you touch on a valid point: we should be focusing less on where our traffic egresses and more on ensuring all of our traffic is end-to-end encrypted as much as possible, as well as ensuring any "meta data" (i.e. DNS) is encrypted too.

This is arguably too narrow a way to think about this, as where you traffic egresses can directly affect what sites or services will work - this isn't hypothetical. Both are important!

If you need access to regional services, a common VPN use case and one outlined in the original article, its the single most important factor.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#76

Post by j45 »

LeoPanthera wrote: post #63
j45 wrote: post #35

Earlier quoted context omitted.

Linode isn't too bad for a VPS instance - best ot make sure the IP isn't on many block lists, take your time logging into all your services through it and the rest can be generally smooth sailing. More and more cloud providers look for and block vpn's self-hosted with vps providers, in which case, finding access to residential connections (trading) or a provider is a way to go.

Linode is now Akamai - and considerably more expensive than Hetzner, and you don't get all that much more for your money.

Linode has only gone up a little.

Hetzner might be worth looking into but the cheapest isn’t always the best value.

Digital ocean should be avoided for all production uses

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#77

Post by mutant »

nprateem wrote: post #65
thatcherc wrote: post #14

Fairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the V…

Tailscale exit node.

Or headscale.

Re: Quick VPN Setup with AWS Lightsail and WireGuard

#78

Post by thatcherc »

nucleardog wrote: post #28
thatcherc wrote: post #14

Fairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the V…

Since you’re just asking for concepts I can take a probably wrong guess that might lead you to something useful with some googling. (I’ve done stuff like this a lot, but not lately and this is all from memory.) The problem you’re trying to solve is basically one of routing. You have a packet leaving your phone to the internet, and you want it to route it through the VPS, from VPS to SBC, SBC to your home router, then…

This is very helpful, thanks! Looks like I have some reading to do about IP forwarding.
Post reply on HN