6 ms·

If you're serious about using a VPN, I strongly recommend getting an OpenWRT capable router and setting up your VPN there. Some benefits: - It's physically imp

If you're serious about using a VPN, I strongly recommend getting an OpenWRT capable router and setting up your VPN there. Some benefits: - It's physically impossible for your devices to bypass the VPN. - It also works with devices that have poor or non existent VPN support (e.g. Roku, smart TV, etc.). - You only have to configure it once vs having to configure it on all your devices. - You can easily and quickly toggle the VPN by switching to a Wifi that doesn't have VPN setup. I've been using GL.iNet's travel routers for many years and can't recommend enough (no affiliation other than being a customer). Just ordered their new Beryl router[0]. [0] https://www.gl-inet.com/products/gl-mt1300/ https://www.gl-inet.com/products/gl-mt1300/

intricatedetail 6y ago
I've tried this approach but often i would find traffic going down - especially YT and occassionaly router would crash. Frankly it's like 5 years old now. Are there any modern routers easily handling VPN?
- economusty 6y ago
  Linksys LRT224 has been great for me, I run a permanent VPN to my aws resources.
- zokier 6y ago
  I don't think age is factor here, routers shouldn't "crash" just because you push some bits through it, 5 years old or not.
  - heavyset_go 6y ago
    They are often not actively cooled and not build for high CPU usage and the heat that generates.
  - gjsman-1000 6y ago
    Except, what’s crazy is that they do. I have an ISP-provided Xyzel C1100 modem, and sometimes it does just randomly crash and take about a minute to reload if we’re doing to much. I’d buy a good DSL modem, but it happens just under the threshold where I’d buy a $100 modem to fix it.
  - ksec 6y ago
    Except they do. And I have no idea why either, just like you said, passing bit around.
- rootusrootus 6y ago
  In my experience, stay away from consumer routers and a lot of these sorts of issues go away. Even something as simple and inexpensive as Ubiquiti is miles ahead of anything in the consumer space. I haven't had a router issue in years. And I use VPN every day.
- matlo 6y ago
  I use OP's router (https://www.gl-inet.com/products/gl-mt1300/ https://www.gl-inet.com/products/gl-mt1300/) and it supports Wireguard out of the box and so far it worked very well (used it for 2 months).
kc0bfv 6y ago
I used my router for this purpose until recently. It was difficult to keep up with updates, partly because openwrt versions for my router lagged other versions for long periods. I replaced my router recently and changed my strategy. Now the router is only a router (and firewall of course). I have a raspi sitting next to it providing the wireguard vpn. This is easy to update and everything actually works better than in past. I attribute a large part of that to wireguard over openvpn, though...
BlueTemplar 6y ago
How well do they deal with IPv6 ?
- xncl 6y ago
  For some proprietary software at one of my jobs we had to disable IPv6 for it to work.
sethgecko 6y ago
I've done that a few months ago on an ubiquity router. Two VLANs, one with normal access and one with a Wireguard tunnel into my self hosted dropplet that also runs pihole. Works like a charm.
ComodoHacker 6y ago
>It's physically impossible for your devices to bypass the VPN It's not true. There are bugs and vulnerabilities, some of them can be exploited remotely. OpenWRT is no exception here. Better than many maybe, but not invulnerable. And please, let's stick to professional terminology and call these "VPNs" what they are - transparent L2/L3 proxies.
- Spivak 6y ago
  Bugs and vulnerabilities are an ever-present thing. You don’t really need to mention them when making a statement like the parent’s. Also I don’t think your terminology is really all that helpful. These services are literally VPNs. Trying to make a distinction doesn’t really add anything when VPN is already an established well understood term. This just adds confusion when there are already L3 proxies.
93po 6y ago
Unfortunately the web is harder and harder to use with VPNs. So many websites just completely block you for using them, including etsy and Craigslist off the top of my head.
- Causality1 6y ago
  Also some non-web services can act weirdly with them. In my personal experience Google's voice to text including Assistant commands and transcription often just fails to go through, or takes tens of seconds to get a response over a VPN.
- enraged_camel 6y ago
  Just curious, how do they detect the fact that the connection is from a VPN? Are they subscribing to IP blacklists, or is there some other method?
  - crazygringo 6y ago
    Yes, it's IP blacklists AFAIK. And for sites with a lot of traffic, you probably don't even need an external subscription, you can deduce the ranges yourself simply by checking for IP addresses that wind up having logged-in users from all over the world in a short time frame. Pretty easy to do accurately with a short set of heuristics.
    - gcoleman 6y ago
      Many geo-ip services also offer VPN or server detection (e.g. is the IP in one of the EC2 ranges). In a previous job at an online gambling company we found that a large percentage of fraudulent user accounts came from VPNs so ended up banning them at the geo lookup stage.
  - gjsman-1000 6y ago
    Easy. How many users are logging in from the same IP address is a big clue.
  - penagwin 6y ago
jedimastert 6y ago
> You can easily and quickly toggle the VPN by switching to a Wifi that doesn't have VPN setup. I feel like "quickly" and "easily" a little overstated. Then again, this is someone who is willing to install their a separate firmware on a router, so...
- ryukafalz 6y ago
  Once you have it set up, toggling it would just involve connecting to a different SSID. That's pretty quick and easy; two or three mouse clicks in most OSes I've used. Yes, setting it up in the first place may be fairly involved.
matlo 6y ago
Second this. I have the same router and it's extremely easy to setup, and it supports Wireguard out of the box, which I love for its simplicity. It has a simple interface on top of openWRT, for non-experts like me. Support is a bit crap as it's all in Chinese but it works like a charm.
- pueblito 6y ago
  I have to chime in with a third; I have been very happy with my AR300M from the same supplier for the last CPI years and I am planning on a new one from them soon.
greggman3 6y ago
I'm almost never looking for all my devices to be going over VPN. Rather it's generally one one device at a time and even within that I'd often prefer it to be one app at a time. I have run a VM with the VPN only running in the VM but the overhead of the VM itself is not worth it.
lkxijlewlf 6y ago
So, is it easy to set this up using a phone when you get to a hotel, for example? Do you simply select the hotel wifi to use?
- heavyset_go 6y ago
  I have a similar setup with a travel router running OpenWRT and it is as simple as connecting to the hotel WiFi.
- arbitrage 6y ago
  No, it is not easy. It is messy, the codebase is showing its age, configuration is a nightmare, and throughput overall is pretty shit with so many layers of unoptimized linux piled ontop of hardware that was never optimized to handle this type of packet generation and mangling.
  - SahAssar 6y ago
    > and throughput overall is pretty shit with so many layers of unoptimized linux piled ontop of hardware that was never optimized to handle this type of packet generation and mangling That's a very broad generalization. I use a https://pcengines.ch/ https://pcengines.ch/ based router with openwrt and mullvad as my VPN and performance is very close to non-vpn traffic. Sure, if you run your VPN on bad hardware you might get bad performance but that is not true for everyone.
paulcarroty 6y ago
> I strongly recommend getting an OpenWRT capable router and setting up your VPN there Double it, OpenWRT functionality beats any production router firmware. Bought Linksys some time ago, now searching a cable to flash OpenWRT on it 'cause original firmware feels crazy dumb.
coffeemaniac 6y ago
how would this compare to something like a Protectli?
armandhammer 6y ago
It's better to go with something like a $150 Intel NUC running pfsense (free) to connect to the VPN because the vast majority of Wi-Fi routers don't have enough CPU to decipher 256bit AES encryption in real-time. Once you fire up the VPN on even a top-tier router, you're likely to see your overall connection speed drop to 15 mbit/sec or less. A cheap NUC has no problem doing 256bit AES at 200+ mbit/sec.
touristtam 6y ago
how do you do that for a multiple VPN setup (for work obviously) and that would need to route the connection to different devices, while working only during office hours and take into account the usual MFA crap?

intricatedetail 6y ago

I've tried this approach but often i would find traffic going down - especially YT and occassionaly router would crash. Frankly it's like 5 years old now. Are there any modern routers easily handling VPN?

economusty 6y ago
Linksys LRT224 has been great for me, I run a permanent VPN to my aws resources.
zokier 6y ago
I don't think age is factor here, routers shouldn't "crash" just because you push some bits through it, 5 years old or not.
- heavyset_go 6y ago
  They are often not actively cooled and not build for high CPU usage and the heat that generates.
- gjsman-1000 6y ago
  Except, what’s crazy is that they do. I have an ISP-provided Xyzel C1100 modem, and sometimes it does just randomly crash and take about a minute to reload if we’re doing to much. I’d buy a good DSL modem, but it happens just under the threshold where I’d buy a $100 modem to fix it.
- ksec 6y ago
  Except they do. And I have no idea why either, just like you said, passing bit around.
rootusrootus 6y ago
In my experience, stay away from consumer routers and a lot of these sorts of issues go away. Even something as simple and inexpensive as Ubiquiti is miles ahead of anything in the consumer space. I haven't had a router issue in years. And I use VPN every day.
matlo 6y ago
I use OP's router (https://www.gl-inet.com/products/gl-mt1300/ https://www.gl-inet.com/products/gl-mt1300/) and it supports Wireguard out of the box and so far it worked very well (used it for 2 months).

kc0bfv 6y ago

I used my router for this purpose until recently. It was difficult to keep up with updates, partly because openwrt versions for my router lagged other versions for long periods. I replaced my router recently and changed my strategy. Now the router is only a router (and firewall of course). I have a raspi sitting next to it providing the wireguard vpn. This is easy to update and everything actually works better than in past. I attribute a large part of that to wireguard over openvpn, though...

BlueTemplar 6y ago

How well do they deal with IPv6 ?

xncl 6y ago
For some proprietary software at one of my jobs we had to disable IPv6 for it to work.

sethgecko 6y ago

I've done that a few months ago on an ubiquity router. Two VLANs, one with normal access and one with a Wireguard tunnel into my self hosted dropplet that also runs pihole. Works like a charm.

ComodoHacker 6y ago

>It's physically impossible for your devices to bypass the VPN It's not true. There are bugs and vulnerabilities, some of them can be exploited remotely. OpenWRT is no exception here. Better than many maybe, but not invulnerable. And please, let's stick to professional terminology and call these "VPNs" what they are - transparent L2/L3 proxies.

Spivak 6y ago
Bugs and vulnerabilities are an ever-present thing. You don’t really need to mention them when making a statement like the parent’s. Also I don’t think your terminology is really all that helpful. These services are literally VPNs. Trying to make a distinction doesn’t really add anything when VPN is already an established well understood term. This just adds confusion when there are already L3 proxies.

93po 6y ago

Unfortunately the web is harder and harder to use with VPNs. So many websites just completely block you for using them, including etsy and Craigslist off the top of my head.

Causality1 6y ago
Also some non-web services can act weirdly with them. In my personal experience Google's voice to text including Assistant commands and transcription often just fails to go through, or takes tens of seconds to get a response over a VPN.
enraged_camel 6y ago
Just curious, how do they detect the fact that the connection is from a VPN? Are they subscribing to IP blacklists, or is there some other method?
- crazygringo 6y ago
  Yes, it's IP blacklists AFAIK. And for sites with a lot of traffic, you probably don't even need an external subscription, you can deduce the ranges yourself simply by checking for IP addresses that wind up having logged-in users from all over the world in a short time frame. Pretty easy to do accurately with a short set of heuristics.
  - gcoleman 6y ago
    Many geo-ip services also offer VPN or server detection (e.g. is the IP in one of the EC2 ranges). In a previous job at an online gambling company we found that a large percentage of fraudulent user accounts came from VPNs so ended up banning them at the geo lookup stage.
- gjsman-1000 6y ago
  Easy. How many users are logging in from the same IP address is a big clue.
- penagwin 6y ago

jedimastert 6y ago

> You can easily and quickly toggle the VPN by switching to a Wifi that doesn't have VPN setup. I feel like "quickly" and "easily" a little overstated. Then again, this is someone who is willing to install their a separate firmware on a router, so...

ryukafalz 6y ago
Once you have it set up, toggling it would just involve connecting to a different SSID. That's pretty quick and easy; two or three mouse clicks in most OSes I've used. Yes, setting it up in the first place may be fairly involved.

matlo 6y ago

Second this. I have the same router and it's extremely easy to setup, and it supports Wireguard out of the box, which I love for its simplicity. It has a simple interface on top of openWRT, for non-experts like me. Support is a bit crap as it's all in Chinese but it works like a charm.

pueblito 6y ago
I have to chime in with a third; I have been very happy with my AR300M from the same supplier for the last CPI years and I am planning on a new one from them soon.

greggman3 6y ago

I'm almost never looking for all my devices to be going over VPN. Rather it's generally one one device at a time and even within that I'd often prefer it to be one app at a time. I have run a VM with the VPN only running in the VM but the overhead of the VM itself is not worth it.

lkxijlewlf 6y ago

So, is it easy to set this up using a phone when you get to a hotel, for example? Do you simply select the hotel wifi to use?

heavyset_go 6y ago
I have a similar setup with a travel router running OpenWRT and it is as simple as connecting to the hotel WiFi.
arbitrage 6y ago
No, it is not easy. It is messy, the codebase is showing its age, configuration is a nightmare, and throughput overall is pretty shit with so many layers of unoptimized linux piled ontop of hardware that was never optimized to handle this type of packet generation and mangling.
- SahAssar 6y ago
  > and throughput overall is pretty shit with so many layers of unoptimized linux piled ontop of hardware that was never optimized to handle this type of packet generation and mangling That's a very broad generalization. I use a https://pcengines.ch/ https://pcengines.ch/ based router with openwrt and mullvad as my VPN and performance is very close to non-vpn traffic. Sure, if you run your VPN on bad hardware you might get bad performance but that is not true for everyone.

paulcarroty 6y ago

> I strongly recommend getting an OpenWRT capable router and setting up your VPN there Double it, OpenWRT functionality beats any production router firmware. Bought Linksys some time ago, now searching a cable to flash OpenWRT on it 'cause original firmware feels crazy dumb.

coffeemaniac 6y ago

how would this compare to something like a Protectli?

armandhammer 6y ago

It's better to go with something like a $150 Intel NUC running pfsense (free) to connect to the VPN because the vast majority of Wi-Fi routers don't have enough CPU to decipher 256bit AES encryption in real-time. Once you fire up the VPN on even a top-tier router, you're likely to see your overall connection speed drop to 15 mbit/sec or less. A cheap NUC has no problem doing 256bit AES at 200+ mbit/sec.

touristtam 6y ago

how do you do that for a multiple VPN setup (for work obviously) and that would need to route the connection to different devices, while working only during office hours and take into account the usual MFA crap?