16 ms·

Setting up a home VPN server with WireGuard

616 points by mikl 7y ago

whalesalad 7y ago
Cool to see this done by hand. I’m running IPSec on my Edgerouter but am about to redo my home network and lab environment and will likely implement WireGuard. There’s also a more plug-n-play tool called Algo that is highly spoken of, which automates a lot of this: https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- TimTheTinker 7y ago
  Algo is pretty cool for setting up an IKEv2 VPN server, but under the hood it uses StrongSwan, which is far more complicated in a code/engineering sense than WireGuard. That being said, I think Algo is often preferable to OpenVPN and IPSec, especially when supporting macOS/iOS clients.
  - smhenderson 7y ago
    I know what you mean when it comes to OpenVPN and macOS. But any insight on why you'd prefer Algo over OpenVPN? I've been using the latter for years but would be interested in revisiting that if there are compelling reasons to do so.
    - gesman 7y ago
      I think Algo is just a setup script, not a VPN itself?
  - tptacek 7y ago
    Algo does a fine job of setting up WireGuard, which is what you should use if you can.
- tylermenezes 7y ago
  FYI WireGuard is pretty slow on the Edgerouter compared to IPSec. I assume IPSec has a hardware offload and WireGuard does not.
  - JustSomeNobody 7y ago
    Yes, IPSec is supported for HW offload: https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRouter-Hardware-Offloading https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRou... Disappointed to hear the performance hit with WireGuard. I was planning on trying it out, but I think I'll wait.
    - zrm 7y ago
      Note that hardware offload only really matters when you're combining fast networks with slow processors. WireGuard on a modern PC CPU will more than saturate gigabit ethernet and the per-packet latency hit is <1ms.
    - msh 7y ago
      Well for some of their routers its false advertising. On the edgerouter x ipsec offload for client vpn have been broken for more than a year.
  - elabajaba 7y ago
    According to https://an.undulating.space/post/181227-er_alternate_firmware_vpn_benchmarks/ https://an.undulating.space/post/181227-er_alternate_firmwar... Wireguard is just as fast as hardware accelerated IPSec on both the Edgerouter X and Lite. With Openwrt on the Edgerouter Lite Wireguard is ~2x faster than hardware accelerated IPSec on EdgeOS.
    - wahern 7y ago
      They don't give the IPSec parameters. Wireguard uses ChaCha20 for encryption with Poly1305 for authentication. IPSec can use many different combinations of cipher and authentication algorithms. If they were using AES+SHA256 then SHA256 would likely be the bottleneck. AFAIU, Ubiquiti routers use a crypto coprocessor (as opposed to AES-NI and SHA-NI on amd64), which means even if SHA256 was accelerated on the coprocessor it could easily still be too costly. But we don't even know if the MAC was accelerated at all. The implication that "IPSec acceleration" handicaps Wireguard is unfounded. If those benchmarks were with AES+GCM, then that would definitely be surprising. But the safe bet is that they were using AES+SHA256 (or something other than GCM for the MAC), in which case their benchmarks are not surprising, simply misleading. IPSec can also do ChaCha20+Poly1305 (at least, OpenBSD's stack can). Any serious comparison should also include IPSec using the same crypto algorithms as Wireguard.
metalliqaz 7y ago
I've been using OpenVPN on my home pfSense box, it's working pretty good and didn't require I install anything except the OpenVPN app on my phone. Not sure if WireGuard has anything to offer that would motivate a switch.
- soohyung 7y ago
  It's faster. But if you already have a working system that you are happy with it may not warrant a switch. I think it's main strength lies in how easy it is to set up though. First time setting it up from scratch I had a working VPN in less than 5 minutes.
- mikl 7y ago
  Wireguard does claim to be faster. It’s also much simpler from a design perspective, so it might end up being more secure. But other than that, there’s no big reason to switch if you have a setup you’re happy with.
  - tptacek 7y ago
    It doesn't just claim to be faster; it's clearly, materially, obviously faster, at least in straightforward configurations (which is to say that someone could come up with some weird OpenVPN configuration that makes up the [large] gap, but I haven't see that yet).
    - 1996 7y ago
      IF you only use AH with strongswan then it is faster than either wireguard or openvpn
      - mikl 7y ago
        The question was if there was a reason to switch away from OpenVPN ;)
      - psanford 7y ago
        If you are just using AH you aren't encrypting your traffic so it isn't really comparable to wireguard or openvpn.
heyoni 7y ago
Anyone know roughly where to look for in terms of potential bottlenecks? I’m running my server on an rpi4 and sometimes feel like I’m not getting great speeds to my home VPN server. I did do my due diligence by wiring it directly through Ethernet but I suspect my router (google WiFi) may be slowing things down.
- mikl 7y ago
  Number one would probably be to ensure the rpi has a good cabled connection to the router (and make sure it uses it instead of WiFi). VPN connections going back and forth over WiFi would slow things down. Next bottleneck would probably be CPU. Check if the CPU is being maxed out or throttled when you’re using the VPN.
  - heyoni 7y ago
    I don't think I ever even set up wifi, but I'm going to follow another reply that suggested tools for testing the real speed that the rpi is getting.
- irq 7y ago
  Does your rpi4 have proper cooling? Unlike all past rpis, the stock cooling on the rpi4 is easily overwhelmed by even slight load, and it drastically slows down in that situation.
  - heyoni 7y ago
    I put on an aluminum case for passive cooling and now it runs around 48 celsius as opposed to 70+ before. That should be good right?
    - irq 7y ago
      Does the case make direct metal to metal contact with all 3 major heat producing chips on the rpi4? IIRC, the chip related to ethernet gets very, very hot in use and not all metal rpi4 cases actually make contact with it.
vsviridov 7y ago
I use wireguard for personal VPN on multiple servers, and to make things a bit easier for provisioning I wrote this simple tool: https://gitlab.com/vsviridov/wg-provision https://gitlab.com/vsviridov/wg-provision
xbhdhdhd 7y ago
Ive attempted to setup openVPN a few times and ended up giving up. Anyone know if there has been an effort to help non networking experts deploy it?
- bananaeater 7y ago
  For use on a VPS with an external IP, I've had success with this https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install For use to connect to home network drives, I've used ZeroTier https://www.zerotier.com/ https://www.zerotier.com/. I've never had an external IP for home internet, so I always ran in headaches trying to do a home VPN to channel my internet traffic while I'm out and about (and that's why I use a VPN on a VPS for that).
  - SturgeonsLaw 7y ago
    Seconding this recommendation - I've used Nyr's script to deploy OpenVPN a couple of times and it's worked well. I can also recommend OpenVPN's virtual appliances: https://openvpn.net/virtual-appliances/ https://openvpn.net/virtual-appliances/ They work out-of-the-box and come with a web UI for configuration, if that's your thing. That said, I've moved on to Wireguard lately and will be unlikely to use OpenVPN for personal VPN networks in the future.
- Havoc 7y ago
  >Ive attempted to setup openVPN a few times and ended up giving up. Give wireguard a try. Had the same experience with OpenVPN, yet got wireguard to work pretty much immediately.
- sccxy 7y ago
  I used raspberry pi and this: http://www.pivpn.io/ http://www.pivpn.io/ Works very well for me.
  - chrsstrm 7y ago
    I literally set one of these up last night with a Pi 4 and the longest step was dd’ing Raspbian Buster Lite to the SD card. Only real gotcha in setup is remember to set up SSH before booting if you’re going headless. Everything else is super easy.
CubicsRube 7y ago
Maybe a dumb question, but does anyone sets up their VPN server in the cloud? Could cheapest droplet on DigitalOcean [0] handle traffic for browsing or youtube? [0] https://www.digitalocean.com/pricing/#standard-compute-trigger https://www.digitalocean.com/pricing/#standard-compute-trigg...
- tprynn 7y ago
  Yes and yes, the $5 droplet is perfect for wireguard.
- mikl 7y ago
  Yeah, if you don’t have a home network you want access to, a cloud server would do just fine. Smallest droplet would probably be fine, if you’re not streaming 4K video. Same goes for the 1TB transfer limit.
- farss 7y ago
  Not dumb at all. I'm doing this on a $5 droplet and it's faster than any of the commercial VPN's I'm currently paying for. It's a little less privacy protective than many VPN providers however - Digital Ocean will for example forward DMCA violation nastygrams they receive from content owners.
  - tgtweak 7y ago
    You'll get recapcha'd like crazy. Also some e-commerce sites will refuse purchases when made from hosting-allocated IP ranges since it's commonplace for fraud.
    - big_chungus 7y ago
      At least for me on linode, it's less-bad than others I've seen. Google doesn't typically get nasty; I think I can only think of a few sites that are especially bad (linkedin and arstechnica forums are two that come to mind). That probably has to do with me using the same IP for ~2yrs now, so it doesn't have reputation problems.
- 7y ago
valkum 7y ago
Hosting my Wireguard server on a scaleway instance, I encountered a very slow performance. Some web pages didn't load at all. Server was under no load. Lowering the MTU on the client and the server from 1500 to 1360 solved the problem. FYI
- AlexandrB 7y ago
  Sounds like IP fragmentation. This is pretty normal with any VPN or tunnelling protocol unless the MTU is set correctly. [1] https://en.wikipedia.org/wiki/IP_fragmentation https://en.wikipedia.org/wiki/IP_fragmentation
  - wahern 7y ago
    It's worse with VPNs like Wireguard because Wireguard only supports tunneling (e.g. IP in IP), which when you add the authentication header means a minimum of 3x the overhead of a regular connection, whereas IPSec encapsulation without tunneling only requires 2x the overhead (just the additional authentication header). Worse, Wireguard also requires UDP encapsulation (i.e. IP inside UDP+IP), which means 4x the overhead. To be fair, IPSec tunneling is quite common (unsure if its the predominant mode) because tunneling makes routing easier. And for road warrior setups where the peer is often behind a NAT gateway, IPSec VPNs will also tend to use UDP. In such cases there's no advantage to IPSec.
    - Avamander 7y ago
      IPSec is just usually an abysmal inane thing to set up, with defaults from the 90s and an extra bonus of error messages and documentation that just make you cuss. I don't recommend anyone IPSec, whatever it offers, after you spend all the time making sure your configuration is good, is really not worth it if you can do Wireguard or even OpenVPN. Ugh, I'm annoyed just thinking about it again.
      - izacus 7y ago
        The best part is when you find out your phone supports set of parameters A, your tablet set of parameters B and your MacBook set of parameters C.... and there's no intersection between sets.
yardie 7y ago
Anyone have recommendations on home routers that can run Wireguard?
- rahimnathwani 7y ago
  ASUS RT-AC86U with Koolshare firmware (derived from Merlin firmware) has Wireguard binaries, but no GUI configuration for it. I expect that any Asus router that can run Merlin should allow you to ssh in to install Wireguard. But you might need to cross-compile it on another system, and obviously the lower end models might struggle with CPU usage.
  - judge2020 7y ago
    On that note, are there any GUI tools for wireguard at all (other than Algo)?
  - yardie 7y ago
    Does this apply to the RT-68U (which I do have)?
    - rahimnathwani 7y ago
      Probably not. The Koolshare group (whose modified version of Asus Merlin is targeted at folks in China) have stopped development for the RT-AC68U, and IIRC this was before they started working on integrating Wireguard into their builds. It looks like Asuswrt-Merlin uses different kernel version for different routers (probably because the use the kernel from Asus' own open source releases). I'm pretty sure the kernel for the AC68U is too old to support Wireguard. This link has more info: https://github.com/RMerl/asuswrt-merlin.ng/issues/210 https://github.com/RMerl/asuswrt-merlin.ng/issues/210
- sjy 7y ago
  The Ubiquiti EdgeRouters can run a third-party WireGuard module [1] and include entry-level devices under $100. [1] https://github.com/Lochnair/vyatta-wireguard https://github.com/Lochnair/vyatta-wireguard
Grollicus 7y ago
I'm running WG for some time and it works really well. Was super easy to set up - I did it in like 1-2hrs during a hacker conference last year, so even with blinking led lights all around it was very straightforward. On the other hand I've yet to achieve sane battery lifetimes on my smartphone with a VPN active. I suspect it's because the VPN needs to reconnect whenever one of my messengers checks for new messages, or similar background services. Anyone have experience how to improve that?
- ignoramous 7y ago
  I think it's the encryption overhead that burns the CPU cycles in turn affecting battery life. Other than that, it could be a bug (not releasing wakelocks, or waking up too frequently, or generally doing too many battery intensive tasks) in the VPN client that drains battery. I think, on Android at least, IPSec is impl in kernel space so technically a VPN based on that should be more efficient. Wireguard is being upstreamed into Linux, so there's a chance Android picks it up and the efficiency improves.
  - wahern 7y ago
    IPSec tends to use AES, which can be 2x to 4x more performant than ChaCha20 thanks to hardware acceleration. And the power savings may be even greater than the throughput differences.
    - microcolonel 7y ago
      Should be added that this is highly dependent on the specific hardware. AES is cripplingly slow where accelerators are misconfigured or otherwise unavailable. If you have a brain larger than your leg, you should consider configuring an IPSec endpoint to save power on your phone.
  - jeroenhd 7y ago
    When I used OpenVPN, the VPN had to keep sending keepalives and periodic key renegotiations to keep the session open. This is fine on a PC, but it keeps waking up the radio hardware on a mobile device which is a real battery drain. It's the same as running an app on the background that constantly polls for data, something Android spent a lot of time on fighting to gain better battery time. I wouldn't hold my breath for official WireGuard support in the manufacturer Android kernels until some big corporations start relying on it but custom ROMs are able to use kernel modules already[1]. Encryption itself should not be much overhead. WireGuard cryptography is based on ChaCha20. While I haven't encountered any hardware support for ChaCha, it's performance is quite good, so good even that Google is requiring manufacturers of very low power Android devices (running Android 10+ Go) to implement ChaCha-based encryption on budget devices [2]. [1]: https://git.zx2c4.com/android_kernel_wireguard/about/ https://git.zx2c4.com/android_kernel_wireguard/about/ [2]: https://security.googleblog.com/2019/02/introducing-adiantum-encryption-for.html https://security.googleblog.com/2019/02/introducing-adiantum...
tgtweak 7y ago
Just use softether - free, simple, open source, fast and secure. Best of all it runs on almost any platform you could want to run it on (both server and client!) You can even bounce off or azure to set up the tunnel when your vpn server is behind a natted firewall. It supports 16-channel connections to max out line throughput even over very long distances between server and client. It can support native windows clients, has openvpn shim for legacy client's on that side. I'm not doing it justice - there's so many features (all gui-configurable) that are supremely thought out. Truly one of the best examples of free software I can think of. Edit: https://github.com/SoftEtherVPN/SoftEtherVPN https://github.com/SoftEtherVPN/SoftEtherVPN
- mikl 7y ago
  > free, simple, open source, fast and secure So is Wireguard?
  - therein 7y ago
    And what I like about Wireguard is that you can't port scan for it. The protocol is designed in such a way that the wireguard server won't respond unless you know the right key.
  - tgtweak 7y ago
    Not saying wireguard isn't. I will say I've used softether on 10gbps links and hit 8gbps between two continents and that was nearly impossible with every other solution 5 years ago when I first set it up. It's been running flawlessly since then.
    - tanderson92 7y ago
      Wireguard didn't exist 5 years ago, so this comparison seems inapt on the current topic. That is, unless you merely want to promote softether... :-)
- mjsir911 7y ago
  I've ended up using softether for the sstp server support, and my only complaint with it is that it feels like a second-class citizen from the linux CLI. Configuring it is a pain done through their `vpncmd` command which gives you a shell with custom commands (not very automatable/reproducable) Logging is also stuck between logging to a file or sending it to a syslog port, which, with the rise of systemd, leaves it logging to nowhere that journald can access It's a pretty solid piece of software, but it definitely feels like it was developed for windows GUI admins
jedisct1 7y ago
Unfortunately, Wireguard will not work if you are not on a network where only TCP ports 80 and 443 are open. For these, you can try DSVPN, which is even easier than Wireguard to set up: https://github.com/jedisct1/dsvpn https://github.com/jedisct1/dsvpn
- hghhbvv 7y ago
  But DSVPN requires a server on such network, too, with certain ports accessible from the internet. If you use a cloud server with Wireguard it too can relay traffic between your home client and destination.
- exhilaration 7y ago
  Why can't you just tell Wireguard to listen on port 443? wg set wg0 listen-port 51820...
  - detaro 7y ago
    It uses UDP, not TCP. (Which is generally a sensible choice for a VPN, but is a limitation if UDP is filtered)
    - JoshTriplett 7y ago
      Fortunately, UDP will eventually stop being filterable on a functional network, once HTTP/3 becomes widely used. At that point, I'd expect the next round of VPNs to look like HTTP/3 traffic.
- finchisko 7y ago
  I saw recently here on HN, post about guy tunneling wireguard udp traffic over some sort of tcp websocket proxy.
- Youden 7y ago
  Or you can run UDP over TCP with a tool like this one: https://github.com/wangyu-/udp2raw-tunnel https://github.com/wangyu-/udp2raw-tunnel
big_chungus 7y ago
Question: I use wireguard and like it, but have a problem. At work, I can only get out on ports 80 and 443 TCP. I've tried openvpn, but it's a pain, slow, etc. Any better options? My dilemma is stuff like sshuttle, dsvpn, etc. all seems to be linux-only, linux & mac, etc; I need something with windows, linux, mac, and android.
- unixhero 7y ago
  ssh tunnels
- rahimnathwani 7y ago
  Assuming it's just port blocking, and you're not behind a proxy or DPI, just run a shadowsocks server listening on 80 or 443. There are good, free clients for Windows, Android and Mac. The client for Android hat will handle both connecting to the shadowsocks server and establishing a local SOCKS proxy, and redirecting regular network requests over that proxy. I'm not sure if the clients for other platforms do that, or if they only work with apps that can use a SOCKS proxy.
  - big_chungus 7y ago
    This is the answer for which I was looking; thank you for your help!
- NilsIRL 7y ago
  you can try udptunnels: https://github.com/wangyu-/udp2raw-tunnel https://github.com/wangyu-/udp2raw-tunnel https://github.com/astroza/udptunnel https://github.com/astroza/udptunnel
- nitrohorse 7y ago
  You could give Outline a try (self-hosted Shadowsocks VPN): https://getoutline.org/ https://getoutline.org/
- finchisko 7y ago
  Recently appeared here on HN. https://github.com/erebe/wstunnel https://github.com/erebe/wstunnel
jeroenhd 7y ago
Haven't seen it mentioned here yet, so this might be useful to someone getting into WireGuard: https://github.com/subspacecloud/subspace https://github.com/subspacecloud/subspace This is a tool that helps you generate and manage configurations for WireGuard, generate qr code for configuring mobile devices and it even integrates into SAML for authentication. It's not as fancy as some other VPN management tools but this is an easy way to get WireGuard set up without too much messing with configs
- ekianjo 7y ago
  Thanks, I did the whole thing manually a few weeks ago and this looks like a good solution at least for mobile devices!
- johntash 7y ago
  Thanks for linking this, I hadn't heard of subspace before. Does it handle IP assignment/configuration as well?
  - balboah 7y ago
    I’ve made a http json service that allocates IPs and configures WireGuard. Not sure if it can be used for this project but here it is: https://github.com/balboah/wireguard-operator https://github.com/balboah/wireguard-operator
  - jeroenhd 7y ago
    Yes, although it's not very configurable in a Docker environment without editing the Dockerfile yourself (hardcoded IP ranges and all that, though it does assign a new IP to each new profile you generate). You can still modify the Dockerfile if you wish to have more control over things like IP ranges and the DNS server used by clients but you'd have to rebuild the container after modifying. You will also likely need to make some changes to your iptables and/or sysctl depending on your server config and firewall. Nothing too shocking per se; you need to do all that with any other kind of VPN as well.
  - nemosaltat 7y ago
deleted 7y ago
[deleted]
dmos62 7y ago
To hijack the thread a bit, what's your favorite way of accessing your home server that's behind a NAT (and you can't port-forward)?
- whisk3rs 7y ago
  Try a Tor hidden service, configured with the low-latency/lower-privacy settings. It is slower than many of the other solutions, but very reliable and very simple.
- krazykringle 7y ago
  Zerotier (mentioned below) is perfect for this! To expand a little bit: it provides an (almost) zero-configuration way to set up a private 'layer 2' network that you can connect your home server to, and any other machines that you want to be able to connect to it or to each other. It handles NAT traversal completely transparently. In practice, it means that if I have a (say) NFS server connected to a Zerotier network I control, I can connect to it transparently from anywhere from another machine on that network, no matter what NATs / firewalls either machine is behind, even if they change. Perfect for phones, roving laptops, etc. I've gone to a model where I do most of my development (over mosh/tmux) on my home machine, from wherever I happen to be. No home firewall configuration needed at all.
  - johntash 7y ago
    +1 for Zerotier. I really like wireguard, but Zerotier is so much easier and quicker to set up from scratch. If wireguard had ACLs and ipam built-in, it probably would probably win me over.
  - tbyehl 7y ago
    I've long been confused about Wireguard getting all the attention over ZeroTier. ZT is so good at finding a communications path that I had to figure out how to block it from traversing one of my IPSec tunnels.
  - finchisko 7y ago
    Maybe because it's not open source, only free for personal use?
jsmith12673 7y ago
Just tried going through this tutorial. I can get traffic to forward through the server just fine, but for some reason, DNS refuses to resolve. I've tried: - Having no DNS explicitly specified - Having unbound DNS server run locally - Using public facing DNS like 1.1.1.1 And none of them seem to make DNS resolve. Anyone else run into this?
- mikl 7y ago
  Question is if you can reach any systems after the server. Have you tried pinging 8.8.8.8 or some other IP while connected?
  - jsmith12673 7y ago
    Indeed. For example, I can ping 8.8.8.8, or I can directly curl an IP for a webpage. It's just the DNS portion that doesn't get through.
trimtab 7y ago
I've been using tinc for quite while. How does it compare to Wireguard? One Tinc advantage is that it can run on an Openwrt router.
- cartoonworld 7y ago
  Whats wrong with wg on openwrt? https://openwrt.org/docs/guide-user/services/vpn/wireguard/start https://openwrt.org/docs/guide-user/services/vpn/wireguard/s...
- mindslight 7y ago
  They're somewhat complimentary. I've got both running along side each other. Wireguard has much better throughput, but tinc guarantees a fully connected network (each node can reach every other node). I wish wireguard could accept overlapping AllowedIPs ranges, appear as an L2 interface, and take a nexthop from the system routing table. Imagine multiple hosts each providing egress to each other - tinc can do this topology when setup to act as an ethernet segment. But wireguard is so trivial to setup, it's easy enough to run a parallel instance for each horizon.
Osiris 7y ago
Does anyone know of any inexpensive VPS or cloud instances that provide support for wireguard?
- dan15 7y ago
  Works fine on BuyVM, which starts at $20/year. https://buyvm.net/kvm-dedicated-server-slices/ https://buyvm.net/kvm-dedicated-server-slices/
- balladeer 7y ago
  Check LowEndTalk for cheap VPS. That’s where I head when I need few to play with or for things like a seedbox.
  - Osiris 7y ago
    Most VPS services I've used don't have the WireGuard kernel module installed and, of course, you can't install kernel modules in VPSs.
    - detaro 7y ago
      You can install kernel modules in most types of VPS. OpenVZ is the only somewhat common type that doesn't support it.
      - Osiris 7y ago
        KVM VPSs are generally significantly more expensive than OpenVZ, so for side projects where I want a cheap (<$5/mn) plan I've always used the OpenVZ VPSs.
    - psic4t 7y ago
      You can use the go implementation of wireguard (wireguard-go). This way you don't need a kernel module. Works for me on a really cheap OpenVZ VPS since months.
desdiv 7y ago
I've been using WireGuard for years and it's been great, now I'm looking into some advanced resilient/redundant setups and was wondering whether it's possible or not with WireGuard: 1. I have two unreliable ISP links to the internet. Is it possible to have dual redundancy WireGuard connections to the same server? I.e. each UDP packet is replicated (with the appropriate headers) and a copy sent over each link. 2. My ISP links have heavy throttling at peak hours with heavy packet losses. Is it possible to trade bandwidth for reliability and send each UDP packet twice (with the appropriate headers)? I don't mind halving my maximum theoretical bandwidth; I'd rather have a 1Mb/s reliable connection than a 10Mb/s unreliable connection.
cmod 7y ago
FWIW: On a recent trip to China, Wireguard setup on a Digital Ocean VPS was the only VPN to work consistently and reliably throughout. Express VPN was recommended as the "best" for China, but I found it rarely worked.
- kirvyteo 7y ago
  Thanks for the tip. I have been sourcing for alternatives to ExpressVPN for China. Last year was pretty ok but on a recent trip, it had difficulty connecting 70% of the time and failed in multiple cities inland and on the coast. Seems like I need to setup my own now.
the_resistence 7y ago
I wish I understood the technicalities better. This doesn't work in mainland China.
yeswecatan 7y ago
I've been curious about VPNs for sometime but unfortunately am still confused by the following questions: - my ISP can still see all of my traffic because my RPi would talk to my router which has to exit my network at some point, right? - if I was on the East coast and wanted, say, YoutubeTV to believe I was on the West coast I would need to have my client (laptop, would be cool if I could get my Roku or TV to do this) pointed to my RPi on the other coast. Is that how it works?
- judge2020 7y ago
  1. Yes, other than other things that are self-encrypted eg. HTTPS. You would need to host the VPN somewhere else (eg. Cloud hosting, but that brings issues with many sites having blacklisted your IP range) if you still don't trust your ISP. I imagine this VPN solution is primarily for keeping your home connection's IP address while on a mobile network, or where you're on public wifi and really don't trust the network operator. 2. Yes, but be wary about actually doing this; I can't find any cases but YouTube TV (or the Google session security system itself) might get suspicious about constantly jumping between the east and west coast.
ptsneves 7y ago
I set up a lightsail instance for 3 dollars with algo. The only configuration in algo I made was that I disabled peer isolation so I can control my home and server appliances from anywhere. No problem whatsoever with blocked sites. The only weird thing is that I get American YouTube which has quite longer ads. Also it's kind of funny to see ads from the USA. I am an emigrant in Poland and funnily I sometimes tune the portuguese online radio to hear the portuguese ads.
- awzeemo 7y ago
  Same! If you're trying to tinker with security stuff Høgh makes a great post, but for anything else Algo is the way to go. https://github.com/trailofbits/algo https://github.com/trailofbits/algo

616 points by mikl 7y ago

Cool to see this done by hand. I’m running IPSec on my Edgerouter but am about to redo my home network and lab environment and will likely implement WireGuard. There’s also a more plug-n-play tool called Algo that is highly spoken of, which automates a lot of this: https://github.com/trailofbits/algo https://github.com/trailofbits/algo

TimTheTinker 7y ago
Algo is pretty cool for setting up an IKEv2 VPN server, but under the hood it uses StrongSwan, which is far more complicated in a code/engineering sense than WireGuard. That being said, I think Algo is often preferable to OpenVPN and IPSec, especially when supporting macOS/iOS clients.
- smhenderson 7y ago
  I know what you mean when it comes to OpenVPN and macOS. But any insight on why you'd prefer Algo over OpenVPN? I've been using the latter for years but would be interested in revisiting that if there are compelling reasons to do so.
  - gesman 7y ago
    I think Algo is just a setup script, not a VPN itself?
- tptacek 7y ago
  Algo does a fine job of setting up WireGuard, which is what you should use if you can.
tylermenezes 7y ago
FYI WireGuard is pretty slow on the Edgerouter compared to IPSec. I assume IPSec has a hardware offload and WireGuard does not.
- JustSomeNobody 7y ago
  Yes, IPSec is supported for HW offload: https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRouter-Hardware-Offloading https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRou... Disappointed to hear the performance hit with WireGuard. I was planning on trying it out, but I think I'll wait.
  - zrm 7y ago
    Note that hardware offload only really matters when you're combining fast networks with slow processors. WireGuard on a modern PC CPU will more than saturate gigabit ethernet and the per-packet latency hit is <1ms.
  - msh 7y ago
    Well for some of their routers its false advertising. On the edgerouter x ipsec offload for client vpn have been broken for more than a year.
- elabajaba 7y ago
  According to https://an.undulating.space/post/181227-er_alternate_firmware_vpn_benchmarks/ https://an.undulating.space/post/181227-er_alternate_firmwar... Wireguard is just as fast as hardware accelerated IPSec on both the Edgerouter X and Lite. With Openwrt on the Edgerouter Lite Wireguard is ~2x faster than hardware accelerated IPSec on EdgeOS.
  - wahern 7y ago
    They don't give the IPSec parameters. Wireguard uses ChaCha20 for encryption with Poly1305 for authentication. IPSec can use many different combinations of cipher and authentication algorithms. If they were using AES+SHA256 then SHA256 would likely be the bottleneck. AFAIU, Ubiquiti routers use a crypto coprocessor (as opposed to AES-NI and SHA-NI on amd64), which means even if SHA256 was accelerated on the coprocessor it could easily still be too costly. But we don't even know if the MAC was accelerated at all. The implication that "IPSec acceleration" handicaps Wireguard is unfounded. If those benchmarks were with AES+GCM, then that would definitely be surprising. But the safe bet is that they were using AES+SHA256 (or something other than GCM for the MAC), in which case their benchmarks are not surprising, simply misleading. IPSec can also do ChaCha20+Poly1305 (at least, OpenBSD's stack can). Any serious comparison should also include IPSec using the same crypto algorithms as Wireguard.

metalliqaz 7y ago

I've been using OpenVPN on my home pfSense box, it's working pretty good and didn't require I install anything except the OpenVPN app on my phone. Not sure if WireGuard has anything to offer that would motivate a switch.

soohyung 7y ago
It's faster. But if you already have a working system that you are happy with it may not warrant a switch. I think it's main strength lies in how easy it is to set up though. First time setting it up from scratch I had a working VPN in less than 5 minutes.
mikl 7y ago
Wireguard does claim to be faster. It’s also much simpler from a design perspective, so it might end up being more secure. But other than that, there’s no big reason to switch if you have a setup you’re happy with.
- tptacek 7y ago
  It doesn't just claim to be faster; it's clearly, materially, obviously faster, at least in straightforward configurations (which is to say that someone could come up with some weird OpenVPN configuration that makes up the [large] gap, but I haven't see that yet).
  - 1996 7y ago
    IF you only use AH with strongswan then it is faster than either wireguard or openvpn
    - mikl 7y ago
      The question was if there was a reason to switch away from OpenVPN ;)
    - psanford 7y ago
      If you are just using AH you aren't encrypting your traffic so it isn't really comparable to wireguard or openvpn.

heyoni 7y ago

Anyone know roughly where to look for in terms of potential bottlenecks? I’m running my server on an rpi4 and sometimes feel like I’m not getting great speeds to my home VPN server. I did do my due diligence by wiring it directly through Ethernet but I suspect my router (google WiFi) may be slowing things down.

mikl 7y ago
Number one would probably be to ensure the rpi has a good cabled connection to the router (and make sure it uses it instead of WiFi). VPN connections going back and forth over WiFi would slow things down. Next bottleneck would probably be CPU. Check if the CPU is being maxed out or throttled when you’re using the VPN.
- heyoni 7y ago
  I don't think I ever even set up wifi, but I'm going to follow another reply that suggested tools for testing the real speed that the rpi is getting.
irq 7y ago
Does your rpi4 have proper cooling? Unlike all past rpis, the stock cooling on the rpi4 is easily overwhelmed by even slight load, and it drastically slows down in that situation.
- heyoni 7y ago
  I put on an aluminum case for passive cooling and now it runs around 48 celsius as opposed to 70+ before. That should be good right?
  - irq 7y ago
    Does the case make direct metal to metal contact with all 3 major heat producing chips on the rpi4? IIRC, the chip related to ethernet gets very, very hot in use and not all metal rpi4 cases actually make contact with it.

vsviridov 7y ago

I use wireguard for personal VPN on multiple servers, and to make things a bit easier for provisioning I wrote this simple tool: https://gitlab.com/vsviridov/wg-provision https://gitlab.com/vsviridov/wg-provision

xbhdhdhd 7y ago

Ive attempted to setup openVPN a few times and ended up giving up. Anyone know if there has been an effort to help non networking experts deploy it?

bananaeater 7y ago
For use on a VPS with an external IP, I've had success with this https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install For use to connect to home network drives, I've used ZeroTier https://www.zerotier.com/ https://www.zerotier.com/. I've never had an external IP for home internet, so I always ran in headaches trying to do a home VPN to channel my internet traffic while I'm out and about (and that's why I use a VPN on a VPS for that).
- SturgeonsLaw 7y ago
  Seconding this recommendation - I've used Nyr's script to deploy OpenVPN a couple of times and it's worked well. I can also recommend OpenVPN's virtual appliances: https://openvpn.net/virtual-appliances/ https://openvpn.net/virtual-appliances/ They work out-of-the-box and come with a web UI for configuration, if that's your thing. That said, I've moved on to Wireguard lately and will be unlikely to use OpenVPN for personal VPN networks in the future.
Havoc 7y ago
>Ive attempted to setup openVPN a few times and ended up giving up. Give wireguard a try. Had the same experience with OpenVPN, yet got wireguard to work pretty much immediately.
sccxy 7y ago
I used raspberry pi and this: http://www.pivpn.io/ http://www.pivpn.io/ Works very well for me.
- chrsstrm 7y ago
  I literally set one of these up last night with a Pi 4 and the longest step was dd’ing Raspbian Buster Lite to the SD card. Only real gotcha in setup is remember to set up SSH before booting if you’re going headless. Everything else is super easy.

CubicsRube 7y ago

Maybe a dumb question, but does anyone sets up their VPN server in the cloud? Could cheapest droplet on DigitalOcean [0] handle traffic for browsing or youtube? [0] https://www.digitalocean.com/pricing/#standard-compute-trigger https://www.digitalocean.com/pricing/#standard-compute-trigg...

tprynn 7y ago
Yes and yes, the $5 droplet is perfect for wireguard.
mikl 7y ago
Yeah, if you don’t have a home network you want access to, a cloud server would do just fine. Smallest droplet would probably be fine, if you’re not streaming 4K video. Same goes for the 1TB transfer limit.
farss 7y ago
Not dumb at all. I'm doing this on a $5 droplet and it's faster than any of the commercial VPN's I'm currently paying for. It's a little less privacy protective than many VPN providers however - Digital Ocean will for example forward DMCA violation nastygrams they receive from content owners.
- tgtweak 7y ago
  You'll get recapcha'd like crazy. Also some e-commerce sites will refuse purchases when made from hosting-allocated IP ranges since it's commonplace for fraud.
  - big_chungus 7y ago
    At least for me on linode, it's less-bad than others I've seen. Google doesn't typically get nasty; I think I can only think of a few sites that are especially bad (linkedin and arstechnica forums are two that come to mind). That probably has to do with me using the same IP for ~2yrs now, so it doesn't have reputation problems.
7y ago

valkum 7y ago

Hosting my Wireguard server on a scaleway instance, I encountered a very slow performance. Some web pages didn't load at all. Server was under no load. Lowering the MTU on the client and the server from 1500 to 1360 solved the problem. FYI

AlexandrB 7y ago
Sounds like IP fragmentation. This is pretty normal with any VPN or tunnelling protocol unless the MTU is set correctly. [1] https://en.wikipedia.org/wiki/IP_fragmentation https://en.wikipedia.org/wiki/IP_fragmentation
- wahern 7y ago
  It's worse with VPNs like Wireguard because Wireguard only supports tunneling (e.g. IP in IP), which when you add the authentication header means a minimum of 3x the overhead of a regular connection, whereas IPSec encapsulation without tunneling only requires 2x the overhead (just the additional authentication header). Worse, Wireguard also requires UDP encapsulation (i.e. IP inside UDP+IP), which means 4x the overhead. To be fair, IPSec tunneling is quite common (unsure if its the predominant mode) because tunneling makes routing easier. And for road warrior setups where the peer is often behind a NAT gateway, IPSec VPNs will also tend to use UDP. In such cases there's no advantage to IPSec.
  - Avamander 7y ago
    IPSec is just usually an abysmal inane thing to set up, with defaults from the 90s and an extra bonus of error messages and documentation that just make you cuss. I don't recommend anyone IPSec, whatever it offers, after you spend all the time making sure your configuration is good, is really not worth it if you can do Wireguard or even OpenVPN. Ugh, I'm annoyed just thinking about it again.
    - izacus 7y ago
      The best part is when you find out your phone supports set of parameters A, your tablet set of parameters B and your MacBook set of parameters C.... and there's no intersection between sets.

yardie 7y ago

Anyone have recommendations on home routers that can run Wireguard?

rahimnathwani 7y ago
ASUS RT-AC86U with Koolshare firmware (derived from Merlin firmware) has Wireguard binaries, but no GUI configuration for it. I expect that any Asus router that can run Merlin should allow you to ssh in to install Wireguard. But you might need to cross-compile it on another system, and obviously the lower end models might struggle with CPU usage.
- judge2020 7y ago
  On that note, are there any GUI tools for wireguard at all (other than Algo)?
- yardie 7y ago
  Does this apply to the RT-68U (which I do have)?
  - rahimnathwani 7y ago
    Probably not. The Koolshare group (whose modified version of Asus Merlin is targeted at folks in China) have stopped development for the RT-AC68U, and IIRC this was before they started working on integrating Wireguard into their builds. It looks like Asuswrt-Merlin uses different kernel version for different routers (probably because the use the kernel from Asus' own open source releases). I'm pretty sure the kernel for the AC68U is too old to support Wireguard. This link has more info: https://github.com/RMerl/asuswrt-merlin.ng/issues/210 https://github.com/RMerl/asuswrt-merlin.ng/issues/210
sjy 7y ago
The Ubiquiti EdgeRouters can run a third-party WireGuard module [1] and include entry-level devices under $100. [1] https://github.com/Lochnair/vyatta-wireguard https://github.com/Lochnair/vyatta-wireguard

Grollicus 7y ago

I'm running WG for some time and it works really well. Was super easy to set up - I did it in like 1-2hrs during a hacker conference last year, so even with blinking led lights all around it was very straightforward. On the other hand I've yet to achieve sane battery lifetimes on my smartphone with a VPN active. I suspect it's because the VPN needs to reconnect whenever one of my messengers checks for new messages, or similar background services. Anyone have experience how to improve that?

ignoramous 7y ago
I think it's the encryption overhead that burns the CPU cycles in turn affecting battery life. Other than that, it could be a bug (not releasing wakelocks, or waking up too frequently, or generally doing too many battery intensive tasks) in the VPN client that drains battery. I think, on Android at least, IPSec is impl in kernel space so technically a VPN based on that should be more efficient. Wireguard is being upstreamed into Linux, so there's a chance Android picks it up and the efficiency improves.
- wahern 7y ago
  IPSec tends to use AES, which can be 2x to 4x more performant than ChaCha20 thanks to hardware acceleration. And the power savings may be even greater than the throughput differences.
  - microcolonel 7y ago
    Should be added that this is highly dependent on the specific hardware. AES is cripplingly slow where accelerators are misconfigured or otherwise unavailable. If you have a brain larger than your leg, you should consider configuring an IPSec endpoint to save power on your phone.
- jeroenhd 7y ago
  When I used OpenVPN, the VPN had to keep sending keepalives and periodic key renegotiations to keep the session open. This is fine on a PC, but it keeps waking up the radio hardware on a mobile device which is a real battery drain. It's the same as running an app on the background that constantly polls for data, something Android spent a lot of time on fighting to gain better battery time. I wouldn't hold my breath for official WireGuard support in the manufacturer Android kernels until some big corporations start relying on it but custom ROMs are able to use kernel modules already[1]. Encryption itself should not be much overhead. WireGuard cryptography is based on ChaCha20. While I haven't encountered any hardware support for ChaCha, it's performance is quite good, so good even that Google is requiring manufacturers of very low power Android devices (running Android 10+ Go) to implement ChaCha-based encryption on budget devices [2]. [1]: https://git.zx2c4.com/android_kernel_wireguard/about/ https://git.zx2c4.com/android_kernel_wireguard/about/ [2]: https://security.googleblog.com/2019/02/introducing-adiantum-encryption-for.html https://security.googleblog.com/2019/02/introducing-adiantum...

tgtweak 7y ago

Just use softether - free, simple, open source, fast and secure. Best of all it runs on almost any platform you could want to run it on (both server and client!) You can even bounce off or azure to set up the tunnel when your vpn server is behind a natted firewall. It supports 16-channel connections to max out line throughput even over very long distances between server and client. It can support native windows clients, has openvpn shim for legacy client's on that side. I'm not doing it justice - there's so many features (all gui-configurable) that are supremely thought out. Truly one of the best examples of free software I can think of. Edit: https://github.com/SoftEtherVPN/SoftEtherVPN https://github.com/SoftEtherVPN/SoftEtherVPN

mikl 7y ago
> free, simple, open source, fast and secure So is Wireguard?
- therein 7y ago
  And what I like about Wireguard is that you can't port scan for it. The protocol is designed in such a way that the wireguard server won't respond unless you know the right key.
- tgtweak 7y ago
  Not saying wireguard isn't. I will say I've used softether on 10gbps links and hit 8gbps between two continents and that was nearly impossible with every other solution 5 years ago when I first set it up. It's been running flawlessly since then.
  - tanderson92 7y ago
    Wireguard didn't exist 5 years ago, so this comparison seems inapt on the current topic. That is, unless you merely want to promote softether... :-)
mjsir911 7y ago
I've ended up using softether for the sstp server support, and my only complaint with it is that it feels like a second-class citizen from the linux CLI. Configuring it is a pain done through their `vpncmd` command which gives you a shell with custom commands (not very automatable/reproducable) Logging is also stuck between logging to a file or sending it to a syslog port, which, with the rise of systemd, leaves it logging to nowhere that journald can access It's a pretty solid piece of software, but it definitely feels like it was developed for windows GUI admins

jedisct1 7y ago

Unfortunately, Wireguard will not work if you are not on a network where only TCP ports 80 and 443 are open. For these, you can try DSVPN, which is even easier than Wireguard to set up: https://github.com/jedisct1/dsvpn https://github.com/jedisct1/dsvpn

hghhbvv 7y ago
But DSVPN requires a server on such network, too, with certain ports accessible from the internet. If you use a cloud server with Wireguard it too can relay traffic between your home client and destination.
exhilaration 7y ago
Why can't you just tell Wireguard to listen on port 443? wg set wg0 listen-port 51820...
- detaro 7y ago
  It uses UDP, not TCP. (Which is generally a sensible choice for a VPN, but is a limitation if UDP is filtered)
  - JoshTriplett 7y ago
    Fortunately, UDP will eventually stop being filterable on a functional network, once HTTP/3 becomes widely used. At that point, I'd expect the next round of VPNs to look like HTTP/3 traffic.
finchisko 7y ago
I saw recently here on HN, post about guy tunneling wireguard udp traffic over some sort of tcp websocket proxy.
Youden 7y ago
Or you can run UDP over TCP with a tool like this one: https://github.com/wangyu-/udp2raw-tunnel https://github.com/wangyu-/udp2raw-tunnel

big_chungus 7y ago

Question: I use wireguard and like it, but have a problem. At work, I can only get out on ports 80 and 443 TCP. I've tried openvpn, but it's a pain, slow, etc. Any better options? My dilemma is stuff like sshuttle, dsvpn, etc. all seems to be linux-only, linux & mac, etc; I need something with windows, linux, mac, and android.

unixhero 7y ago
ssh tunnels
rahimnathwani 7y ago
Assuming it's just port blocking, and you're not behind a proxy or DPI, just run a shadowsocks server listening on 80 or 443. There are good, free clients for Windows, Android and Mac. The client for Android hat will handle both connecting to the shadowsocks server and establishing a local SOCKS proxy, and redirecting regular network requests over that proxy. I'm not sure if the clients for other platforms do that, or if they only work with apps that can use a SOCKS proxy.
- big_chungus 7y ago
  This is the answer for which I was looking; thank you for your help!
NilsIRL 7y ago
you can try udptunnels: https://github.com/wangyu-/udp2raw-tunnel https://github.com/wangyu-/udp2raw-tunnel https://github.com/astroza/udptunnel https://github.com/astroza/udptunnel
nitrohorse 7y ago
You could give Outline a try (self-hosted Shadowsocks VPN): https://getoutline.org/ https://getoutline.org/
finchisko 7y ago
Recently appeared here on HN. https://github.com/erebe/wstunnel https://github.com/erebe/wstunnel

jeroenhd 7y ago

Haven't seen it mentioned here yet, so this might be useful to someone getting into WireGuard: https://github.com/subspacecloud/subspace https://github.com/subspacecloud/subspace This is a tool that helps you generate and manage configurations for WireGuard, generate qr code for configuring mobile devices and it even integrates into SAML for authentication. It's not as fancy as some other VPN management tools but this is an easy way to get WireGuard set up without too much messing with configs

ekianjo 7y ago
Thanks, I did the whole thing manually a few weeks ago and this looks like a good solution at least for mobile devices!
johntash 7y ago
Thanks for linking this, I hadn't heard of subspace before. Does it handle IP assignment/configuration as well?
- balboah 7y ago
  I’ve made a http json service that allocates IPs and configures WireGuard. Not sure if it can be used for this project but here it is: https://github.com/balboah/wireguard-operator https://github.com/balboah/wireguard-operator
- jeroenhd 7y ago
  Yes, although it's not very configurable in a Docker environment without editing the Dockerfile yourself (hardcoded IP ranges and all that, though it does assign a new IP to each new profile you generate). You can still modify the Dockerfile if you wish to have more control over things like IP ranges and the DNS server used by clients but you'd have to rebuild the container after modifying. You will also likely need to make some changes to your iptables and/or sysctl depending on your server config and firewall. Nothing too shocking per se; you need to do all that with any other kind of VPN as well.
- nemosaltat 7y ago

deleted 7y ago

[deleted]

dmos62 7y ago

To hijack the thread a bit, what's your favorite way of accessing your home server that's behind a NAT (and you can't port-forward)?

whisk3rs 7y ago
Try a Tor hidden service, configured with the low-latency/lower-privacy settings. It is slower than many of the other solutions, but very reliable and very simple.
krazykringle 7y ago
Zerotier (mentioned below) is perfect for this! To expand a little bit: it provides an (almost) zero-configuration way to set up a private 'layer 2' network that you can connect your home server to, and any other machines that you want to be able to connect to it or to each other. It handles NAT traversal completely transparently. In practice, it means that if I have a (say) NFS server connected to a Zerotier network I control, I can connect to it transparently from anywhere from another machine on that network, no matter what NATs / firewalls either machine is behind, even if they change. Perfect for phones, roving laptops, etc. I've gone to a model where I do most of my development (over mosh/tmux) on my home machine, from wherever I happen to be. No home firewall configuration needed at all.
- johntash 7y ago
  +1 for Zerotier. I really like wireguard, but Zerotier is so much easier and quicker to set up from scratch. If wireguard had ACLs and ipam built-in, it probably would probably win me over.
- tbyehl 7y ago
  I've long been confused about Wireguard getting all the attention over ZeroTier. ZT is so good at finding a communications path that I had to figure out how to block it from traversing one of my IPSec tunnels.
- finchisko 7y ago
  Maybe because it's not open source, only free for personal use?

jsmith12673 7y ago

Just tried going through this tutorial. I can get traffic to forward through the server just fine, but for some reason, DNS refuses to resolve. I've tried: - Having no DNS explicitly specified - Having unbound DNS server run locally - Using public facing DNS like 1.1.1.1 And none of them seem to make DNS resolve. Anyone else run into this?

mikl 7y ago
Question is if you can reach any systems after the server. Have you tried pinging 8.8.8.8 or some other IP while connected?
- jsmith12673 7y ago
  Indeed. For example, I can ping 8.8.8.8, or I can directly curl an IP for a webpage. It's just the DNS portion that doesn't get through.

trimtab 7y ago

I've been using tinc for quite while. How does it compare to Wireguard? One Tinc advantage is that it can run on an Openwrt router.

cartoonworld 7y ago
Whats wrong with wg on openwrt? https://openwrt.org/docs/guide-user/services/vpn/wireguard/start https://openwrt.org/docs/guide-user/services/vpn/wireguard/s...
mindslight 7y ago
They're somewhat complimentary. I've got both running along side each other. Wireguard has much better throughput, but tinc guarantees a fully connected network (each node can reach every other node). I wish wireguard could accept overlapping AllowedIPs ranges, appear as an L2 interface, and take a nexthop from the system routing table. Imagine multiple hosts each providing egress to each other - tinc can do this topology when setup to act as an ethernet segment. But wireguard is so trivial to setup, it's easy enough to run a parallel instance for each horizon.

Osiris 7y ago

Does anyone know of any inexpensive VPS or cloud instances that provide support for wireguard?

dan15 7y ago
Works fine on BuyVM, which starts at $20/year. https://buyvm.net/kvm-dedicated-server-slices/ https://buyvm.net/kvm-dedicated-server-slices/
balladeer 7y ago
Check LowEndTalk for cheap VPS. That’s where I head when I need few to play with or for things like a seedbox.
- Osiris 7y ago
  Most VPS services I've used don't have the WireGuard kernel module installed and, of course, you can't install kernel modules in VPSs.
  - detaro 7y ago
    You can install kernel modules in most types of VPS. OpenVZ is the only somewhat common type that doesn't support it.
    - Osiris 7y ago
      KVM VPSs are generally significantly more expensive than OpenVZ, so for side projects where I want a cheap (<$5/mn) plan I've always used the OpenVZ VPSs.
  - psic4t 7y ago
    You can use the go implementation of wireguard (wireguard-go). This way you don't need a kernel module. Works for me on a really cheap OpenVZ VPS since months.

desdiv 7y ago

I've been using WireGuard for years and it's been great, now I'm looking into some advanced resilient/redundant setups and was wondering whether it's possible or not with WireGuard: 1. I have two unreliable ISP links to the internet. Is it possible to have dual redundancy WireGuard connections to the same server? I.e. each UDP packet is replicated (with the appropriate headers) and a copy sent over each link. 2. My ISP links have heavy throttling at peak hours with heavy packet losses. Is it possible to trade bandwidth for reliability and send each UDP packet twice (with the appropriate headers)? I don't mind halving my maximum theoretical bandwidth; I'd rather have a 1Mb/s reliable connection than a 10Mb/s unreliable connection.

cmod 7y ago

FWIW: On a recent trip to China, Wireguard setup on a Digital Ocean VPS was the only VPN to work consistently and reliably throughout. Express VPN was recommended as the "best" for China, but I found it rarely worked.

kirvyteo 7y ago
Thanks for the tip. I have been sourcing for alternatives to ExpressVPN for China. Last year was pretty ok but on a recent trip, it had difficulty connecting 70% of the time and failed in multiple cities inland and on the coast. Seems like I need to setup my own now.

the_resistence 7y ago

I wish I understood the technicalities better. This doesn't work in mainland China.

yeswecatan 7y ago

I've been curious about VPNs for sometime but unfortunately am still confused by the following questions: - my ISP can still see all of my traffic because my RPi would talk to my router which has to exit my network at some point, right? - if I was on the East coast and wanted, say, YoutubeTV to believe I was on the West coast I would need to have my client (laptop, would be cool if I could get my Roku or TV to do this) pointed to my RPi on the other coast. Is that how it works?

judge2020 7y ago
1. Yes, other than other things that are self-encrypted eg. HTTPS. You would need to host the VPN somewhere else (eg. Cloud hosting, but that brings issues with many sites having blacklisted your IP range) if you still don't trust your ISP. I imagine this VPN solution is primarily for keeping your home connection's IP address while on a mobile network, or where you're on public wifi and really don't trust the network operator. 2. Yes, but be wary about actually doing this; I can't find any cases but YouTube TV (or the Google session security system itself) might get suspicious about constantly jumping between the east and west coast.

ptsneves 7y ago

I set up a lightsail instance for 3 dollars with algo. The only configuration in algo I made was that I disabled peer isolation so I can control my home and server appliances from anywhere. No problem whatsoever with blocked sites. The only weird thing is that I get American YouTube which has quite longer ads. Also it's kind of funny to see ads from the USA. I am an emigrant in Poland and funnily I sometimes tune the portuguese online radio to hear the portuguese ads.

awzeemo 7y ago
Same! If you're trying to tinker with security stuff Høgh makes a great post, but for anything else Algo is the way to go. https://github.com/trailofbits/algo https://github.com/trailofbits/algo