5 ms·

Friendly reminder: Azure and AWS both offer a free tier of VM which are perfectly sufficient for a personal openVPN server. Azure even has a preconfigured optio

Friendly reminder: Azure and AWS both offer a free tier of VM which are perfectly sufficient for a personal openVPN server. Azure even has a preconfigured option in their marketplace that's easy to set up in a legal jurisdiction of your choice. Probably so does AWS and even DigitalOcean, but I'm most familiar with Azure because of my own preference for open source (Azure's orchestrator is https://github.com/microsoft/service-fabric/ https://github.com/microsoft/service-fabric/). After the free year, a minimal always-on VM costs about $13/mo.

homero 7y ago
AWS bandwidth is a killer though
- Sohcahtoa82 7y ago
  Use a LightSail instance and get 2 TB of data transfer included for $5/month.
dbeley 7y ago
Isn't $13/mo quite expensive compared to the cheapest VPS on any cloud providers ? The bandwidth on Azure might be better, but the first tier on OVH, DigitalOcean and Scaleway begins at 3$/mo and you still have 100mbps.
calcifer 7y ago
If the reason you are using a VPN is to avoid potentially untrustworthy middlemen, sure. But if you are after the privacy benefits of sharing an IP address with thousands, then a self hosted VPN won't help you.
- manquer 7y ago
  Why not ? Unless your instance has a reservation of public IP you are sharing the outbound IP with thousands of other traffic. The actual problem with such setups and VPNs is the constant captcha because you are not using a residential IP range
  - calcifer 7y ago
    > Unless your instance has a reservation of public IP you are sharing the outbound IP with thousands of other traffic On which cloud provider do you share an outbound IP with others? AWS, Linode and Digital Ocean all assign a public IP per instance.
    - judge2020 7y ago
      To add: with my own DigitalOcean VPN I rarely see captchas, but some sites block that ASN (like crunchyroll).
badrabbit 7y ago
First that costs too much for many. Second, you don't just want to prevent MITM, you (hopefully) also care about site's tracking you. For example, you have a Linux/Firefox user-agent and you are browsing HN in private mode, you close the window and start over. No cookies or other artifacts of the previous session remains but your user-agent and IP combibation is unique enough to identify your device. Now if you are using a VPN service there might be at least a handful of Linux/Firefox users out of millions that share the same IP. Third, most VPN users like the geoip flexibility it allows them (bypass filtering or access different content). Fourth, a VPS dedicated to this one service means you are now the admin of one more server that needs to be patched and supported by you (admin overhead) Fivth, some sites block you if you use cloud provider IPs Sixth, some VPN providers specifically host their infra in privacy friendly jurisdictions and take precautions cloud/vps providers might not (legally and technically). Seventh, reputation. No one will bat an eye if Microsoft let some country's law enforcement have logs of your traffic in Azure. But by design, outbound VPN traffic can only be logged on the VPN server and it would ruin their reputation if they disclosed logs or tampered with traffic which translates to monetary loss. VPN services are far from perfect but they hardly have any replacement. Just pick one with a good reputation. For example with PIA, they are incorporated in the great surveillance kingdom of the UK, which is why I avoided them. They did not take the neccessary legal precautions and their freenode aquisition made little sense from a profit perspective which all in all suggests a grand scheme/vision not obvious to customers.
- iudqnolq 7y ago
  It depends on your threat model. If you're worried about threats below the level of major nation-states a big company could make more sense. If for example a VPN company was caught bundling malware with their VPN client they would be over, but their owners would loose much less than Google would under the same circumstances. Google will cooperate with big governments, but you can be confident they aren't owned by the Russian mafia.
  - badrabbit 7y ago
    If you're dealing with nation states, all the big cloud providers have NSA presence in their network. Even without that,secret warrants are a thing and VPS providers rent datacenters from someone else ,that someone else (azure,hetzner,ovh,etc...) also rents out infra to VPN providers. The only differrence is VPN providets sell VPN while VPS providers let you access the whole vm. The only differnce is how a VPN provider can be incompetent or malicious. It is less likely for MS to be incompetent but so long as the nation state is a western nation,they are more likely to be malicious. I guess it does depend on your threat model but I would say for most people who don't have specific threat in mind they should exclude highly sophisticated attackers much like how you don't secure your housr against sophisticated bank robbers that might pull a heist on you.
Havoc 7y ago
Kinda defeats the purpose though? You lose the benefit of your traffic being aggregated with lots of other traffic.
akerro 7y ago
I pay ~$3.5 for my dedicated server and already consider it expensive...
- joshmn 7y ago
  For a dedicated server? Or a VPS?
  - akerro 7y ago
    dedicated server
gruez 7y ago
>Friendly reminder: Azure and AWS both offer a free tier of VM which are perfectly sufficient for a personal openVPN server. No, it's not. Both have zero or very low amount of free egress (5GB max). After that you're paying $0.1 per GB of egress traffic.
ignoramous 7y ago
I think Vultr has the cheapest option at $2.5 for a VPS with allowance 1TB of traffic. Scaleaway offers similar options, too. Also see a recent news.yc discussion on cheaper hosting: https://news.ycombinator.com/item?id=21172818 https://news.ycombinator.com/item?id=21172818
- gruez 7y ago
  >I think Vultr has the cheapest option at $2.5 for a VPS with allowance 1TB of traffic. AFAIK that option uses NATed ipv4, so it could dicey unless you know that you have ipv6 everywhere you go.
swebs 7y ago
>After the free year, a minimal always-on VM costs about $13/mo. It's $5 at Linode, and that's not run by a company known for spying on users.
jammygit 7y ago
Digital ocean would be $5 per month. I’m not sure what their logging/privacy policy though because I found their terms documents so broad and confusing

homero 7y ago

AWS bandwidth is a killer though

Sohcahtoa82 7y ago
Use a LightSail instance and get 2 TB of data transfer included for $5/month.

dbeley 7y ago

Isn't $13/mo quite expensive compared to the cheapest VPS on any cloud providers ? The bandwidth on Azure might be better, but the first tier on OVH, DigitalOcean and Scaleway begins at 3$/mo and you still have 100mbps.

calcifer 7y ago

If the reason you are using a VPN is to avoid potentially untrustworthy middlemen, sure. But if you are after the privacy benefits of sharing an IP address with thousands, then a self hosted VPN won't help you.

manquer 7y ago
Why not ? Unless your instance has a reservation of public IP you are sharing the outbound IP with thousands of other traffic. The actual problem with such setups and VPNs is the constant captcha because you are not using a residential IP range
- calcifer 7y ago
  > Unless your instance has a reservation of public IP you are sharing the outbound IP with thousands of other traffic On which cloud provider do you share an outbound IP with others? AWS, Linode and Digital Ocean all assign a public IP per instance.
  - judge2020 7y ago
    To add: with my own DigitalOcean VPN I rarely see captchas, but some sites block that ASN (like crunchyroll).

badrabbit 7y ago

First that costs too much for many. Second, you don't just want to prevent MITM, you (hopefully) also care about site's tracking you. For example, you have a Linux/Firefox user-agent and you are browsing HN in private mode, you close the window and start over. No cookies or other artifacts of the previous session remains but your user-agent and IP combibation is unique enough to identify your device. Now if you are using a VPN service there might be at least a handful of Linux/Firefox users out of millions that share the same IP. Third, most VPN users like the geoip flexibility it allows them (bypass filtering or access different content). Fourth, a VPS dedicated to this one service means you are now the admin of one more server that needs to be patched and supported by you (admin overhead) Fivth, some sites block you if you use cloud provider IPs Sixth, some VPN providers specifically host their infra in privacy friendly jurisdictions and take precautions cloud/vps providers might not (legally and technically). Seventh, reputation. No one will bat an eye if Microsoft let some country's law enforcement have logs of your traffic in Azure. But by design, outbound VPN traffic can only be logged on the VPN server and it would ruin their reputation if they disclosed logs or tampered with traffic which translates to monetary loss. VPN services are far from perfect but they hardly have any replacement. Just pick one with a good reputation. For example with PIA, they are incorporated in the great surveillance kingdom of the UK, which is why I avoided them. They did not take the neccessary legal precautions and their freenode aquisition made little sense from a profit perspective which all in all suggests a grand scheme/vision not obvious to customers.

iudqnolq 7y ago
It depends on your threat model. If you're worried about threats below the level of major nation-states a big company could make more sense. If for example a VPN company was caught bundling malware with their VPN client they would be over, but their owners would loose much less than Google would under the same circumstances. Google will cooperate with big governments, but you can be confident they aren't owned by the Russian mafia.
- badrabbit 7y ago
  If you're dealing with nation states, all the big cloud providers have NSA presence in their network. Even without that,secret warrants are a thing and VPS providers rent datacenters from someone else ,that someone else (azure,hetzner,ovh,etc...) also rents out infra to VPN providers. The only differrence is VPN providets sell VPN while VPS providers let you access the whole vm. The only differnce is how a VPN provider can be incompetent or malicious. It is less likely for MS to be incompetent but so long as the nation state is a western nation,they are more likely to be malicious. I guess it does depend on your threat model but I would say for most people who don't have specific threat in mind they should exclude highly sophisticated attackers much like how you don't secure your housr against sophisticated bank robbers that might pull a heist on you.

Havoc 7y ago

Kinda defeats the purpose though? You lose the benefit of your traffic being aggregated with lots of other traffic.

akerro 7y ago

I pay ~$3.5 for my dedicated server and already consider it expensive...

joshmn 7y ago
For a dedicated server? Or a VPS?
- akerro 7y ago
  dedicated server

gruez 7y ago

>Friendly reminder: Azure and AWS both offer a free tier of VM which are perfectly sufficient for a personal openVPN server. No, it's not. Both have zero or very low amount of free egress (5GB max). After that you're paying $0.1 per GB of egress traffic.

ignoramous 7y ago

I think Vultr has the cheapest option at $2.5 for a VPS with allowance 1TB of traffic. Scaleaway offers similar options, too. Also see a recent news.yc discussion on cheaper hosting: https://news.ycombinator.com/item?id=21172818 https://news.ycombinator.com/item?id=21172818

gruez 7y ago
>I think Vultr has the cheapest option at $2.5 for a VPS with allowance 1TB of traffic. AFAIK that option uses NATed ipv4, so it could dicey unless you know that you have ipv6 everywhere you go.

swebs 7y ago

>After the free year, a minimal always-on VM costs about $13/mo. It's $5 at Linode, and that's not run by a company known for spying on users.

jammygit 7y ago

Digital ocean would be $5 per month. I’m not sure what their logging/privacy policy though because I found their terms documents so broad and confusing