10 ms·

Algo: A set of Ansible scripts that simplify the setup of a personal IPSEC VPN

189 points by uoflcards22 8y ago

givinguflac 8y ago
Serious question, do people consider a cloud provider to be more trustworthy than a professional VPN company?
- wetpaws 8y ago
  It depends on a cloud provider
- mirimir 8y ago
  It depends. Some VPN services will go out of their way to protect users' privacy. Because it's a moral issue for them. Or because they value their reputation. Others will sell you out, to avoid penalties and costs. And the same is true for cloud providers.
- filmgirlcw 8y ago
  Perhaps? If you’re using a VPN to protect your internet traffic from being sold to ad companies, probably. The VPN industry has become a racket full of affiliate schemes that push people towards plans and services that don’t necessarily act in the user’s best interest. Figuring out the food from the bad can be difficult. And I’ve seen some services that when audited use outdated or insecure stacks. Of course, if you’re using a VPN to try to protect your browsing activity from authorities, obviously a major cloud provider may be more willing to turn your info over to someone else.
  - mirimir 8y ago
    I've been using VPN services for over a decade. In my opinion, the most privacy friendly are AirVPN, Insorg, IVPN, Mullvad, Private Internet Access and Riseup. To my knowledge, HideMyAss, EarthVPN, IPVanish, PureVPN and WANSecurity have violated their users' privacy. For the most part, by sharing logs with investigators. Prudent providers make damn sure not to have any logs that could be seized.
    - Alexa_Anthony 8y ago
      Well, I will not advocate for any big brand here but it is also true that hidemyass, IPvanish, Purevpn has more than 50% total share of VPN users and indeed its true that new VPN services especially Private Internet Access is going great. I recently read some review of them at Bestvpn.co.
  - auslander 8y ago
    > Figuring out the food from the bad can be difficult Lol. Funny, good VPNs are like good fishing spots, the ones who know the difference tend not to share their favourites, keeping it for themselves :)
- sitepodmatt 8y ago
  Serious question, are there any professional VPN companies? Dont most VPN companies depend on cloud providers for many locations too. Most VPN companies have had serious screw ups in the past. PureVPN - disable all encryption by default for performance on their Windows client - for example. StrongVPN I recall logging. Other popular ones recur billing at top whack after a year and refusing refund. Overloaded servers, port blocking and so on.
- techsupporter 8y ago
  Trustworthy? I could go either way, depending on particular scenario. Usable? Infinitely. I've noticed quite a few web sites and services putting obnoxious blocks or filters or other impediments against users coming from "widely-known" VPN and VPS provider IP addresses. But few seem to bother with Microsoft or Amazon IPs. So for something that has the purpose of either getting me out from behind a restrictive network or wrapping my traffic on an insecure network, a VPN to an Azure- or EC2-provisioned virtual machine works just fine.
  - blacksmith_tb 8y ago
    I have a Streisand [1] server on a Digital Ocean droplet, and I do run into the occasional Cloudflare: blocked or extra-aggressive captcha when I am routed through it. 1: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
- LeoPanthera 8y ago
  It depends what you want. If you're trying to obtain some degree of anonymity, then a personal VPN server is obviously much worse, since you'll be a using a dedicated IP address just for you, instead of sharing a public one. But if you just want to secure your data from an untrustworthy local network, it's a reasonable choice. You're less likely to be flagged as connecting from a "bad" IP.
  - mirimir 8y ago
    You can have both. Mirimir reaches the Internet using a nested chain of three VPN services. The last being IVPN, given that I work for them. But then I use private VPNs on VPS when I need to pretend that I'm not using a VPN.
- auslander 8y ago
  a professional VPN company is probably using some cloud provider themselves.
accrual 8y ago
> Does not install Tor, OpenVPN, or other risky servers Although I recognize IPsec is a widely supported protocol and suitable for this use case, did the readme intend to imply OpenVPN is risky?
- Operyl 8y ago
  https://github.com/trailofbits/algo/issues/36 https://github.com/trailofbits/algo/issues/36 I guess they consider TLS to be a considerable risk. Theoretical I guess.
  - dguido 8y ago
    There is an FAQ that addresses "Why not OpenVPN?" including the specific security concerns with it: https://github.com/trailofbits/algo/blob/master/docs/faq.md#why-arent-you-using-openvpn https://github.com/trailofbits/algo/blob/master/docs/faq.md#...
nimbius 8y ago
>Algo supports DigitalOcean (most user friendly), Amazon Lightsail, Amazon EC2, Microsoft Azure, Google Compute Engine, Scaleway and OpenStack. four of the seven listed are cloud providers that actively encourage censorship for the sake of their business model. at best, you would be a fool to run a personal VPN on them, at worst the fact that support exists at all could be evidence that this software is in fact worse than openVPN or TOR in that it facilitates an obviously poor implementation. Google and Microsoft both joined the PRISM program in 2009. https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#Media_disclosure_of_PRISM https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#M...
nodesocket 8y ago
I prefer https://github.com/hwdsl2/setup-ipsec-vpn https://github.com/hwdsl2/setup-ipsec-vpn. Shamless blog post on setting it up on a Raspberry Pi 3 - https://blog.elasticbyte.net/setting-up-a-native-cisco-ipsec-vpn-server-using-a-raspberry-pi/ https://blog.elasticbyte.net/setting-up-a-native-cisco-ipsec...
- athrun 8y ago
  Thank you for posting this! I'll be checking this out. I like how the scope of this project is only about setting up an IPsec server automatically on a Linux box. Algo and Streisand have too much features, making them unwieldy.
- gmac 8y ago
  See also https://github.com/jawj/IKEv2-setup https://github.com/jawj/IKEv2-setup for IKEv2 (I made this)
verroq 8y ago
Not enough people have heard of Outline. https://getoutline.org/ https://getoutline.org/ It is a shadowsocks client and even non-technical users can provision VPNs on cloud hosting providers.
- voltagex_ 8y ago
  It's a Google/Alphabet project. Hmm.
  - dguido 8y ago
    It's not a Google project, it's a Jigsaw project. There's a huge difference, since one is run with extremely low resources and employees between the entities are not shared. Don't trust code that comes from Jigsaw. In my experience, it's all been haphazardly thrown together for a proof of concept and media coverage, not production quality software that people should use.
- dguido 8y ago
  Outline is a security disaster, and I strongly recommend against using it. - Shadowsocks is not a VPN, it's a per-application SOCKS proxy. What has Jigsaw done to ensure that packets don't leak outside of the tunnel? All UDP traffic leaks, so it looks like they did nothing! https://github.com/shadowsocks/shadowsocks-rust/issues/78 https://github.com/shadowsocks/shadowsocks-rust/issues/78 - Shadowsocks is dangerously full of bad configuration options to avoid. Did Jigsaw avoid all of them when it built Outline? Their copy of shadowsocks appears to use an unauthenticated CFB mode by default (https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d10358c2312d4e0ef286092763258acc/src/shadowbox/server/libev_shadowsocks_server.ts#L29 https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d...), but then this setting is overridden elsewhere. Good luck checking all the rest. - They enabled an automated update system they called "Watchtower." Is this safe to use? Who controls the keys? When are updates pushed out? How would it react to a subpoena? - Is shadowsocks safe? It's a giant pile of C that was purpose-built to evade censorship by the Chinese Great Firewall, nothing more. It wasn't written or designed by an expert in secure communications and it was not even intended for that purpose. It's had a bunch of bugs before (https://x41-dsec.de/lab/advisories/x41-2017-008-shadowsocks/ https://x41-dsec.de/lab/advisories/x41-2017-008-shadowsocks/) and none of the crypto makes sense (https://crypto.stackexchange.com/questions/39776/evaluatung-shadowsocks-crypto-strength https://crypto.stackexchange.com/questions/39776/evaluatung-...)! - The setup process is bonkers. Outline has an Electron app that builds a cloud server, authenticates to it over a random port, then somehow bootstraps encrypted communication with a self-signed certificate. I haven't had time to review the process in all its detail but what the hell? The certificate does not even appear pinned correctly: https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d10358c2312d4e0ef286092763258acc/src/server_manager/electron_app/index.ts#L89-L93 https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d... - Jigsaw did not pay for a reputable security review of the code. This security review is one of the worst, possibly THE worst, that I have ever read. It looks like shadowsocks was in scope at first, but then eliminated from scope. There's some weird fascination with parsing bugs in local configuration files. I don't know what's going on here, but it's a waste of paper: https://s3.amazonaws.com/outline-vpn/static_downloads/ros-report.pdf https://s3.amazonaws.com/outline-vpn/static_downloads/ros-re... Jigsaw is advertising this as a method to keep high-risk journalists safe and it's likely to get someone killed (https://medium.com/jigsaw/introducing-outline-making-it-safer-to-break-the-news-feda4d047b4 https://medium.com/jigsaw/introducing-outline-making-it-safe...). They are conflating two different use cases: Outline may be acceptable for bypassing censorship (low-risk, where success is immediately visible), but it is wholly unacceptable for protecting the safety or anonymity of speech online (which carries the risk of an invisible and potentially fatal failure in a hundred different ways if traffic can be inspected or even just attributed to a person). tl;dr Outline is a flaming pile of garbage. Stop recommending it.
xanth 8y ago
Having not done any cloud work myself I have no clue how much this would cost, anyone able to give a rough estimate?
- gbear605 8y ago
  $5/month or less is a reasonable.
ilarum 8y ago
What is the best way to have a VPN in each continent (apart from the obvious option to have an instance in each region)? I used to pay for a commercial service, but I lost this functionality when I switched to a self-hosted solution. I prefer this feature since I travel a lot and would like to have lower latency wherever I am.
- gumby 8y ago
  I swap with friends: they host an endpoint someplace they control and I host one in my colo in California. They are friends of mine whom I know well so don't worry about one of my IP addresses being used to download child porn.
- tootahe45 8y ago
  What is wrong with purchasing a VPN that is made to provide this functionality on the cheap? i don't get why everybody has to try do it themselves. If you're worrying about tainted IPs, pay a little more for a VPN that logs. All good VPNs support connecting via openVPN at this point.
Nadya 8y ago
I actually tried running Algo through Azure and Microsoft terminated my Azure account citing I was breaking Terms of Service. I had hosted Algo for all of two and a half days before the takedown. Not sure if anyone else has had luck - that was all I was using Azure for was to test Algo out so had nothing else running on Azure at the time. I also ran into a few snags trying to deplay Algo onto Azure so haven't bothered trying to set it up elsewhere. My goal of the VPN was to get a JP address as a few sites I browse are easier to browse with a JP address (eg: I don't get forced bad English translations with no way to toggle to the JP version of the site because I'm coming from an American IP...)
- dguido 8y ago
  Hello! Developer for AlgoVPN here. We have many successful reports of using Azure for AlgoVPN. I would appreciate it very much if you could file an issue and include the full details of what happened, including any communications you received from Microsoft (https://github.com/trailofbits/algo/issues/new https://github.com/trailofbits/algo/issues/new). I have contacts at Azure that I can escalate this issue to directly.
  - Nadya 8y ago
    I don't tend to hold onto email as I don't really care for or value them; especially not emails saying my account has been terminated. Those are more of a delete and move on with my life kind of notice. I ended up getting an email from a rep. asking how my experience was and either two or three (I think it was two) calls to speak with me. A funny left-hand not speaking to the right-hand scenario where customer reps tried to salvage a client even though the client had been terminated by the service. Thanks for extending a hand. I'll look for the email tomorrow - and if found - I'll open an issue. Though if you don't hear from me, it's because the email in all likelihood was deleted shortly after getting it. My use wasn't critical need, so I didn't particularly care to deal with the headache of getting things sorted.
- johnnycarcin 8y ago
  I have been running my algo VM (with wireguard) in Azure for 2-3 months now without issue. For me it is nice because there is an Azure region pretty close to me so I don't take a _huge_ hit traversing the country. I do work at MSFT but my algo VM is inside of my personal account.
vermilingua 8y ago
It’s worth mentioning that it is not, nor does TrailOfBits pretend, that the goal of this project is privacy; it is security. Algo doesn’t and couldn’t care less about your privacy once you reach the endpoint, only about securing the tunnel. You shouldn’t use Algo if you are concerned about surveillance from corporations/governments, you should use Algo if you are concerned about surveillance/attacks from your local network or ISP.
- dguido 8y ago
  Hello, I am the original author of Algo. This is 100% correct and I am glad that people understand the goals of the project. Please use Algo to keep communications secure.
- auslander 8y ago
  Governments take the data from ISP too. And hiding your IP behind VPN is good in any case.
  - JshWright 8y ago
    That is the parent comment's point. This will protect you from your local ISP. It will not protect you from the government (or the ISP on the other end of the tunnel). A VPN does not 'hide' your IP address. It merely changes it.
    - auslander 8y ago
      > That is the parent comment's point. "You shouldn’t use Algo if you are concerned about surveillance from corporations/governments" --- wrong, because Govs get all ISP data. > It will not protect you from the government But it will, because all the government will see (using ISP data) is some VPN traffic from me, nothing more. VPN does hide my IP address - all further connections are made from VPN IP, used by thousands, and not from my personal ISP IP.
      - harshreality 8y ago
eximius 8y ago
Use Wireguard. It is wonderful and the community is friendly. `wg-quick` is easy to use but if you need it, I believe Streisand supports automatically provisioning a wireguard setup.
- PascalW 8y ago
  Yes! Algo also sets up Wireguard for you.
- mistaken 8y ago
  Wireguard is awesome, but the kernel module is so far a mess. If you're paranoid I wouldn't rely on it until the code has been cleaned up and perhaps audited.
  - auslander 8y ago
    you are not mistaken
    - JshWright 8y ago
      Based on what evidence?
      - auslander 8y ago
        I just think being cautious is wise, given how new WG is. And, AFAIK it is userland only, like OpenVpn, not in linux kernel, think performance.
        geofft 8y ago
        There is a WireGuard kernel module, and it also seems weird to me to say "This is a mess" when what you actually mean is "Nobody yet knows if it is a mess or not and I have no evidence either way."
        aaronmdjones 8y ago
        I'm not sure where you're getting your information; the /de facto/ primary WireGuard implementation is a Linux kernel module.
dalanmiller 8y ago
It should be noted that if you've setup Algo already that it now supports WireGuard. The WireGuard Android app (which would be great to verify that it is indeed published by www.wireguard.com) is stupid easy to setup and enable on your device.
- Tharre 8y ago
  It already is linked on the installation page: https://www.wireguard.com/install/#android-play-store-f-droid https://www.wireguard.com/install/#android-play-store-f-droi...
ishanjain28 8y ago
How do you decide what vpn tech to use? I was using openvpn and then switched to wireguard because openvpn was consuming a lot of power on my phone. Why would I want to use Ipsec?
- ReverseCold 8y ago
  > Why would I want to use Ipsec? It's already built into your phone. (Probably)
  - ishanjain28 8y ago
    It is. But just one tiny app for VPN isn't too bad if that VPN does not ruin internet bandwidth.
- auslander 8y ago
  > Why would I want to use Ipsec? Why wouldn't you?
  - ishanjain28 8y ago
    I don't know. I briefly used IPsec when I stopped using OpenVPN and I was looking for alternatives. The setup for IPsec on the server was slightly annoying. I used a Github project that sets up everything for me but the script didn't do everything. And I have observed(from just using IPsec and wireguard on my phone) that wireguard is quite good(maybe even better) than IPsec at not annihilating internet bandwidth.
TimTheTinker 8y ago
Question - are there any guides available to help set up a home-brew router to route all outbound connections through an Algo VPN with exceptions for Netflix/etc.? Something like this (this is for OpenVPN): https://arstechnica.com/gadgets/2017/05/how-to-build-your-own-vpn-if-youre-rightfully-wary-of-commercial-options/ https://arstechnica.com/gadgets/2017/05/how-to-build-your-ow... I currently have a pfSense router set up with Algo, but I have to disable the IPSec policy whenever I want to use Netflix. (Discussion here: https://github.com/trailofbits/algo/issues/292 https://github.com/trailofbits/algo/issues/292 - see comments near the bottom.)
- auslander 8y ago
  Try OPNsense Here is detailed tutorial https://forum.opnsense.org/index.php?topic=4979.0 https://forum.opnsense.org/index.php?topic=4979.0
  - udkyo 8y ago
    VyOS is another good option
  - TimTheTinker 8y ago
    I tried it, but the installer keeps crashing. (Device is an HP T620 Plus with a 4-port/1GB Intel server NIC.)
akerro 8y ago
>Does not install Tor, OpenVPN, or other risky servers Does it call OpenVPN a risky server? Why? Found it https://github.com/trailofbits/algo/blob/master/docs/faq.md#why-arent-you-using-openvpn https://github.com/trailofbits/algo/blob/master/docs/faq.md#...
mtgx 8y ago
IPSEC is broken by (NSA) design. Use Wireguard instead. https://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html https://www.mail-archive.com/cryptography@metzdowd.com/msg12... https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/
chrisweekly 8y ago
Given this post's HN commentary is full of seemingly well-informed perspectives on the relative merits of several VPN service providers and software packages can anyone comment on Private Tunnel? I've been using it for years, having paid something like $20 for 100GB. No complaints, but interested in expert opinion / insights regarding privacy and security. Thanks!
- dguido 8y ago
  My choice is typically between "should I use a hosted provider" vs "should I host my own." IMHO there is not a vast amount of difference between hosted VPN providers. They all suffer from generally the same issues. Here are some reasons you might want to self-host: https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...
codedokode 8y ago
I once wanted to write an Ansible playbook to install VPN on a server but found out that you cannot just pass parameters via command line like ansible setup-vpn 1.2.3.4 Ansible expects you to write host address into a file in /etc. So inconvenient. Also, Ansible doesn't support Windows and Cygwin. It turned out it was easier to write instructions into a Bash program. Sadly, it is non-portable and works only with a specific distribution. It is also surprising how many files are there in the repository for a relatively simple task. And how complicated installation process is. In PHP everything would be easier, because you can pack your application into a single phar archive like in Java. They don't support builtin Android client. I remember I installed Strongswan or something like this and it worked with Android out of the box. I wouldn't recommend Digital Ocean. They don't accept virtual debit card (they want a real card so they can charge you whenever they want) and their VPS are too expensive. $5 per month is too expensive when you can find offers as low as 1 euro/month in Europe with pre-paid system.
- happythought 8y ago
  You can specify inventory on the command line with -i
- zenja 8y ago
  https://stackoverflow.com/questions/30662069/how-can-i-pass-variable-to-ansible-playbook-in-the-command-line https://stackoverflow.com/questions/30662069/how-can-i-pass-...
- 1118836282029 8y ago
  Ansible works on Windows https://www.ansible.com/integrations/infrastructure/windows https://www.ansible.com/integrations/infrastructure/windows I don’t get the Ansible hate, it’s great.
  - codedokode 8y ago
    It only can manage modern Windows versions. But you cannot use Windows to control other hosts: https://docs.ansible.com/ansible/latest/user_guide/windows_faq.html#can-ansible-run-on-windows https://docs.ansible.com/ansible/latest/user_guide/windows_f...
deleted 8y ago
[deleted]
alchemism 8y ago
Also is great. I extend this script and use it as a quick-and-easy way of managing my dev team’s vpn into our clouds.

189 points by uoflcards22 8y ago

givinguflac 8y ago

Serious question, do people consider a cloud provider to be more trustworthy than a professional VPN company?

wetpaws 8y ago
It depends on a cloud provider
mirimir 8y ago
It depends. Some VPN services will go out of their way to protect users' privacy. Because it's a moral issue for them. Or because they value their reputation. Others will sell you out, to avoid penalties and costs. And the same is true for cloud providers.
filmgirlcw 8y ago
Perhaps? If you’re using a VPN to protect your internet traffic from being sold to ad companies, probably. The VPN industry has become a racket full of affiliate schemes that push people towards plans and services that don’t necessarily act in the user’s best interest. Figuring out the food from the bad can be difficult. And I’ve seen some services that when audited use outdated or insecure stacks. Of course, if you’re using a VPN to try to protect your browsing activity from authorities, obviously a major cloud provider may be more willing to turn your info over to someone else.
- mirimir 8y ago
  I've been using VPN services for over a decade. In my opinion, the most privacy friendly are AirVPN, Insorg, IVPN, Mullvad, Private Internet Access and Riseup. To my knowledge, HideMyAss, EarthVPN, IPVanish, PureVPN and WANSecurity have violated their users' privacy. For the most part, by sharing logs with investigators. Prudent providers make damn sure not to have any logs that could be seized.
  - Alexa_Anthony 8y ago
    Well, I will not advocate for any big brand here but it is also true that hidemyass, IPvanish, Purevpn has more than 50% total share of VPN users and indeed its true that new VPN services especially Private Internet Access is going great. I recently read some review of them at Bestvpn.co.
- auslander 8y ago
  > Figuring out the food from the bad can be difficult Lol. Funny, good VPNs are like good fishing spots, the ones who know the difference tend not to share their favourites, keeping it for themselves :)
sitepodmatt 8y ago
Serious question, are there any professional VPN companies? Dont most VPN companies depend on cloud providers for many locations too. Most VPN companies have had serious screw ups in the past. PureVPN - disable all encryption by default for performance on their Windows client - for example. StrongVPN I recall logging. Other popular ones recur billing at top whack after a year and refusing refund. Overloaded servers, port blocking and so on.
techsupporter 8y ago
Trustworthy? I could go either way, depending on particular scenario. Usable? Infinitely. I've noticed quite a few web sites and services putting obnoxious blocks or filters or other impediments against users coming from "widely-known" VPN and VPS provider IP addresses. But few seem to bother with Microsoft or Amazon IPs. So for something that has the purpose of either getting me out from behind a restrictive network or wrapping my traffic on an insecure network, a VPN to an Azure- or EC2-provisioned virtual machine works just fine.
- blacksmith_tb 8y ago
  I have a Streisand [1] server on a Digital Ocean droplet, and I do run into the occasional Cloudflare: blocked or extra-aggressive captcha when I am routed through it. 1: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
LeoPanthera 8y ago
It depends what you want. If you're trying to obtain some degree of anonymity, then a personal VPN server is obviously much worse, since you'll be a using a dedicated IP address just for you, instead of sharing a public one. But if you just want to secure your data from an untrustworthy local network, it's a reasonable choice. You're less likely to be flagged as connecting from a "bad" IP.
- mirimir 8y ago
  You can have both. Mirimir reaches the Internet using a nested chain of three VPN services. The last being IVPN, given that I work for them. But then I use private VPNs on VPS when I need to pretend that I'm not using a VPN.
auslander 8y ago
a professional VPN company is probably using some cloud provider themselves.

accrual 8y ago

> Does not install Tor, OpenVPN, or other risky servers Although I recognize IPsec is a widely supported protocol and suitable for this use case, did the readme intend to imply OpenVPN is risky?

Operyl 8y ago
https://github.com/trailofbits/algo/issues/36 https://github.com/trailofbits/algo/issues/36 I guess they consider TLS to be a considerable risk. Theoretical I guess.
- dguido 8y ago
  There is an FAQ that addresses "Why not OpenVPN?" including the specific security concerns with it: https://github.com/trailofbits/algo/blob/master/docs/faq.md#why-arent-you-using-openvpn https://github.com/trailofbits/algo/blob/master/docs/faq.md#...

nimbius 8y ago

>Algo supports DigitalOcean (most user friendly), Amazon Lightsail, Amazon EC2, Microsoft Azure, Google Compute Engine, Scaleway and OpenStack. four of the seven listed are cloud providers that actively encourage censorship for the sake of their business model. at best, you would be a fool to run a personal VPN on them, at worst the fact that support exists at all could be evidence that this software is in fact worse than openVPN or TOR in that it facilitates an obviously poor implementation. Google and Microsoft both joined the PRISM program in 2009. https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#Media_disclosure_of_PRISM https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#M...

nodesocket 8y ago

I prefer https://github.com/hwdsl2/setup-ipsec-vpn https://github.com/hwdsl2/setup-ipsec-vpn. Shamless blog post on setting it up on a Raspberry Pi 3 - https://blog.elasticbyte.net/setting-up-a-native-cisco-ipsec-vpn-server-using-a-raspberry-pi/ https://blog.elasticbyte.net/setting-up-a-native-cisco-ipsec...

athrun 8y ago
Thank you for posting this! I'll be checking this out. I like how the scope of this project is only about setting up an IPsec server automatically on a Linux box. Algo and Streisand have too much features, making them unwieldy.
gmac 8y ago
See also https://github.com/jawj/IKEv2-setup https://github.com/jawj/IKEv2-setup for IKEv2 (I made this)

verroq 8y ago

Not enough people have heard of Outline. https://getoutline.org/ https://getoutline.org/ It is a shadowsocks client and even non-technical users can provision VPNs on cloud hosting providers.

voltagex_ 8y ago
It's a Google/Alphabet project. Hmm.
- dguido 8y ago
  It's not a Google project, it's a Jigsaw project. There's a huge difference, since one is run with extremely low resources and employees between the entities are not shared. Don't trust code that comes from Jigsaw. In my experience, it's all been haphazardly thrown together for a proof of concept and media coverage, not production quality software that people should use.
dguido 8y ago
Outline is a security disaster, and I strongly recommend against using it. - Shadowsocks is not a VPN, it's a per-application SOCKS proxy. What has Jigsaw done to ensure that packets don't leak outside of the tunnel? All UDP traffic leaks, so it looks like they did nothing! https://github.com/shadowsocks/shadowsocks-rust/issues/78 https://github.com/shadowsocks/shadowsocks-rust/issues/78 - Shadowsocks is dangerously full of bad configuration options to avoid. Did Jigsaw avoid all of them when it built Outline? Their copy of shadowsocks appears to use an unauthenticated CFB mode by default (https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d10358c2312d4e0ef286092763258acc/src/shadowbox/server/libev_shadowsocks_server.ts#L29 https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d...), but then this setting is overridden elsewhere. Good luck checking all the rest. - They enabled an automated update system they called "Watchtower." Is this safe to use? Who controls the keys? When are updates pushed out? How would it react to a subpoena? - Is shadowsocks safe? It's a giant pile of C that was purpose-built to evade censorship by the Chinese Great Firewall, nothing more. It wasn't written or designed by an expert in secure communications and it was not even intended for that purpose. It's had a bunch of bugs before (https://x41-dsec.de/lab/advisories/x41-2017-008-shadowsocks/ https://x41-dsec.de/lab/advisories/x41-2017-008-shadowsocks/) and none of the crypto makes sense (https://crypto.stackexchange.com/questions/39776/evaluatung-shadowsocks-crypto-strength https://crypto.stackexchange.com/questions/39776/evaluatung-...)! - The setup process is bonkers. Outline has an Electron app that builds a cloud server, authenticates to it over a random port, then somehow bootstraps encrypted communication with a self-signed certificate. I haven't had time to review the process in all its detail but what the hell? The certificate does not even appear pinned correctly: https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d10358c2312d4e0ef286092763258acc/src/server_manager/electron_app/index.ts#L89-L93 https://github.com/Jigsaw-Code/outline-server/blob/d8cb1575d... - Jigsaw did not pay for a reputable security review of the code. This security review is one of the worst, possibly THE worst, that I have ever read. It looks like shadowsocks was in scope at first, but then eliminated from scope. There's some weird fascination with parsing bugs in local configuration files. I don't know what's going on here, but it's a waste of paper: https://s3.amazonaws.com/outline-vpn/static_downloads/ros-report.pdf https://s3.amazonaws.com/outline-vpn/static_downloads/ros-re... Jigsaw is advertising this as a method to keep high-risk journalists safe and it's likely to get someone killed (https://medium.com/jigsaw/introducing-outline-making-it-safer-to-break-the-news-feda4d047b4 https://medium.com/jigsaw/introducing-outline-making-it-safe...). They are conflating two different use cases: Outline may be acceptable for bypassing censorship (low-risk, where success is immediately visible), but it is wholly unacceptable for protecting the safety or anonymity of speech online (which carries the risk of an invisible and potentially fatal failure in a hundred different ways if traffic can be inspected or even just attributed to a person). tl;dr Outline is a flaming pile of garbage. Stop recommending it.

xanth 8y ago

Having not done any cloud work myself I have no clue how much this would cost, anyone able to give a rough estimate?

gbear605 8y ago
$5/month or less is a reasonable.

ilarum 8y ago

What is the best way to have a VPN in each continent (apart from the obvious option to have an instance in each region)? I used to pay for a commercial service, but I lost this functionality when I switched to a self-hosted solution. I prefer this feature since I travel a lot and would like to have lower latency wherever I am.

gumby 8y ago
I swap with friends: they host an endpoint someplace they control and I host one in my colo in California. They are friends of mine whom I know well so don't worry about one of my IP addresses being used to download child porn.
tootahe45 8y ago
What is wrong with purchasing a VPN that is made to provide this functionality on the cheap? i don't get why everybody has to try do it themselves. If you're worrying about tainted IPs, pay a little more for a VPN that logs. All good VPNs support connecting via openVPN at this point.

Nadya 8y ago

I actually tried running Algo through Azure and Microsoft terminated my Azure account citing I was breaking Terms of Service. I had hosted Algo for all of two and a half days before the takedown. Not sure if anyone else has had luck - that was all I was using Azure for was to test Algo out so had nothing else running on Azure at the time. I also ran into a few snags trying to deplay Algo onto Azure so haven't bothered trying to set it up elsewhere. My goal of the VPN was to get a JP address as a few sites I browse are easier to browse with a JP address (eg: I don't get forced bad English translations with no way to toggle to the JP version of the site because I'm coming from an American IP...)

dguido 8y ago
Hello! Developer for AlgoVPN here. We have many successful reports of using Azure for AlgoVPN. I would appreciate it very much if you could file an issue and include the full details of what happened, including any communications you received from Microsoft (https://github.com/trailofbits/algo/issues/new https://github.com/trailofbits/algo/issues/new). I have contacts at Azure that I can escalate this issue to directly.
- Nadya 8y ago
  I don't tend to hold onto email as I don't really care for or value them; especially not emails saying my account has been terminated. Those are more of a delete and move on with my life kind of notice. I ended up getting an email from a rep. asking how my experience was and either two or three (I think it was two) calls to speak with me. A funny left-hand not speaking to the right-hand scenario where customer reps tried to salvage a client even though the client had been terminated by the service. Thanks for extending a hand. I'll look for the email tomorrow - and if found - I'll open an issue. Though if you don't hear from me, it's because the email in all likelihood was deleted shortly after getting it. My use wasn't critical need, so I didn't particularly care to deal with the headache of getting things sorted.
johnnycarcin 8y ago
I have been running my algo VM (with wireguard) in Azure for 2-3 months now without issue. For me it is nice because there is an Azure region pretty close to me so I don't take a _huge_ hit traversing the country. I do work at MSFT but my algo VM is inside of my personal account.

vermilingua 8y ago

It’s worth mentioning that it is not, nor does TrailOfBits pretend, that the goal of this project is privacy; it is security. Algo doesn’t and couldn’t care less about your privacy once you reach the endpoint, only about securing the tunnel. You shouldn’t use Algo if you are concerned about surveillance from corporations/governments, you should use Algo if you are concerned about surveillance/attacks from your local network or ISP.

dguido 8y ago
Hello, I am the original author of Algo. This is 100% correct and I am glad that people understand the goals of the project. Please use Algo to keep communications secure.
auslander 8y ago
Governments take the data from ISP too. And hiding your IP behind VPN is good in any case.
- JshWright 8y ago
  That is the parent comment's point. This will protect you from your local ISP. It will not protect you from the government (or the ISP on the other end of the tunnel). A VPN does not 'hide' your IP address. It merely changes it.
  - auslander 8y ago
    > That is the parent comment's point. "You shouldn’t use Algo if you are concerned about surveillance from corporations/governments" --- wrong, because Govs get all ISP data. > It will not protect you from the government But it will, because all the government will see (using ISP data) is some VPN traffic from me, nothing more. VPN does hide my IP address - all further connections are made from VPN IP, used by thousands, and not from my personal ISP IP.
    - harshreality 8y ago

eximius 8y ago

Use Wireguard. It is wonderful and the community is friendly. `wg-quick` is easy to use but if you need it, I believe Streisand supports automatically provisioning a wireguard setup.

PascalW 8y ago
Yes! Algo also sets up Wireguard for you.
mistaken 8y ago
Wireguard is awesome, but the kernel module is so far a mess. If you're paranoid I wouldn't rely on it until the code has been cleaned up and perhaps audited.
- auslander 8y ago
  you are not mistaken
  - JshWright 8y ago
    Based on what evidence?
    - auslander 8y ago
      I just think being cautious is wise, given how new WG is. And, AFAIK it is userland only, like OpenVpn, not in linux kernel, think performance.
      - geofft 8y ago
        There is a WireGuard kernel module, and it also seems weird to me to say "This is a mess" when what you actually mean is "Nobody yet knows if it is a mess or not and I have no evidence either way."
      - aaronmdjones 8y ago
        I'm not sure where you're getting your information; the /de facto/ primary WireGuard implementation is a Linux kernel module.

dalanmiller 8y ago

It should be noted that if you've setup Algo already that it now supports WireGuard. The WireGuard Android app (which would be great to verify that it is indeed published by www.wireguard.com) is stupid easy to setup and enable on your device.

Tharre 8y ago
It already is linked on the installation page: https://www.wireguard.com/install/#android-play-store-f-droid https://www.wireguard.com/install/#android-play-store-f-droi...

ishanjain28 8y ago

How do you decide what vpn tech to use? I was using openvpn and then switched to wireguard because openvpn was consuming a lot of power on my phone. Why would I want to use Ipsec?

ReverseCold 8y ago
> Why would I want to use Ipsec? It's already built into your phone. (Probably)
- ishanjain28 8y ago
  It is. But just one tiny app for VPN isn't too bad if that VPN does not ruin internet bandwidth.
auslander 8y ago
> Why would I want to use Ipsec? Why wouldn't you?
- ishanjain28 8y ago
  I don't know. I briefly used IPsec when I stopped using OpenVPN and I was looking for alternatives. The setup for IPsec on the server was slightly annoying. I used a Github project that sets up everything for me but the script didn't do everything. And I have observed(from just using IPsec and wireguard on my phone) that wireguard is quite good(maybe even better) than IPsec at not annihilating internet bandwidth.

TimTheTinker 8y ago

Question - are there any guides available to help set up a home-brew router to route all outbound connections through an Algo VPN with exceptions for Netflix/etc.? Something like this (this is for OpenVPN): https://arstechnica.com/gadgets/2017/05/how-to-build-your-own-vpn-if-youre-rightfully-wary-of-commercial-options/ https://arstechnica.com/gadgets/2017/05/how-to-build-your-ow... I currently have a pfSense router set up with Algo, but I have to disable the IPSec policy whenever I want to use Netflix. (Discussion here: https://github.com/trailofbits/algo/issues/292 https://github.com/trailofbits/algo/issues/292 - see comments near the bottom.)

auslander 8y ago
Try OPNsense Here is detailed tutorial https://forum.opnsense.org/index.php?topic=4979.0 https://forum.opnsense.org/index.php?topic=4979.0
- udkyo 8y ago
  VyOS is another good option
- TimTheTinker 8y ago
  I tried it, but the installer keeps crashing. (Device is an HP T620 Plus with a 4-port/1GB Intel server NIC.)

akerro 8y ago

>Does not install Tor, OpenVPN, or other risky servers Does it call OpenVPN a risky server? Why? Found it https://github.com/trailofbits/algo/blob/master/docs/faq.md#why-arent-you-using-openvpn https://github.com/trailofbits/algo/blob/master/docs/faq.md#...

mtgx 8y ago

IPSEC is broken by (NSA) design. Use Wireguard instead. https://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html https://www.mail-archive.com/cryptography@metzdowd.com/msg12... https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/

chrisweekly 8y ago

Given this post's HN commentary is full of seemingly well-informed perspectives on the relative merits of several VPN service providers and software packages can anyone comment on Private Tunnel? I've been using it for years, having paid something like $20 for 100GB. No complaints, but interested in expert opinion / insights regarding privacy and security. Thanks!

dguido 8y ago
My choice is typically between "should I use a hosted provider" vs "should I host my own." IMHO there is not a vast amount of difference between hosted VPN providers. They all suffer from generally the same issues. Here are some reasons you might want to self-host: https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...

codedokode 8y ago

I once wanted to write an Ansible playbook to install VPN on a server but found out that you cannot just pass parameters via command line like ansible setup-vpn 1.2.3.4 Ansible expects you to write host address into a file in /etc. So inconvenient. Also, Ansible doesn't support Windows and Cygwin. It turned out it was easier to write instructions into a Bash program. Sadly, it is non-portable and works only with a specific distribution. It is also surprising how many files are there in the repository for a relatively simple task. And how complicated installation process is. In PHP everything would be easier, because you can pack your application into a single phar archive like in Java. They don't support builtin Android client. I remember I installed Strongswan or something like this and it worked with Android out of the box. I wouldn't recommend Digital Ocean. They don't accept virtual debit card (they want a real card so they can charge you whenever they want) and their VPS are too expensive. $5 per month is too expensive when you can find offers as low as 1 euro/month in Europe with pre-paid system.

happythought 8y ago
You can specify inventory on the command line with -i
zenja 8y ago
https://stackoverflow.com/questions/30662069/how-can-i-pass-variable-to-ansible-playbook-in-the-command-line https://stackoverflow.com/questions/30662069/how-can-i-pass-...
1118836282029 8y ago
Ansible works on Windows https://www.ansible.com/integrations/infrastructure/windows https://www.ansible.com/integrations/infrastructure/windows I don’t get the Ansible hate, it’s great.
- codedokode 8y ago
  It only can manage modern Windows versions. But you cannot use Windows to control other hosts: https://docs.ansible.com/ansible/latest/user_guide/windows_faq.html#can-ansible-run-on-windows https://docs.ansible.com/ansible/latest/user_guide/windows_f...

deleted 8y ago

[deleted]

alchemism 8y ago

Also is great. I extend this script and use it as a quick-and-easy way of managing my dev team’s vpn into our clouds.