Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be your own VPN provider with OpenBSD

networkfilter.blogspot.com

Post reply on HN
Print view View original

11–20 of 63 posts

Re: Be your own VPN provider with OpenBSD

#12

Post by delsarto »

cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups.

In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns

Re: Be your own VPN provider with OpenBSD

#13

Post by [deleted] »

cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

[deleted]

Re: Be your own VPN provider with OpenBSD

#14

Post by hiou »

If you aren't partial to OpenBSD, I've had good success with this:

https://github.com/Nyr/openvpn-install

You can turn off logging on the server with

/etc/openvpn/server.conf

    log /dev/null
    status /dev/null
Remember to restart the openvpn service after that.

That said, this wouldn't deal with the VPS provider's logging etc.

Re: Be your own VPN provider with OpenBSD

#15

Post by jrockway »

regecks wrote: post #9
gatehouse wrote: post #8

I've been considering running all my mobile data through a VPN for better security, and saving all of it so I can analyze anything after the fact. Anyone doing anything like this?

Keeping a VPN connection alive doesn't do the battery any favors, and bringing up a VPN connection isn't that fast to do it on-demand.

OpenVPN has a tuneable keepalive interval. I think the default is 10 seconds, which is not so good for battery. But if you set it to 10 minutes, that would be fine.

(I bet the roaming between wifi and cellular data could be a problem, though.)

Re: Be your own VPN provider with OpenBSD

#16

Post by icehawk »

cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

Firefox has the config option

  network.proxy.socks_remote_dns
which you can toggle to prevent DNS leakage.

Re: Be your own VPN provider with OpenBSD

#17

Post by rdtsc »

cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

Even better trick is SSH can actually tunnel level 3 data! Via TUN/TAP interfaces (this is effectively how some VPN implementations do it).

See "-w" option

Here are a few guides. This is more involved than just adding the -D option and setting a "proxy" field in some applications but this is more general as well:

http://sleepyhead.de/howto/?href=vpn

https://wiki.archlinux.org/index.php/VPN_over_SSH

https://help.ubuntu.com/community/SSH_VPN

Re: Be your own VPN provider with OpenBSD

#18

Post by stephen-mw »

If anyone is interested, here's a script that will install openvpn on a raspberry pi in one command[1].

I use it along with the openvpn ios app on my phone when I'm on corporate wifi, or I connect to it with my laptop any time I'm in a coffee shop. Just note it's meant to tunnel traffic to a "safe" network, not anonymize you on the internet.

1. https://github.com/stephen-mw/raspberrypi-openvpn-auto-insta...

Re: Be your own VPN provider with OpenBSD

#19

Post by pbhjpbhj »

cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

I sometimes use sshuttle when I want to tunnel traffic through a remote server, can intercept and route DNS requests along the tunnel to using --dns.

    sshuttle --dns -r root@XX.XX.XX.XX 0/0 --exclude 192.168.0.0/9
Exclude as used here stops local addresses being tunneled.

Re: Be your own VPN provider with OpenBSD

#20

Post by brycehamrick »

By far the fastest and easiest setup I've done of a VPN was with Pritunl, an open source and OpenVPN compatible VPN server that has installable packages for the big distros. It has a great web based admin interface for managing the server as well.

https://pritunl.com https://medium.com/pritunl-tutorials/pritunl-tutorial-ed50a5...

Post reply on HN