4 ms·

Gotta say, if you just want a VPN to work now, definitely check out Algo or Streisand. You can get a VPN running in an hour or less. Algo even supports wiregua

by jchook 7y ago

Gotta say, if you just want a VPN to work now, definitely check out Algo or Streisand. You can get a VPN running in an hour or less. Algo even supports wireguard. I currently have two VPNs — Algo Wireguard & iVPN. Anecdotally the wireguard VPN rocks— crazy fast in every way, including connection/disconnection. Sometimes YouTube is slow.. I just hop on WG and it’s fast again. I’ve achieved faster downloads via WG than my bare internet connection (thanks Linode!) However, some points to consider: 1. If you use a VPS to host your own VPN.. you don’t gain privacy. Usually your IP can (mostly) still identify you. And your VPS company will hold you accountable for your traffic eg DMCA. 2. OpenVPN never borks my resolv.conf but Wireguard often leaves my DNS resolution in a state of confusion.

nsomaru 7y ago
My default-config Streisand server was compromised according to Vultr. Just a heads up because VPNs can’t really afford this.
- brianjking 7y ago
  Compromised due to Streisand being vulnerable or what?
- stevekemp 7y ago
  Do you have further details? I mean this could be your server having SSH open and a weak root password, or it could be an exploit which hit Streisand, but we can't tell which ..
- NamTaf 7y ago
  Per the sibling comments, I'd definitely like to know more detail. I rely on Streisand when in China and so if it's something to do with Streisand itself then I want to be aware of that.
- nsomaru 7y ago
  Replying to myself, I accepted what Vultr had to say and killed the server. Wasn’t really worth me investigating too deeply and I took them on their word. I did the default Streisand install with all services, and disabled password based login on the box (keys only). It seems Streisand has some issues updating some components according to their issues board and it seems like the maintainer might have abandoned it. Next time I’ll probably use algo instead. I just need wireshark anyways ;)
mingabunga 7y ago
We've been working on a Windows version for the past few years, same idea - instant connection/disconnection, crazy fast, modern encryption. Uses only 10% of a single server cpu at gigabit speed. Almost finished, just adding in encryption for TCP (UDP and DNS already done). Shameless self promotion: https://www.firetrust.com/products/hideaway-secure-unlimited-vpn/beta https://www.firetrust.com/products/hideaway-secure-unlimited...
- ubercow13 7y ago
  Do you mean that your product is built on wireguard?
  - mingabunga 7y ago
    No, it's not, it's our own implementation (except for the encryption part of course). We did a version similar to how Wireguard does it (UDP only) a few years back, but ran in to issues, so we ended up re-doing it with some different optimizations and UDP and TCP.
Nursie 7y ago
I managed to get StrongSwan IPSEC going in about an hour... But then I'm looking for a configuration that allows me to route all my traffic via home from wherever I am, not a solution that allows me to route my home traffic via a third party. Wireguard sounds interesting, and I'm going to learn more about it, but I like where I am with StrongSwan and just being able to issue a new certificate for a new device, and run with it.
3xblah 7y ago
"2. OpenVPN never borks my resolv.conf but Wireguard often leaves my DNS resolution in a state of confusion." Checking the source... excerpt from src/tools/wg-quick/openbsd.bash: set_dns() { [[ ${#DNS[@]} -gt 0 ]] || return 0 # TODO: this is a horrible way of doing it. Has OpenBSD no resolvconf? cmd cp /etc/resolv.conf "/etc/resolv.conf.wg-quick-backup.$INTERFACE" cmd printf 'nameserver %s\n' "${DNS[@]}" > /etc/resolv.conf }
- zx2c4 7y ago
  We're doing something better on other platforms. But for OpenBSD I'm not entirely sure the best way. Suggestions welcome.
  - Hello71 7y ago
    did you check what openvpn does? I would assume they have something at a local maximum.
learntofly 7y ago
I flagged the slow YouTube issues to iVPN (openvpn) previously but got palmed off by support, otherwise they offer an excellent service.
oarsinsync 7y ago
> 1. If you use a VPS to host your own VPN.. you don’t gain privacy. Usually your IP can (mostly) still identify you. And your VPS company will hold you accountable for your traffic eg DMCA. Unfortunately, the same can be said for your VPN provider, depending on the provider. They can (and more than one does) save your name, address, billing details, as well as your source IP, and which IP and source ports you appear as after VPN translation has occurred. Even if they don't do this, traffic analysis by the underlying network provider can de-anonymise your VPN'd traffic from your original source traffic too, and it doesn't take a genius to do this either.

by jchook 7y ago

nsomaru 7y ago

My default-config Streisand server was compromised according to Vultr. Just a heads up because VPNs can’t really afford this.

brianjking 7y ago
Compromised due to Streisand being vulnerable or what?
stevekemp 7y ago
Do you have further details? I mean this could be your server having SSH open and a weak root password, or it could be an exploit which hit Streisand, but we can't tell which ..
NamTaf 7y ago
Per the sibling comments, I'd definitely like to know more detail. I rely on Streisand when in China and so if it's something to do with Streisand itself then I want to be aware of that.
nsomaru 7y ago
Replying to myself, I accepted what Vultr had to say and killed the server. Wasn’t really worth me investigating too deeply and I took them on their word. I did the default Streisand install with all services, and disabled password based login on the box (keys only). It seems Streisand has some issues updating some components according to their issues board and it seems like the maintainer might have abandoned it. Next time I’ll probably use algo instead. I just need wireshark anyways ;)

mingabunga 7y ago

We've been working on a Windows version for the past few years, same idea - instant connection/disconnection, crazy fast, modern encryption. Uses only 10% of a single server cpu at gigabit speed. Almost finished, just adding in encryption for TCP (UDP and DNS already done). Shameless self promotion: https://www.firetrust.com/products/hideaway-secure-unlimited-vpn/beta https://www.firetrust.com/products/hideaway-secure-unlimited...

ubercow13 7y ago
Do you mean that your product is built on wireguard?
- mingabunga 7y ago
  No, it's not, it's our own implementation (except for the encryption part of course). We did a version similar to how Wireguard does it (UDP only) a few years back, but ran in to issues, so we ended up re-doing it with some different optimizations and UDP and TCP.

Nursie 7y ago

I managed to get StrongSwan IPSEC going in about an hour... But then I'm looking for a configuration that allows me to route all my traffic via home from wherever I am, not a solution that allows me to route my home traffic via a third party. Wireguard sounds interesting, and I'm going to learn more about it, but I like where I am with StrongSwan and just being able to issue a new certificate for a new device, and run with it.

3xblah 7y ago

"2. OpenVPN never borks my resolv.conf but Wireguard often leaves my DNS resolution in a state of confusion." Checking the source... excerpt from src/tools/wg-quick/openbsd.bash: set_dns() { [[ ${#DNS[@]} -gt 0 ]] || return 0 # TODO: this is a horrible way of doing it. Has OpenBSD no resolvconf? cmd cp /etc/resolv.conf "/etc/resolv.conf.wg-quick-backup.$INTERFACE" cmd printf 'nameserver %s\n' "${DNS[@]}" > /etc/resolv.conf }

zx2c4 7y ago
We're doing something better on other platforms. But for OpenBSD I'm not entirely sure the best way. Suggestions welcome.
- Hello71 7y ago
  did you check what openvpn does? I would assume they have something at a local maximum.

learntofly 7y ago

I flagged the slow YouTube issues to iVPN (openvpn) previously but got palmed off by support, otherwise they offer an excellent service.

oarsinsync 7y ago

> 1. If you use a VPS to host your own VPN.. you don’t gain privacy. Usually your IP can (mostly) still identify you. And your VPS company will hold you accountable for your traffic eg DMCA. Unfortunately, the same can be said for your VPN provider, depending on the provider. They can (and more than one does) save your name, address, billing details, as well as your source IP, and which IP and source ports you appear as after VPN translation has occurred. Even if they don't do this, traffic analysis by the underlying network provider can de-anonymise your VPN'd traffic from your original source traffic too, and it doesn't take a genius to do this either.