41–50 of 78 posts
Question: Assuming PKI is "solved" (whatever that means) isn't mTLS in contrast to sth like a VPN the preferred solution nowadays? Or both? I'm asking because Wireguard itself looks a lot like mTLS to me and I'm curious how HN people currently see that context.
And then half of the websites are not working because they think you are a crawler/malicious user.
Depending on the instance type, Lightsail easily gets throttled into oblivion. The $3.50/month instance allows for 5% utilization before you start eating up burst capacity. Perhaps WireGuard is light enough that it's okay, but thought it worth mentioning.
LightSail instances are burstable t2/t3 instances under the hood. Which...those types of instances have their use. But the fact that AWS kind of hides the whole CPU credit thing in LightSail is a bit misleading.
Fairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the V…
I have a vps as the wireguard "hub" with my phone, DNS and internal services being the spokes. I don't route traffic through home, but I do use home DNS as adblocker on the go. DNS also does the split horizon to route the phone to internal services over wg. I would strongly recommend switching from iptables to nftables -- drastically reduces wtfs/minute metric during the configuration. If you'd like -- I can send you…
Or you could post a link to a GitHub "gist" of a "sanitized" version of it it, so other random folks (like me; it sounds interesting / useful) can also benefit from it without you havin' to email it to a zillion random people. ;~)
Earlier quoted context omitted.
Wireguard is L3, right? So it behaves like a network layer VPN. That means that you can't switch how traffic is flowing based on application protocol. But I'm not super familiar with VoIP stuff. You can split the tunnel based on IP routing, but I think that's as good as it gets. So if you want to Wireguard specific traffic to your peer then you're fine. For instance, we have our internal cloud network linked to our o…
How about policy routing based on dport? See `ip rule help`.
I've long given up hosting my own VPN on VPC/cloud providers as means of cheap and quick "browser in another country" hack - so many things block access to known VPC/cloud IP address ranges, especially AWS, and I was previously an advocate for just throwing up a cheap self-run VPN container somewhere too. The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a r…
This is almost always not true.
There are "residential" VPN providers, but they are scammy AF. The only way to get access to a true residential IP is via some proxy/gateway software run by a customer of a real home ISP. These are usually obtained via botnets of infected PCs.
Users of residential VPNs are usually using them to scrape sites which try to prevent scraping and so are probably happy to turn a blind eye to where they get their IPs from.
They're also much more expensive then traditional VPNs.