5 ms·

+1 for tinc. I've used it for years in VPS providers and from home to VPS to cloak DNS from the ISP eyes and tampering. It's not as fast as strongswan or wire

+1 for tinc. I've used it for years in VPS providers and from home to VPS to cloak DNS from the ISP eyes and tampering. It's not as fast as strongswan or wireguard, but it has dynamic mesh routing. If one of my nodes is down, I route through the others automagically, all in user space without having to enable forwarding on any nodes. This is handy when backbone providers are having issues.

kitotik 9y ago
Mostly the same feedback, though I’m curious on the performance differences you’re seeing with strongswan. In my setups, strongswan seems to induce ~25% hit, compared to ~15% with tincd. I’m a noob with strongswan so I’m sure it’s something with my setup.
- LinuxBender 9y ago
  Are you also doing UDP encapsulation and any additional NAT's? I'm using transport mode on strongswan. I get about 3% overhead with strongswan and about 5% with tinc, but the throughput on tinc caps out much sooner for me than with strongswan when dealing with high RTT. It could be the tun driver in CentOS causing my issues, possibly.
  - nh2 9y ago
    Overhead over what, and at which line speed? 1 Gbit/s, 10 Gbit/s? Tinc on bare metal hardware has pretty low CPU usage at 1 Gbit/s, but not so at 10 Gbit/s.
arca_vorago 9y ago
Interesting, I usually just ssh tunnel (I liked the idea of https://github.com/apenwarr/sshuttle/ https://github.com/apenwarr/sshuttle/) but I like the idea of making things a bit easier on myself, gonna have to checkout tinc.
- rsync 9y ago
  The apenwarr/sshuttle is abandoned - the current sshuttle, which is under active development, is here: https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle Highly recommended. Allows you to use any server running SSH as a VPN endpoint with no configuration necessary - you just need a working login.
  - arca_vorago 9y ago
    Thank you very much!
  - crtasm 9y ago
    Do you know if it has leak protection built in (prevent traffic when sshuttle's connection drops)? I can't see it mentioned in the documentation.
gruez 9y ago
>I've used it for years in VPS providers and from home to VPS to cloak DNS from the ISP eyes and tampering. what's the logic behind that? are vps providers somehow more trustworthy than ISPs?
- ryanlol 9y ago
  >are vps providers somehow more trustworthy than ISPs? Random small providers from lowendtalk or whatever may not be, but yeah vast majority of hosting providers will be far more trustworthy than any residential ISP. However, life tends to be much easier if you avoid VPS providers and just get a cheap dedicated server from somebody like OVH instead.
  - metalliqaz 9y ago
    > but yeah vast majority of hosting providers will be far more trustworthy than any residential ISP. [citation needed]
    - ryanlol 9y ago
      1) Incentives, residential ISPs obviously have a far bigger incentive to try and monetize your traffic. 2) No lock-in for hosting products, way more competitive hosting market, hosting companies have incentive to provide better service than residential ISPs. 3) Residential ISPs tend to have a far bigger attack surface and less trained staff. I hacked many of the worlds biggest ISPs and hosting companies, the ISPs were always running Solaris from a decade ago.
    - mirimir 9y ago
      One reason is that you and your ISP are almost certainly under the same jurisdiction. So your ISP is more likely subject to coercion by your government, compared with VPS providers in other jurisdictions. Further, you can choose VPS providers in jurisdictions where such coercion will not likely be successful.
  - jrnichols 9y ago
    "just get a cheap dedicated server " what does one consider to be "cheap" for a dedicated server these days?

kitotik 9y ago

Mostly the same feedback, though I’m curious on the performance differences you’re seeing with strongswan. In my setups, strongswan seems to induce ~25% hit, compared to ~15% with tincd. I’m a noob with strongswan so I’m sure it’s something with my setup.

LinuxBender 9y ago
Are you also doing UDP encapsulation and any additional NAT's? I'm using transport mode on strongswan. I get about 3% overhead with strongswan and about 5% with tinc, but the throughput on tinc caps out much sooner for me than with strongswan when dealing with high RTT. It could be the tun driver in CentOS causing my issues, possibly.
- nh2 9y ago
  Overhead over what, and at which line speed? 1 Gbit/s, 10 Gbit/s? Tinc on bare metal hardware has pretty low CPU usage at 1 Gbit/s, but not so at 10 Gbit/s.

arca_vorago 9y ago

Interesting, I usually just ssh tunnel (I liked the idea of https://github.com/apenwarr/sshuttle/ https://github.com/apenwarr/sshuttle/) but I like the idea of making things a bit easier on myself, gonna have to checkout tinc.

rsync 9y ago
The apenwarr/sshuttle is abandoned - the current sshuttle, which is under active development, is here: https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle Highly recommended. Allows you to use any server running SSH as a VPN endpoint with no configuration necessary - you just need a working login.
- arca_vorago 9y ago
  Thank you very much!
- crtasm 9y ago
  Do you know if it has leak protection built in (prevent traffic when sshuttle's connection drops)? I can't see it mentioned in the documentation.

gruez 9y ago

>I've used it for years in VPS providers and from home to VPS to cloak DNS from the ISP eyes and tampering. what's the logic behind that? are vps providers somehow more trustworthy than ISPs?

ryanlol 9y ago
>are vps providers somehow more trustworthy than ISPs? Random small providers from lowendtalk or whatever may not be, but yeah vast majority of hosting providers will be far more trustworthy than any residential ISP. However, life tends to be much easier if you avoid VPS providers and just get a cheap dedicated server from somebody like OVH instead.
- metalliqaz 9y ago
  > but yeah vast majority of hosting providers will be far more trustworthy than any residential ISP. [citation needed]
  - ryanlol 9y ago
    1) Incentives, residential ISPs obviously have a far bigger incentive to try and monetize your traffic. 2) No lock-in for hosting products, way more competitive hosting market, hosting companies have incentive to provide better service than residential ISPs. 3) Residential ISPs tend to have a far bigger attack surface and less trained staff. I hacked many of the worlds biggest ISPs and hosting companies, the ISPs were always running Solaris from a decade ago.
  - mirimir 9y ago
    One reason is that you and your ISP are almost certainly under the same jurisdiction. So your ISP is more likely subject to coercion by your government, compared with VPS providers in other jurisdictions. Further, you can choose VPS providers in jurisdictions where such coercion will not likely be successful.
- jrnichols 9y ago
  "just get a cheap dedicated server " what does one consider to be "cheap" for a dedicated server these days?