Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Building a Simple VPN with WireGuard with a Raspberry Pi as Server

snikt.net

Post reply on HN
Print view View original

91–100 of 126 posts

Re: Building a Simple VPN with WireGuard with a Raspberry Pi as Server

#91

Post by msh »

0xEFF wrote: post #57
sjy wrote: post #53

For anyone else wanting to set this up at home, I’d recommend installing the vyatta-wireguard module [1] on an EdgeRouter X instead. It costs about the same as a Raspberry Pi, and you get a reliable network appliance with four gigabit ports and PoE, rather than a general purpose Linux box with graphics and USB. I’ve found the WireGuard module to be fast enough to keep up with my 100/40 Mbps internet connection, and n…

I upgraded from an ER-X to an ER-4 because the X can’t do full 1000 Mbit with PPPoE fiber without hardware offload. With hardware offload turned on there’s a bug in the hardware that causes some sites, most notably Netflix, to not route at all. The ER-4 has been great with the Cavium hardware. No hardware offload issues like this. Edit: The ER-X tops out around 500 Mbit with hardware offload turned off.

Huh. I have a er-x with hardware offloading turned on. I have noticed no issues with netflix.

I get about 900 megabit on my gigabit fiber.

Re: Building a Simple VPN with WireGuard with a Raspberry Pi as Server

#92

Post by nerdkid93 »

Naac wrote: post #43
riston wrote: post #42

I have been using ZeroTier( https://www.zerotier.com/ ) much simpler solution to setup.

Doesn't sound like it's Open Source to me. "A commercial license is only needed if you want to offer a paid network management service or embed it into a proprietary device or app." I would stay away from software that wants to restrict how you use it.

Their library version is GPL-3.0, so I'd say while everything might not be open source, some of their utilities are: https://github.com/zerotier/libzt

Re: Building a Simple VPN with WireGuard with a Raspberry Pi as Server

#93

Post by DavideNL »

doctoboggan wrote: post #76
ekianjo wrote: post #60

Earlier quoted context omitted.

No degraded performance in my experience, at least not visibly. Only drawback is more battery consumption.

About how much more consumption?

On an iPhone you will not notice the difference, it's negligible

Re: Building a Simple VPN with WireGuard with a Raspberry Pi as Server

#94

Post by jlgaddis »

3fe9a03ccd14ca5 wrote: post #88
nucleardog wrote: post #70

Earlier quoted context omitted.

> First of all, at least one of the CIDRs is wrong ("Address = 10.200.200.2/24"). Also by setting AllowedIPs to to 10.200.200.0/24 in the client, only traffic to that subnet will actually go through the VPN, not all traffic. Not sure what your issue is with the address line. As for the AllowedIPs, that's intentional. From the first lines of the article: > An Linux Laptop that should use the VPN only accessing network…

Is 10.200.200.2/24 a valid cidr? Does the system just ignore the trailing 2 and assume it’s a 0?

10.200.200.2/24 is a shorthand form (a.k.a. "CIDR notation") of saying IP address 10.200.200.2 with a 24-bit subnet mask (255.255.255.0).

Re: Building a Simple VPN with WireGuard with a Raspberry Pi as Server

#95

Post by bisby »

0xEFF wrote: post #57
sjy wrote: post #53

For anyone else wanting to set this up at home, I’d recommend installing the vyatta-wireguard module [1] on an EdgeRouter X instead. It costs about the same as a Raspberry Pi, and you get a reliable network appliance with four gigabit ports and PoE, rather than a general purpose Linux box with graphics and USB. I’ve found the WireGuard module to be fast enough to keep up with my 100/40 Mbps internet connection, and n…

I upgraded from an ER-X to an ER-4 because the X can’t do full 1000 Mbit with PPPoE fiber without hardware offload. With hardware offload turned on there’s a bug in the hardware that causes some sites, most notably Netflix, to not route at all. The ER-4 has been great with the Cavium hardware. No hardware offload issues like this. Edit: The ER-X tops out around 500 Mbit with hardware offload turned off.

I had an ER Lite, and hardware offload was re-validating packets. Things would come in as error, and come out the other side still invalid, but validated. And at the time my ISP was sending me a lot of uncorrectable errors. So a lot of services would refuse to run with hardware offload on, because the errors weren't being handled. (with it off, the errors were identified as errors and handled. slow, but accurate).

Then the pole outside my house got hit by lightning and fried the thing, and I replaced it with something from mikrotik.

Re: Building a Simple VPN with WireGuard with a Raspberry Pi as Server

#96

Post by jotef »

axiomdata316 wrote: post #55
sjy wrote: post #53

For anyone else wanting to set this up at home, I’d recommend installing the vyatta-wireguard module [1] on an EdgeRouter X instead. It costs about the same as a Raspberry Pi, and you get a reliable network appliance with four gigabit ports and PoE, rather than a general purpose Linux box with graphics and USB. I’ve found the WireGuard module to be fast enough to keep up with my 100/40 Mbps internet connection, and n…

I have this router and set up the wg interface but got stuck at how to route all my home traffic through wg. Any recommendations on how to troubleshoot this part?

I recommend following this blog post. Helped me a lot: https://andrew.dunn.dev/posts/wireguard-from-your-isp/

Re: Building a Simple VPN with WireGuard with a Raspberry Pi as Server

#97

Post by willis936 »

probablyexists wrote: post #3
als0 wrote: post #2

What's the throughput like on a Raspberry Pi?

I was only able to get ~60mbps with OpenVPN through a hard wired Raspberry Pi 3 connected to Google Fiber, due to limitations of its bus. The 4 is supposed to be actual gigabit, but I have not yet tried it out to confirm.

I just ran iperf from my Pi4 to my Ubuntu VM in the same LAN five minutes ago. 850 Mbps symmetric with no VPN.

Re: Building a Simple VPN with WireGuard with a Raspberry Pi as Server

#98

Post by h4waii »

josteink wrote: post #30

Ironically this looks considerably simpler than trying to get wireguard working on my OpenWRT router (and with much less collateral damage should I mess up). I might give this a try!

I've been running a WireGuard VPN on my OpenWrt router for quite a while with no issues whatsoever. Rock solid since I set it up, only has a 4 or 5 peers, but it's been excellent and I highly suggest it versus adding yet another single purpose device.

Not sure why the RPi is so lauded for this and Pi-Hole (which is just a fancy DNS blocklist) when OpenWrt is just as simple and powerful for both (and more) tasks.

Re: Building a Simple VPN with WireGuard with a Raspberry Pi as Server

#99

Post by bscphil »

willis936 wrote: post #97
probablyexists wrote: post #3

Earlier quoted context omitted.

I was only able to get ~60mbps with OpenVPN through a hard wired Raspberry Pi 3 connected to Google Fiber, due to limitations of its bus. The 4 is supposed to be actual gigabit, but I have not yet tried it out to confirm.

I just ran iperf from my Pi4 to my Ubuntu VM in the same LAN five minutes ago. 850 Mbps symmetric with no VPN.

I get 940 Mbps for two devices on the same switch.

Re: Building a Simple VPN with WireGuard with a Raspberry Pi as Server

#100

Post by oddly »

nreece wrote: post #52
brentjanderson wrote: post #39

Cool project - if you're looking to set up a secure VPN in a quick, no-nonsense way, be sure to look at [Algo]( https://github.com/trailofbits/algo ). Does WireGuard (and IPSec if you want), only secure, sane defaults, and nothing more. Hands down the easiest, most secure way to setup a modern VPN in a few minutes. Far better than using some random anonymous VPN service running out of some random person's closet that…

+1 for Algo. I've been using it since last year on a VM (took under 5 minutes to setup), for firewall access (SSH, RDP, DBs etc.) to work servers. Works great for secure access from anywhere when working remotely or travelling.

Also check out Streisand[0] if you're interested in this.

[0] https://github.com/StreisandEffect/streisand

Post reply on HN