Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

blog.hsp.dk

Post reply on HN
Print view View original

41–47 of 47 posts

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#41

Post by viraptor »

kijin wrote: post #36
eriknstr wrote: post #33

Earlier quoted context omitted.

>masking browsing habits from your ISP What I don't get is why people think that random VPS and VPN providers would somehow be better for your privacy than to let your ISP see the content of your traffic.

Your ISP and your government have a strong interest in monitoring what you do, and they are more likely to take action against you if they don't like what you do. A random VPS service (preferably in another country) only cares about you insofar as you pay them and don't cause any trouble to them. They don't have as much of an incentive to invade your privacy as your home ISP does, and I trust incentive structures a l…

> They don't have as much of an incentive to invade your privacy as your home ISP does

The have a much better opportunity of correlating traffic than anyone else. It's not separated by an IP anymore. They've got a specific account they can connect to a specific person. (via billing) I believe if they wanted to sell the traffic logs, they'd easily find customers.

Also there have been companies like Hola (https://torrentfreak.com/hola-vpn-sells-users-bandwidth-1505...) that do outright evil things just because you run their software. Facebook bought Onavo VPN which gave them more traffic visibility.

There's also a few VPN services which will replace / inject ads into pages you visit without https.

So yeah - a lot of reasons to invade both your security and your privacy here.

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#42

Post by kijin »

viraptor wrote: post #41
kijin wrote: post #36

Earlier quoted context omitted.

Your ISP and your government have a strong interest in monitoring what you do, and they are more likely to take action against you if they don't like what you do. A random VPS service (preferably in another country) only cares about you insofar as you pay them and don't cause any trouble to them. They don't have as much of an incentive to invade your privacy as your home ISP does, and I trust incentive structures a l…

> They don't have as much of an incentive to invade your privacy as your home ISP does The have a much better opportunity of correlating traffic than anyone else. It's not separated by an IP anymore. They've got a specific account they can connect to a specific person. (via billing) I believe if they wanted to sell the traffic logs, they'd easily find customers. Also there have been companies like Hola ( https://torr…

I said VPS service, not VPN service. I don't trust VPN services at all.

Meanwhile, I doubt that Linode has any interest in injecting ads or selling traffic logs.

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#43

Post by spaceboy »

118383 wrote: post #27

Not really that knowledgeable about maintaining servers, but is it really enough, but is it really enough to just straight away 'apt-get openvpn'. Surely for it to be a 'secure VPN server' there has got to be some stuff set up first, like setting up key only login, disabling root ssh login, disabling everything ssh, setting up firewall, disabling ipv6 entirely in the case of openvpn? I run a vpn on digital ocean and…

That's good advice. It's necessary and worth it to harden any server that you deploy bash recipes on. The amount of tutorials online that leave out the IPV6 advice in that Linode article is astonishing.

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#44

Post by spaceboy »

kijin wrote: post #36
eriknstr wrote: post #33

Earlier quoted context omitted.

>masking browsing habits from your ISP What I don't get is why people think that random VPS and VPN providers would somehow be better for your privacy than to let your ISP see the content of your traffic.

Your ISP and your government have a strong interest in monitoring what you do, and they are more likely to take action against you if they don't like what you do. A random VPS service (preferably in another country) only cares about you insofar as you pay them and don't cause any trouble to them. They don't have as much of an incentive to invade your privacy as your home ISP does, and I trust incentive structures a l…

> Use a VPN and now you're only vulnerable to the VPS service and the NSA

You can always try 'chaining' VPNs together, or stacking them on top of each other so that if one of the VPS servers is compromised, a TLA gets nothing but encrypted traffic and can't see what you're doing. The only caveat here is the 'exit' VPS is always going to have to be unencrypted. This is why it's worth looking into offshore VPS providers in non-five-eyes countries. I'm not sure what countries these are. I haven't done the research.

Typically I achieve chaining by doing the following:

- Hardware VPN that I connect to as normal. Personally I use http://www.pivpn.io/

- Then I connect to another VPN on my host/hypervisor machine

- Then I fire up Virtualbox and run another VPN inside the VM

- The chain now has three hops, and the exit VPN is on a box that I control. I avoid Digital Ocean like the plague as it's a US company.

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#45

Post by yjftsjthsd-h »

XERQ wrote: post #24
TuringNYC wrote: post #13

Earlier quoted context omitted.

Any suggestions on smaller companies that are flying under the radar so far?

I'm the founder of SSD Nodes, Inc., which is a bootstrapped SSD-based hosting provider for startups that I've been working on since 2011. We have several locations which are great for VPNs: NYC, Dallas, Seattle, and Montreal. We're really good about curbing abuse, so our IPs usually don't have any issues (there's also a 14-day refund if it doesn't work out, we're very generous with refunds). https://www.ssdnodes.com/…

It might be worth it for the reasons you mention, but the lowest end plan is still far overpowered for VPN use and that's reflected in pricing.

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#46

Post by tyingq »

yjftsjthsd-h wrote: post #45
XERQ wrote: post #24

Earlier quoted context omitted.

I'm the founder of SSD Nodes, Inc., which is a bootstrapped SSD-based hosting provider for startups that I've been working on since 2011. We have several locations which are great for VPNs: NYC, Dallas, Seattle, and Montreal. We're really good about curbing abuse, so our IPs usually don't have any issues (there's also a 14-day refund if it doesn't work out, we're very generous with refunds). https://www.ssdnodes.com/…

It might be worth it for the reasons you mention, but the lowest end plan is still far overpowered for VPN use and that's reflected in pricing.

$5.49 a month seems reasonable to me. I'm sure you could find something cheaper, but not much cheaper.

Re: How to Setup a Secure VPN Server on Raspberry Pi or DigitalOcean

#47

Post by suprjami »

withzombies wrote: post #29
suprjami wrote: post #26

This seems a bit pointless to me. If your aim is to hide your traffic from third-party networks you might be on (free wifi, school, hotels, etc) then a yearly VPN subscription is almost certainly cheaper than the cheapest DigitalOcean droplet. If you get a good provider (I use PIA but am not affiliated with them) then you get unlimited traffic, multiple clients, endpoints all over the world, tech support, all without…

I trust Digital Ocean much more than I trust PrivateInternetAccess. I also don't want to be associated with the other traffic going through PIA or similar VPNs.

You can replace PIA with any other VPN provider. I'd trust a commercial VPN provider with good reviews more than I'd trust myself to get good crypto right.
Post reply on HN