4 ms·
I have basically the same implementation except it's running on my dedicated openbsd router using openvpn/unbound/pf and scripts. It doesn't support wireguard t
by tyfon 8y ago
I have basically the same implementation except it's running on my dedicated openbsd router using openvpn/unbound/pf and scripts. It doesn't support wireguard though but openvpn should be equivalent? I know the wireguard developers claim it's more secure, however I think a properly secured openvpn with certificate based authentication both ways should be fine for a home setup.
For the lazy, someone other than me made scripts to both pi-hole (dns) setup[1] and pf (firewall) setup[2] to block on network level too.
The scripts themselves are very easy to read and vet for bad stuff.
[1] https://geoghegan.ca/unbound-adblock.html https://geoghegan.ca/unbound-adblock.html
[2] https://geoghegan.ca/pfbadhost.html https://geoghegan.ca/pfbadhost.html
- DyslexicAtheist 8y agoThe main selling point of wireguard is elimination of insecure ciphers and less chance of shooting yourself in the foot with configuration. the protocol is more lightweight too. openbsd has a port btw: https://marc.info/?l=openbsd-ports&m=152712417729497 https://marc.info/?l=openbsd-ports&m=152712417729497
- tyfon 8y agoYeah I know it's supposed to be more efficient too. But thanks for the link to the openbsd port, I'll definitively look into that! For some reason I thought it was only implemented as a linux kernel module.