Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to build your own VPN if you're wary of commercial options

arstechnica.com

Post reply on HN
Print view View original

91–100 of 117 posts

Re: How to build your own VPN if you're wary of commercial options

#91

Post by cat199 »

super-io wrote: post #71
LinuxBender wrote: post #26

Earlier quoted context omitted.

There are use cases that make sense. My home linux router intercepts and sends all DNS and NTP requests, then routes all DNS requests to multiple VPS nodes that in turn, use multiple DNS recursors at each VPS datacenter. I intentionally avoid google and opendns. I override the min-ttl of all requests to avoid some shenanigans and I am well aware of the issues this can cause. At a minimum, my ISP can not see or tamper…

"At a minimum, my ISP can not see or tamper with DNS requests." Are you encrypting each DNS packet at the source (e.g. your home recursor/DNS-forwwarder)? If yes, when are your sent packets decrypted? At the authoritative nameserver, or at some intermediary recursor? If no, how do you believe that your DNS packets are opaque and tamper resistant? There are very few authoritative nameservers on the internet that accep…

Pretty clear to me he's running DNS over the VPN, and so yes, 'ISP' referred to 'his immediately upstream ISP', and so yes,

OP is "creating a chain of recursors (that you control?) to make tracing the requests more difficult"

but also, as a result less difficult to tamper with by a less trusted party such as a mass market commercial ISP - tampering with his forwarder would entail either tampering with random many other peoples traffic or compromising the 'percieved as more secure' ISP.

Pretty sure someone mucking around with TTL's on these packets to make sure they don't get too far out of intended range and the numerous other things would be aware of these issues..

Re: How to build your own VPN if you're wary of commercial options

#92

Post by cat199 »

filleokus wrote: post #9

I would like to have a setup like this: - One VPN to connect laptop on the road with machines at home LAN, and with VM:s on different hosts. - Have this VPN "exit" via a commercial VPN-provider (for privacy). Could I easily configure this? Have one of the VM's be the VPN server and configure it to "exit" trough the commercial VPN? I haven't really managed / configured "real" VPN's, how does local access work? I.e, wh…

It's all about the routing table and subnet masks/link-local addressing.

start with the lan and configuring interfaces statically.. then run your own router (manually) then setup your portion of VPN to your VM.

by that time, the rest will all make sense.

Re: How to build your own VPN if you're wary of commercial options

#93

Post by cat199 »

yaantc wrote: post #59
the_common_man wrote: post #38

What's the difference between L2TP/IPsec and OpenVPN?

They are three different protocols allowing to tunnel encrypted traffic between two end points: - L2TP is the "layer 2 tunneling protocol", where the layer 2 is usually PPP, and an IETF standard; - IPsec is designed to tunnel IP over IP, and an IETF standard; - OpenVPN is a specific software and protocol, using TLS. IF memory serves well it can operate at both Ethernet and IP level, although IP is the most common.

To add, L2TP is only tunneling and not encrypted, which is why it is often used in combination with IPSec.

It is used instead of pure IPSec because it allows non IP traffic, which in some cases is more important (e.g. windows non-IP netbios traffic interop when L2TP/IPSec was first made popular)

and to confirm, yes, OpenVPN will run in IP or ethernet mode.

Re: How to build your own VPN if you're wary of commercial options

#94

Post by cam_l »

greglindahl wrote: post #21
aphextron wrote: post #18

Earlier quoted context omitted.

>The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. Yes, but what good is a VPN where you cannot trust your own network? I would have zero trust in any closed source private VPN. There are ways to gain anonymity from your host that wont require setting up a MITM attack vector for your traffic.

I get a lot of value from a VPN that prevents my ISP from spying on my traffic. I see from looking around this conversation that two other people cited this same reason. I could totally see that many people wouldn't care about this particular thing.

Not just spying either, but if you are in oz at least, keeping all that metadata in a big, juicy, government mandated, and poorly secured bundle for 2 years!

Re: How to build your own VPN if you're wary of commercial options

#95

Post by mappu »

super-io wrote: post #77

"First your website uses SNI..." s/uses/may use/ Not every website uses SNI. For example, the majority of sites linked to from HN do not use SNI. Also, there are workarounds when SNI is not supported. Workarounds have been published by one major corporation who authors a popular web server software and runs a cloud hosting service. Is SNI "the only way to do it"? No. There is another way to do stream encryption for m…

I am interested in this idea, but I don't expect a better solution than SNI to appear anytime soon.

RFC2817's `Upgrade: TLS` is just like SNI except it requires an extra roundtrip and it only works for HTTP, not other TLS-enabled services experiencing the same issue (e.g. IRCS, FTPS, ...).

For an HTTPS server with a single certificate and no SNI handling, the domain name is (A) still leaked in plaintext by the initial DNS lookup, and (B) instantly visible by anyone who connects to the IP address.

Even if you plug the DNS hole, the fundamental issue is needing to secure communications with the remote server, before you even tell it what domain you're asking for. That can't work under the domain-validation CA model.

I suppose you could add an extra layer of indirection, by adding a certificate for the server itself; but that's just moving the chain of trust, and it's practically equivalent to a multi-domain SAN certificate.

Re: How to build your own VPN if you're wary of commercial options

#97

Post by pg_is_a_butt »

jankotek wrote: post #33
cyruscm wrote: post #8

Earlier quoted context omitted.

Exactly. The author says because hosting companies are big they would never give information but this is a complete flaw. Google and Reddit are both known to hand information to law enforcement. Companies like digital ocean don't put as high as emphasis on customer privacy as companies likes PIA. On 90% of the service portals for servers I've purchased have had a message showing my IP was logged for safety reasons. S…

Put your consideration in Germany, privacy is pretty enforced here.

where your soldiers don't have to do anything that they don't feel like doing....

Re: How to build your own VPN if you're wary of commercial options

#99

Post by ereyes01 »

masmullin wrote: post #22
AdmiralAsshat wrote: post #3

The problem with a home-grown VPN is that you lose some of the plausible deniability that's gained from a shared VPN. If you have a VPN connected to a privately-owned AWS instance, the IP coming from that AWS instance is easily traced back to you. Whereas if your external IP is coming from a cluster that is shared by thousands of other people using that VPN, it is more difficult for someone to tie that specifically b…

> AWS instance is easily traced back to you. Define "easily" as used in this context. Easy is a product of whom your enemy is. Is your enemy your ISP? If that's the case, I don't think it's "easy" for them; they would have to pay Digital Ocean or Amazon to get your data, and probably isn't really that valuable to them. Is your enemy the MPAA? If that's the case, I still don't think it's particularly "easy" for them.…

Digital ocean outed me to the MPAA (they forwarded me a warning), but they didn't cancel my account. I now proxy my torrent client on top of the VPN.
Post reply on HN