6 ms·
Ask HN: What do you use for your cloud VPN?
I have a couple of servers running in digital ocean with some docker web applications on them. I want to block access to these web services from the public internet but allow them from the VPC network. The only out of the box solutions I see for digitalocean are proprietary apps like OpenVPN. WireGuard is a good alternative but requires a surprisingly high amount of configuration, and all the third party UIs are barely maintained.
I can’t believe this isn’t a solved problem so very curious what people are using to access VPCs. Preferably open source.
- cpach 6y agoTailscale might be an alternative https://tailscale.com/ https://tailscale.com/
- oliverjudge 6y agoThanks for the heads up on this, just switched over from a manual Wireguard install.
- cpach 6y agoCool!
- camjohnson26 6y agoLooks cool, and $10 a user a month is a lot better than OpenVPN access server which I believe is around $50 a month for more than 2 clients.
- dcminter 6y agoI thought OpenVPN was free, and cursory searching suggests that the "Community Edition" version is indeed GPL. Are there features you need from the non-CE version?
- camjohnson26 6y agoAll the docker images I’ve found are for openvpn-as, just want to keep configuration as simple as possible for security
- camjohnson26 6y agoAlso thought it was free but the digital ocean app and the docker image both request a $700 a year license for more than 2 clients.
- lmarcos 6y ago> I can’t believe this isn’t a solved problem so very curious what people are using to access VPCs. I'm actually facing the same scenario, but I thought that a bastion ssh server between the VPC and the internet was enough. I'm totally new to these things, so could someone tell me the differences between a VPN and a VPC+bastion server?
- camjohnson26 6y agoPretty sure a bastion server will work for ssh but not for web services
- lmarcos 6y agoWhat about an LB sitting between the VPC and the internet?
- camjohnson26 6y agoCould work but I’d rather have it behind a firewall, stuff like Vault and Grafana
- AkshayPrabhu 6y agoHave you considered AlgoVPN [0], I've not used it personally but heard positive reviews from those who have. They claim to be "set of Ansible scripts that simplify the setup of a personal WireGuard". [0] - https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- camjohnson26 6y agoHmm didn’t know Algo used WireGuard under the hood. That’s cool but there’s no UI for adding clients, so I would still have to ssh into the server to download certificates and there’s a lot of commands to run, so at that point might as well just install wireguard manually. Wish they had a docker image and bundled something like WireGuard-access-server.
- cutthegrass2 6y ago+1 for Algo. I run this on an inexpensive AWS Lightsail instance. Trivial to move it between regions also.
- atmosx 6y ago> I have a couple of servers running in digital ocean with some docker web applications on them. I want to block access to these web services from the public internet but allow them from the VPC network. What you need is a private network[1]. A private VPC will allow instances to communicate with each other, but to access them from the outside a "bastion host" is required. If you install a VPN in the bastion house and add the appropriate routes and settings, you'll be able to connect to your instances internally. This is the "proper" way to create a "private" network. You could achieve the same thing using Cloud Firewall[2]. The cloud firewall supports droplet as a "source" definition. UPDATE: You can create a private network using a shared VPN but it is an overkill if instances are on the same data centre. [1]: https://www.digitalocean.com/docs/networking/vpc/#features https://www.digitalocean.com/docs/networking/vpc/#features [2]: https://www.digitalocean.com/docs/networking/firewalls/#features https://www.digitalocean.com/docs/networking/firewalls/#feat...
- camjohnson26 6y agoThis is actually what I’m trying to do, just surprised that this step: “install a VPN in the bastion house and add the appropriate routes and settings” is taking a lot more manual configuration than I expected, was hoping for some out of the box solution in case I mess up a routing rule or network configuration. WireGuard is pretty good but still requires messing with iptables to forward the VPN traffic onto the VPC
- atmosx 6y agoI did not get that, sorry. I would opt for routing instead of NATing if possible.
- quantumofalpha 6y ago> WireGuard is a good alternative but requires a surprisingly high amount of configuration Not really. It has a bit of a learning curve, but once you get past it it's actually a total joy to use. But if you want something even simpler, I could suggest https://github.com/jedisct1/dsvpn https://github.com/jedisct1/dsvpn
- kyawzazaw 6y agoOpenVPN + PiHole on DigitalOcean
- 8b16380d 6y agoWire guard on mullvad. They have OpenVPN support as well.
- tehskylark 6y agoZeroTier is another option worth looking at for your use case. https://www.zerotier.com/ https://www.zerotier.com/