7 ms·

I used to maintain an ipsec VPN for road warrior type scenarios, but I've found that mostly I just wanted to get a remote desktop on a computer within the netwo

I used to maintain an ipsec VPN for road warrior type scenarios, but I've found that mostly I just wanted to get a remote desktop on a computer within the network. So I've stopped mucking around with VPN and just published Apache Guacamole HTML5 VNC/RDP tunnels. No plugins, no clients except a modern web browser and good security with certbot+auto redirect to https+simple auth to keep badguys away from possible exploits in the guacamole login form. Configs can be as simple as the NoAuth plugin, all the way to full integration with eg. AD. I've implemented this at a number of businesses, and it does what almost everyone in the organization wants. It also supports things like printing (to a pdf that comes thru the browser as a download) and file transfer. Super easy to set up and is much more responsive than VNC or RDP thru ssh. The times when I actually want full IP access to a network from my laptop are so rare that it seemed silly to maintain IPSec. What need do others have for full-connectivity VPNs? Not site-to-site VPNs of course, but these ad-hoc on the road type ones. Honest question

michaelmior 9y ago
> It also supports things like printing (to a pdf that comes thru the browser as a download) Wow, didn't know that. Impressive!
pcl 9y ago
I VPN back to my home network when I’m abroad so I can watch US Netflix shows.
- yeukhon 9y ago
  Curious but why?
  - iforgotpassword 9y ago
    Because he likes watching US Netflix shows.
  - aurelianito 9y ago
    Shows available on Netflix depend on location.
- YouKnowBetter 9y ago
  Being local in a country with a limited Flix library, I have a hard time still paying for the (most excellent!) service. And since Flix has succesfully banned all commercial VPN's, I am more and more contemplating seting up a "share your own local IP for Flix affectionados" with a couple of people. How do others solve / done / consider this?
  - carlhjerpe 9y ago
    Problem is they not only banned most commercial VPNs but i believe they pretty much banned entire ASN's from watching their stuff. So it's not like you can just go ahead and and set a VPS up somewhere, because it'll be blocked too :(
bhauer 9y ago
I recently wrote about my home VPN setup in a previous HN thread [1]. But to answer your question, the additional use-cases I have are: 1. I connect to my home file server from all of my devices. This allows me to access my singular master file system from everywhere, which includes all of my documents and data. For example, I can reach my Keepass database from all devices without any need for clumsy synchronization or a third-party "cloud" provider. 2. I view my security camera streams by reaching my on-premises NVR from anywhere. 3. I can print to home from anywhere. 4. My entire media library is available from anywhere. 5. I can reach my family's home intranet web-app from all of my devices (e.g., my phone), natively. It's true that all of this could be done in a remote desktop window, but it would be less smooth and less convenient. E.g., using Keepass in a remote desktop window wouldn't be as convenient as running it locally (with the kdbx loaded from the file server). [1] https://news.ycombinator.com/item?id=15586997 https://news.ycombinator.com/item?id=15586997
- atmosx 9y ago
  What's your upstream speed at home?
- linker3000 9y ago
  I have pretty much the same functionality, including the printing, plus I have a home IoT setup. Through the MQTT app on my phone I can view and control the home heating, see the output from various sensors (like house temp and outside temp) and control some of the lights - all without having to send my data to a commercial product's cloud service to manage things. The IoT hub is an Atom-based Mini ITX machine running Ubuntu server, Mosquitto (MQTT message broker), Node-Red (MQTT message handler) and Home Assistant to manage some of the sensors and automation (although Node-Red does most of the work). I'll probably move the whole lot to a Raspberry Pi at some time. This setup is more of a base to exercise my electronics hobby skills than a serious attempt to automate everything - for example, the home heating IoT stuff overlays (rather than replaces) the traditional electronic timer and temperature sensors on the heating/hot water system, so if the IoT cleverness goes offline, watchdog relays will return control to the old timer/sensors. VPN access is through a Draytek xDSL Router (2860) - they have good inbuilt VPN support.
- 9y ago
manigandham 9y ago
For everyone else, I recommend https://pritunl.com https://pritunl.com or https://www.zerotier.com https://www.zerotier.com to get VPN access easily. Pritunl is more traditional client/server while ZeroTier creates 1 giant LAN between as many machines as you want.
- qaq 9y ago
  Thank you for mentioning them!!! Was just looking for a solution for connecting my VPSs across DO, Vultr and Lightsale ZeroTier looks like a perfect solution
  - carlhjerpe 9y ago
    ZeroTier is the perfect solution, it's the most genious VPN solution i've seen. http://packetpushers.net/podcast/podcasts/pq-134-meet-zerotier-open-source-networking/ http://packetpushers.net/podcast/podcasts/pq-134-meet-zeroti... <- Here's a Pod with the creator of ZT, once you've listened to it you'll realize how it fits everyone =)
vbezhenar 9y ago
1. My country bans a lot of websites, so I'm often using netherlands VPN to circumvent this ban. Also internet provider at my work sends angry emails when I'm downloading torrents, so I'm downloading them over VPN as well. I don't really see any alternative to VPN. 2. My home server contains some interesting services for me (file storage, movies, music, passwords), but I don't want to expose them to the internet, so I exposed it to VPN and protected with very minimal authorization (nginx checking value of specific cookie acting as a password). So I'm using VPN as a main protection for weakly protected services. 3. I didn't implement it yet, but I want to receive my mail on my home server. Currently mail server operates on VPN server, so I can't really be sure that nobody reads my mail. But operating e-mail requires static IP and reverse-ptr record which isn't available from my home internet provider. So I want to use some kind of port mapping with VPN to transfer everything to my home server. Though ssh would work well here, but I would need to think about reconnecting if network is down, I expect VPN to be more stable.
pletnes 9y ago
Ssh to access various servers/git repos/my desktop. Ssh in a local window is always snappy. Terminal access in a RDP/VNC window is not. Not to mention modifier key issues etc...
- DrPhish 9y ago
  Guacamole also supports SSH/telnet, and is very snappy thru html5. I autogenerate a guac config file for all the switches on each site at work, and even on high-latency low-bandwith sites on wireless it still works great. Definitely better than a console session via RDP or VNC. This has the extra benefit that you can lock your switches down to only be managed thru certain IPs and enforce session recording.
closeparen 9y ago
Many companies (including startups) have internal tools that are web applications. While the more adventurous firms put these on public IPs behind an employee login/SSO system, the more conservative will always have them behind VPN. VNC is a drastically worse UX than a local browser unless your endpoints are really bad. Honestly, I think you can get a similar security posture with a reverse proxy enforcing client certificates and 2FA (this is what my employer does), but people feel more comfortable trusting VPN appliances from big-name vendors than their nginx configs. Harder to fail open, certainly.

michaelmior 9y ago

> It also supports things like printing (to a pdf that comes thru the browser as a download) Wow, didn't know that. Impressive!

pcl 9y ago

I VPN back to my home network when I’m abroad so I can watch US Netflix shows.

yeukhon 9y ago
Curious but why?
- iforgotpassword 9y ago
  Because he likes watching US Netflix shows.
- aurelianito 9y ago
  Shows available on Netflix depend on location.
YouKnowBetter 9y ago
Being local in a country with a limited Flix library, I have a hard time still paying for the (most excellent!) service. And since Flix has succesfully banned all commercial VPN's, I am more and more contemplating seting up a "share your own local IP for Flix affectionados" with a couple of people. How do others solve / done / consider this?
- carlhjerpe 9y ago
  Problem is they not only banned most commercial VPNs but i believe they pretty much banned entire ASN's from watching their stuff. So it's not like you can just go ahead and and set a VPS up somewhere, because it'll be blocked too :(

bhauer 9y ago

I recently wrote about my home VPN setup in a previous HN thread [1]. But to answer your question, the additional use-cases I have are: 1. I connect to my home file server from all of my devices. This allows me to access my singular master file system from everywhere, which includes all of my documents and data. For example, I can reach my Keepass database from all devices without any need for clumsy synchronization or a third-party "cloud" provider. 2. I view my security camera streams by reaching my on-premises NVR from anywhere. 3. I can print to home from anywhere. 4. My entire media library is available from anywhere. 5. I can reach my family's home intranet web-app from all of my devices (e.g., my phone), natively. It's true that all of this could be done in a remote desktop window, but it would be less smooth and less convenient. E.g., using Keepass in a remote desktop window wouldn't be as convenient as running it locally (with the kdbx loaded from the file server). [1] https://news.ycombinator.com/item?id=15586997 https://news.ycombinator.com/item?id=15586997

atmosx 9y ago
What's your upstream speed at home?
linker3000 9y ago
I have pretty much the same functionality, including the printing, plus I have a home IoT setup. Through the MQTT app on my phone I can view and control the home heating, see the output from various sensors (like house temp and outside temp) and control some of the lights - all without having to send my data to a commercial product's cloud service to manage things. The IoT hub is an Atom-based Mini ITX machine running Ubuntu server, Mosquitto (MQTT message broker), Node-Red (MQTT message handler) and Home Assistant to manage some of the sensors and automation (although Node-Red does most of the work). I'll probably move the whole lot to a Raspberry Pi at some time. This setup is more of a base to exercise my electronics hobby skills than a serious attempt to automate everything - for example, the home heating IoT stuff overlays (rather than replaces) the traditional electronic timer and temperature sensors on the heating/hot water system, so if the IoT cleverness goes offline, watchdog relays will return control to the old timer/sensors. VPN access is through a Draytek xDSL Router (2860) - they have good inbuilt VPN support.
9y ago

manigandham 9y ago

For everyone else, I recommend https://pritunl.com https://pritunl.com or https://www.zerotier.com https://www.zerotier.com to get VPN access easily. Pritunl is more traditional client/server while ZeroTier creates 1 giant LAN between as many machines as you want.

qaq 9y ago
Thank you for mentioning them!!! Was just looking for a solution for connecting my VPSs across DO, Vultr and Lightsale ZeroTier looks like a perfect solution
- carlhjerpe 9y ago
  ZeroTier is the perfect solution, it's the most genious VPN solution i've seen. http://packetpushers.net/podcast/podcasts/pq-134-meet-zerotier-open-source-networking/ http://packetpushers.net/podcast/podcasts/pq-134-meet-zeroti... <- Here's a Pod with the creator of ZT, once you've listened to it you'll realize how it fits everyone =)

vbezhenar 9y ago

1. My country bans a lot of websites, so I'm often using netherlands VPN to circumvent this ban. Also internet provider at my work sends angry emails when I'm downloading torrents, so I'm downloading them over VPN as well. I don't really see any alternative to VPN. 2. My home server contains some interesting services for me (file storage, movies, music, passwords), but I don't want to expose them to the internet, so I exposed it to VPN and protected with very minimal authorization (nginx checking value of specific cookie acting as a password). So I'm using VPN as a main protection for weakly protected services. 3. I didn't implement it yet, but I want to receive my mail on my home server. Currently mail server operates on VPN server, so I can't really be sure that nobody reads my mail. But operating e-mail requires static IP and reverse-ptr record which isn't available from my home internet provider. So I want to use some kind of port mapping with VPN to transfer everything to my home server. Though ssh would work well here, but I would need to think about reconnecting if network is down, I expect VPN to be more stable.

pletnes 9y ago

Ssh to access various servers/git repos/my desktop. Ssh in a local window is always snappy. Terminal access in a RDP/VNC window is not. Not to mention modifier key issues etc...

DrPhish 9y ago
Guacamole also supports SSH/telnet, and is very snappy thru html5. I autogenerate a guac config file for all the switches on each site at work, and even on high-latency low-bandwith sites on wireless it still works great. Definitely better than a console session via RDP or VNC. This has the extra benefit that you can lock your switches down to only be managed thru certain IPs and enforce session recording.

closeparen 9y ago

Many companies (including startups) have internal tools that are web applications. While the more adventurous firms put these on public IPs behind an employee login/SSO system, the more conservative will always have them behind VPN. VNC is a drastically worse UX than a local browser unless your endpoints are really bad. Honestly, I think you can get a similar security posture with a reverse proxy enforcing client certificates and 2FA (this is what my employer does), but people feel more comfortable trusting VPN appliances from big-name vendors than their nginx configs. Harder to fail open, certainly.