Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detailed VPN Comparison Chart

thatoneprivacysite.net

Post reply on HN
Print view View original

61–70 of 71 posts

Re: Detailed VPN Comparison Chart

#61

Post by Smushman »

brotherjerky wrote: post #41
inertial wrote: post #39

And a few DIY VPN options (open source ansible etc. scripts) that have been features on HN recently (in order of popularity) https://github.com/jlund/streisand (6000+ stars) https://github.com/sovereign/sovereign (6000+ stars) https://github.com/Nyr/openvpn-install (3000+ stars) https://github.com/ttlequals0/autovpn (1400+ stars) https://github.com/trailofbits/algo (1100+ stars) https://github.com/robbintt/popup-open…

Has anyone setup OpenVPN via Docker? I've seen some of the images, just wondering if anyone has actually got it working.

Using openvpn with deluge in UnRaid as a container - runs flawlessly, and not leaking (re: data out of the VPN) as verified by firewall logs for 3 months now.

Re: Detailed VPN Comparison Chart

#62

Post by jagermo »

jessaustin wrote: post #44
jlgaddis wrote: post #28

Earlier quoted context omitted.

I don't see a "disclaimer/disclosure" (kinda standard practice around here) so I assume your username is entirely coincidental?

The 'name and the link are less than a centimeter apart on one's screen. That seems enough to clue in most readers?

plus, the OP talks in the third person "should use their serivce", so it is a little misleading.

Re: Detailed VPN Comparison Chart

#63

Post by terrywang »

RJIb8RBYxzAMX9u wrote: post #56

Genuine question: why's OpenVPN so popular over L2TP/IPsec? Configuration on the server side is maybe a little more complicated, but configuration on the client side is super simple, as all major OS, mobile or otherwise, have support built-in. I've read arguments that firewalls tend to block IPsec packets, but there's also UDP encapsulation. And IME, I've never had connectivity issues, from multiple random coffee sho…

L2TP/IPsec is obsolete, itself does NOT provide encryption or confidentiality to traffic passes through it. L2TP/IPsec encapsulates data twice at layer 2, it has pros and cons. See this (may be out-dated) -> https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs...

IKEv{1,2} + IPsec (ESP) (tunnel mode) is recommended. strongSwan is probably the best free, open source IPsec solution out there (much better than libreswan...), good documentation, use cases and examples etc, actively developed and maintained by a group of passionate developers that knows the stuff well.

My employer (pre-IPO startup) has been using strongSwan for 2+ years as site-to-site solution from AWS VPC to on-premises data centres (or other cloud virtual network), proved to be rock solid as long as it's properly configured (pretty much all outages were caused by AWS...) ;-)

The only drawback is that strongSwan currently does NOT have a mature HA solution but it's shaping up (5.4.0 introduced IKEv2 redirect). Hopefully a proper HA solution (not sure if it is something similar to VRRP - curious to know more - PLEASE comment) will be built on top and later productized ;-)

In addition: I myself have been using strongSwan since its 5.0.x for remote access, to protect privacy, fight censorship (yes, originally from China mainland where the infamous GFW is in place...). The native strongSwan client for Android is a killer feature, RSA authentication with X509 certificates works flawlessly with 1 click ;-)

BTW: OpenVPN is SSL VPN, relatively easy to install and configure, that's why it's more popular (remote access). IPsec works at IP layer (layer 3), generally speaking it requires deeper networking knowledge and more experience to get things right. OpenVPN is harder to block as it can disguise as HTTPS (TLS) or other traffic while IPsec requires UDP ports 500 (IKE) and 4500 (NAT-T) to work which is easier to block.

HTH

Re: Detailed VPN Comparison Chart

#64

Post by okbake »

jessaustin wrote: post #44
jlgaddis wrote: post #28

Earlier quoted context omitted.

I don't see a "disclaimer/disclosure" (kinda standard practice around here) so I assume your username is entirely coincidental?

The 'name and the link are less than a centimeter apart on one's screen. That seems enough to clue in most readers?

Yeah, it's not so subtle. But then again:

> ThatOnePrivacyGuy should use their open source speed test tool instead

Using their instead of our makes it sound like there is no affiliation.

Re: Detailed VPN Comparison Chart

#65

Post by brotherjerky »

Smushman wrote: post #61
brotherjerky wrote: post #41

Earlier quoted context omitted.

Has anyone setup OpenVPN via Docker? I've seen some of the images, just wondering if anyone has actually got it working.

Using openvpn with deluge in UnRaid as a container - runs flawlessly, and not leaking (re: data out of the VPN) as verified by firewall logs for 3 months now.

Nice, which docker image?

Re: Detailed VPN Comparison Chart

#66

Post by ergot »

inertial wrote: post #39

And a few DIY VPN options (open source ansible etc. scripts) that have been features on HN recently (in order of popularity) https://github.com/jlund/streisand (6000+ stars) https://github.com/sovereign/sovereign (6000+ stars) https://github.com/Nyr/openvpn-install (3000+ stars) https://github.com/ttlequals0/autovpn (1400+ stars) https://github.com/trailofbits/algo (1100+ stars) https://github.com/robbintt/popup-open…

Brilliant list. I always wondered how many commercial VPN providers use code from these. I suspect setting up the VPN is easy enough, but coding the billing backend might be trickier.

Re: Detailed VPN Comparison Chart

#67

Post by ergot »

michaelt wrote: post #18

If I was the NSA, I'd certainly be looking to launch a VPN company or two - maybe even subsidising their offerings, to get them to the top of the performance and value for money charts. After all, getting users to voluntarily direct their traffic through your network would be much easier than installing snooping hardware at every ISP, backdooring hardware in transit or snooping on undersea cables.

> Maybe even subsidising their offering

Yeah there's a few VPNs that look shady because of their pricing. One that springs to mind is LeafVPN[1]. For $5.00 you get to send all your traffic to Mallory. And it even has `LEA` as the first three letters, so you're safe! This is not an endorsement of this service BTW.

[1]: https://leafvpn.com

Re: Detailed VPN Comparison Chart

#68

Post by Smushman »

brotherjerky wrote: post #65
Smushman wrote: post #61

Earlier quoted context omitted.

Using openvpn with deluge in UnRaid as a container - runs flawlessly, and not leaking (re: data out of the VPN) as verified by firewall logs for 3 months now.

Nice, which docker image?

I believe this is what you were looking for:

binhex/arch-delugevpn

If you have trouble reach out again.

Re: Detailed VPN Comparison Chart

#69

Post by ionised »

pilif wrote: post #25
michaelt wrote: post #18

If I was the NSA, I'd certainly be looking to launch a VPN company or two - maybe even subsidising their offerings, to get them to the top of the performance and value for money charts. After all, getting users to voluntarily direct their traffic through your network would be much easier than installing snooping hardware at every ISP, backdooring hardware in transit or snooping on undersea cables.

> If I was the NSA, I'd certainly be looking to launch a VPN company or two not worth the trouble when you can just compel existing VPN companies to send all traffic to you.

In foreign jurisdictions?

Re: Detailed VPN Comparison Chart

#70

Post by sarsaparilla »

JorgeGT wrote: post #52
sarsaparilla wrote: post #46

Earlier quoted context omitted.

If you're the only user of your VPN, doesn't that make it pretty easy to trace your usage back to you? I would have thought that using a VPN Provider would assist privacy by making it hard to figure out which client initiated the any request coming out of the VPN node...

A local adversary (in your network) can know that you're establishing a connection to a certain IP in another country, but they cannot know what that particular machine is accessing in turn. [This is my threat model, I use this in public WiFi]. And a remote adversary (who sees your VPS IP) cannot know who is, in turn, connected to that VPS, unless they can extract that information from the VPS provider via court orde…

That's a fair analysis. I guess I was imagining something like a government. For example, the UK one would now be able to see that you're establishing a connection to your VPS IP. However, I don't know if they would then be able to see the connections from there to various hosts back in the UK.
Post reply on HN