Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detailed VPN Comparison Chart

thatoneprivacysite.net

Post reply on HN
Print view View original

51–60 of 71 posts

Re: Detailed VPN Comparison Chart

#51

Post by nmjohn »

brotherjerky wrote: post #41
inertial wrote: post #39

And a few DIY VPN options (open source ansible etc. scripts) that have been features on HN recently (in order of popularity) https://github.com/jlund/streisand (6000+ stars) https://github.com/sovereign/sovereign (6000+ stars) https://github.com/Nyr/openvpn-install (3000+ stars) https://github.com/ttlequals0/autovpn (1400+ stars) https://github.com/trailofbits/algo (1100+ stars) https://github.com/robbintt/popup-open…

Has anyone setup OpenVPN via Docker? I've seen some of the images, just wondering if anyone has actually got it working.

Yes, it works quite well - For an example setup, this is my setup script [0] to bootstrap a digital ocean droplet + launch an openvpn container using this image [1]

[0]: https://github.com/n-johnson/setup-openvpn-server

[1]: https://github.com/n-johnson/dockvpn

Re: Detailed VPN Comparison Chart

#52

Post by JorgeGT »

sarsaparilla wrote: post #46
JorgeGT wrote: post #33

Earlier quoted context omitted.

I also run my VPN on a cheap VPS. Dedicated VPN companies can easily come under attack/scrutiny, or could have temptations of selling user data if subscribers fall, but I doubt anyone is monitoring individual, ephemeral DO droplets/AWS instances.

If you're the only user of your VPN, doesn't that make it pretty easy to trace your usage back to you? I would have thought that using a VPN Provider would assist privacy by making it hard to figure out which client initiated the any request coming out of the VPN node...

A local adversary (in your network) can know that you're establishing a connection to a certain IP in another country, but they cannot know what that particular machine is accessing in turn. [This is my threat model, I use this in public WiFi].

And a remote adversary (who sees your VPS IP) cannot know who is, in turn, connected to that VPS, unless they can extract that information from the VPS provider via court order or hacking. [This is of more concern if you plan to do illegal things or are a dissident].

As always, you must model your threat scenario and proceed accordingly.

Re: Detailed VPN Comparison Chart

#53

Post by jlgaddis »

jessaustin wrote: post #44
jlgaddis wrote: post #28

Earlier quoted context omitted.

I don't see a "disclaimer/disclosure" (kinda standard practice around here) so I assume your username is entirely coincidental?

The 'name and the link are less than a centimeter apart on one's screen. That seems enough to clue in most readers?

It was mere chance that I noticed it at all. I normally don't (consciously) pay much attention to usernames. "GOOGLE CEO" could reply to me and I probably wouldn't notice it so the disclaimers are a nice addition, IMO.

Re: Detailed VPN Comparison Chart

#55

Post by AlexCoventry »

nine_k wrote: post #24
AlexCoventry wrote: post #19

Earlier quoted context omitted.

Wouldn't a VPN run off DO hosts quickly trigger their network abuse filters?

Why would it? As long as you're in within your traffic limits, I suppose DO is happy to sell you the service you paid for. You're also likely not adding much SSD IOPS by running a VPN, but you have paid for a bit of storage, so you're a lucrative customer :) Anecdotally, people routinely run small-scale VPN off DO or even AWS free tier hosts.

I was mostly thinking about the DMCA notices, the spam and the CP traffic you would end up being associated with.

Re: Detailed VPN Comparison Chart

#56

Post by RJIb8RBYxzAMX9u »

Genuine question: why's OpenVPN so popular over L2TP/IPsec? Configuration on the server side is maybe a little more complicated, but configuration on the client side is super simple, as all major OS, mobile or otherwise, have support built-in.

I've read arguments that firewalls tend to block IPsec packets, but there's also UDP encapsulation. And IME, I've never had connectivity issues, from multiple random coffee shop / airport WiFi, in multiple countries. I suspect it's because Cisco's VPN product used to (still?) uses IPsec, just with proprietary authentication schemes, and a lot of businesses use it, so most firewalls are configured to let it through.

Re: Detailed VPN Comparison Chart

#57

Post by smartbit »

jlgaddis wrote: post #28
vpnspeedtest wrote: post #4

http://vpnspeedtest.org/ tests over 20 VPN services to find the maximum speed of each VPN from 8 locations around the world. ThatOnePrivacyGuy should use their open source speed test tool instead as the tests are verifiable (unlike his tests from a single location which nobody can reproduce).

I don't see a "disclaimer/disclosure" (kinda standard practice around here) so I assume your username is entirely coincidental?

vpnspeedtest.org probably only tests download speed but doesn't state it clearly. I use one of the listed vpn-providers and the upload speed of it is heavily throttled in a saw-tooth manner from 0,2 Mbit to 1.2Mbit, nowhere near the 50Mbit that vpnspeedtest.org lists for my hometown & PureVPN. After my ISP worked on their network, I got a new ip-address and PureVPN initially limited upload to 2Mbit, but the next day it was back to the saw-tooth behavior.

Re: Detailed VPN Comparison Chart

#58

Post by [deleted] »

pilif wrote: post #25
michaelt wrote: post #18

If I was the NSA, I'd certainly be looking to launch a VPN company or two - maybe even subsidising their offerings, to get them to the top of the performance and value for money charts. After all, getting users to voluntarily direct their traffic through your network would be much easier than installing snooping hardware at every ISP, backdooring hardware in transit or snooping on undersea cables.

> If I was the NSA, I'd certainly be looking to launch a VPN company or two not worth the trouble when you can just compel existing VPN companies to send all traffic to you.

[deleted]

Re: Detailed VPN Comparison Chart

#59

Post by walrus01 »

RJIb8RBYxzAMX9u wrote: post #56

Genuine question: why's OpenVPN so popular over L2TP/IPsec? Configuration on the server side is maybe a little more complicated, but configuration on the client side is super simple, as all major OS, mobile or otherwise, have support built-in. I've read arguments that firewalls tend to block IPsec packets, but there's also UDP encapsulation. And IME, I've never had connectivity issues, from multiple random coffee sho…

at the expense of latency and performance, openvpn can run in purely TCP mode which is more likely to survive shitty wifi connections and aggressive/stupid captive portal wifi and firewalls/NATs like you might find in an airport. I have an openvpn server running its public interface on port 443 in tcp mode which is frequently accessible when ipsec stuff is blocked.

openvpn can also be used with obfsproxy

Re: Detailed VPN Comparison Chart

#60

Post by RJIb8RBYxzAMX9u »

walrus01 wrote: post #59
RJIb8RBYxzAMX9u wrote: post #56

Genuine question: why's OpenVPN so popular over L2TP/IPsec? Configuration on the server side is maybe a little more complicated, but configuration on the client side is super simple, as all major OS, mobile or otherwise, have support built-in. I've read arguments that firewalls tend to block IPsec packets, but there's also UDP encapsulation. And IME, I've never had connectivity issues, from multiple random coffee sho…

at the expense of latency and performance, openvpn can run in purely TCP mode which is more likely to survive shitty wifi connections and aggressive/stupid captive portal wifi and firewalls/NATs like you might find in an airport. I have an openvpn server running its public interface on port 443 in tcp mode which is frequently accessible when ipsec stuff is blocked. openvpn can also be used with obfsproxy

> [...] openvpn can run in purely TCP mode which is more likely to survive shitty wifi connections and aggressive/stupid captive portal wifi and firewalls/NATs like you might find in an airport [...]

That's contrary to my own experience, hence my original post. Obviously I've not been to every airport, but I've been to a handful of different ones over the last decade, and I've never had problems with IPsec. And IME airport / coffee shop / hotel WiFi are usually not the ones most locked down, but corporate guest WiFi. The last one I used blocked everything except TCP port 80, 443...and UDP port 500, 1723, and 4500.

I used to run OpenVPN to my home network, since that's the general recommendation, and Cisco VPN to the school, and later work, networks, and I've had more connectivity issues with OpenVPN. Switching to one of ports 53, 80, or 443 generally works, but Cisco VPN always "just works"...connectivity wise anyway. The client software broke like every other minor OS update. I even switched to PPTP for a while, because it'd also always worked, plus support was built into the OS. And that's what drew my attention to L2TP/IPsec.

Finally, when Tunnelblick stopped working after one of the OS X major upgrade, I looked into setting up L2TP/IPsec, and have been using it since.

Maybe IPsec is more often blocked in Europe / Asia / Africa?

Post reply on HN