Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be your own VPN provider with OpenBSD

networkfilter.blogspot.com

Post reply on HN
Print view View original

41–50 of 63 posts

Re: Be your own VPN provider with OpenBSD

#41

Post by mortenlarsen »

ReidZB wrote: post #23
delsarto wrote: post #12

Earlier quoted context omitted.

I think the fact that this leaks DNS lookups is really quite key because that gives away a huge amount about what you're looking at over your "vpn", not to mention services like netflix that are pointing you to different responses based upon the source of your dns lookups. In firefox you want to go to about:config page and turn on network.proxy.socks_remote_dns

I'm using the latest stable release of Firefox (34.0.5) and I see a "Remote DNS" checkbox under my SOCKS proxy configuration. Isn't that the same option in the GUI? No about:config tweaks needed? I would think so, but everyone seems to be giving the about:config business, so maybe I am missing something.

Yes, that is the same option. Toggling the option in the GUI toggles network.proxy.socks_remote_dns in about:config. As default it is, is still off though.

Re: Be your own VPN provider with OpenBSD

#42

Post by __mp »

I use Debian + UFW + OpenVPN + Digitalocean for my US Netflix needs. I get 10Mbit downstream and 20Mbit upstream from NY3 to my 60/60 fiber connection here in Zurich. I could also configure it to use DNS only, but open dns servers are not so welcomed at the moment. Since I do quite a bit of roaming it's easiest to just configure OpenVPN.

Re: Be your own VPN provider with OpenBSD

#43

Post by INTPenis »

These days there's a working OpenVPN client for Android but there were times when IPsec[1] VPN was the only good way to connect many different clients like Windows, Mac OS and iPhone to your VPN server.

Which is why I had to mention IPsec VPN and link to a good article on how to manage it on OpenBSD.

[1] http://www.kernel-panic.it/openbsd/vpn/vpn3.html

Re: Be your own VPN provider with OpenBSD

#44

Post by illumen »

cperciva wrote: post #34
rdtsc wrote: post #17

Earlier quoted context omitted.

Even better trick is SSH can actually tunnel level 3 data! Via TUN/TAP interfaces (this is effectively how some VPN implementations do it). See "-w" option Here are a few guides. This is more involved than just adding the -D option and setting a "proxy" field in some applications but this is more general as well: http://sleepyhead.de/howto/?href=vpn https://wiki.archlinux.org/index.php/VPN_over_SSH https://help.ubunt…

Yes, except for the TCP-over-TCP issue.

SSH does it's own flow control, and with HPN-SSH it is much better.

Also, if your connection to the VPN host is quite good, then the TCP-over-TCP issue does not apply as much. The bad cases happen when that connection has packet loss.

Re: Be your own VPN provider with OpenBSD

#48

Post by pi-rat »

pbhjpbhj wrote: post #19
cfallin wrote: post #2

If anyone's ever looking for an even quicker hack, ssh has built-in the ability to act as a SOCKS5 proxy, tunneling your traffic over ssh to whatever remote machine you might have access to: $ ssh -D 1080 myserver.myhost.net Then configure Chrome or Firefox or whatever to use a SOCKS5 proxy on localhost, port 1080. (N.B. that this does not tunnel DNS lookups by default.) The OpenVPN-based route is the way to go for s…

I sometimes use sshuttle when I want to tunnel traffic through a remote server, can intercept and route DNS requests along the tunnel to using --dns. sshuttle --dns -r root@XX.XX.XX.XX 0/0 --exclude 192.168.0.0/9 Exclude as used here stops local addresses being tunneled.

Love sshuttle, sadly it stopped working on OS X some time ago when apple moved from ipfw to pf.

I hope someone is able to crank out a version that used pf soon.

Re: Be your own VPN provider with OpenBSD

#49

Post by borski »

We made this really easy, on Ubuntu: https://www.tinfoilsecurity.com/vpn will generate you a private VPN on your own box with a single click.

If you don't trust us and prefer to do it on your own, that's fine too, it's open source: https://github.com/tinfoil/openvpn_autoconfig/blob/master/bi...

Post reply on HN