8 ms·

Set up your own VPN at home with Raspberry Pi – Wolfang's Blog

150 points by tambourine_man 5y ago

deltafile 5y ago
tbronchain 5y ago
Had something like this running before, with an extra tunnel to a VPS, so when I was connecting to this VPS on a specific port, it was eventually connecting to my home VPN - useful with dynamic IPs. I can't remember the tool I used for the tunnel. SSH was quite slow and I remember using something else at the TCP level. Any idea? Bonus for any solution that works with UDP.
- rschachte 5y ago
  Just run OpenVPN through UDP. It’s supported natively and I get fast speeds. You can use DynDNS or Pihole to avoid needing a static IP
Vladimof 5y ago
that's what I did: https://www.pivpn.io/ https://www.pivpn.io/ (wireguard)
digitallyfree 5y ago
Keep in mind that in the last couple years I've seen a lot of public Wifi (e.g. coffee shop, business guest network) blocking common dynamic dns domains like those from Afraid, Duckdns, etc. They also block most UDP and TCP ports unrelated to web browsing. The only VPN connection I've seen that works everywhere is one on TCP 443, with a domain name that you control. Maybe have a UDP VPN instance on another port for performance but always have the TCP 443 instance avaliable as backup so you won't get blocked out. Personally I use OpenVPN on TCP 443 and have never had issues.
- Gigachad 5y ago
  Do any OSs support DoH yet? Would solve that issue since cafe wifi wouldn’t be able to block individual domains.
  - hansel_der 5y ago
    for a chad in a cafe, maybe solved. but then again you could just connect to the address directly and forgoe doh. dns blocking is mostly not a prohibiting factor, just an annoyance.
- Nextgrid 5y ago
  Note that running VPNs over TCP has significant performance concerns (as you'd be running TCP within TCP) so it should only be used as a last-resort.
  - digitallyfree 5y ago
    That's why you can run a second UDP instance on another port if you need that performance, and have the TCP one available as a fallback if that is blocked. Though to be honest the performance loss really depends on what you're doing on the VPN - if you need a low latency high bandwidth services, then UDP is the way to go. If you just use it for SSH, VDI, browsing, and file transfer I find the performance loss acceptable.
    - Nextgrid 5y ago
      It really depends on packet loss. If you’re on a reliable connection with constant latency & bandwidth, TCP-in-TCP isn’t that bad. However when you have high-packet-loss connections it becomes absolutely terrible.
- joshbaptiste 5y ago
  If for some reason my Tailscale instance doesn't work at a cafe, last resort is a public cheap VPS where I have sshd listening on port 443 .. to ssh -D localhost:8888 VPS .. and then socks proxy my browser over localhost:8888
elzbardico 5y ago
Nowadays things like Tailscale are far more practical
- djbeadle 5y ago
  I have spent lots of time fiddling with OpenVPN and Wireguard configurations. On a whim I tried out Tailscale and literally within 10 minutes I was up and running, it totally blew my mind. Not a paid shill and I don't even use it that much but when I do I can count on it to work (which is a level of faith I never had in my own OpenVPN configs).
  - aborsy 5y ago
    OpenVPN installer: https://github.com/angristan/openvpn-install https://github.com/angristan/openvpn-install Install, and ready to connect! There is a Wireguard version too, but I haven’t tested it, since 443 is all I have at work. Wireguard is preferred if you have an unfiltered UDP port.
- fgblanch 5y ago
  TailScale and its exit nodes make this blog post a tweet. Install OS > Install TailScale > set as exit node > You are done.
- ptidhomme 5y ago
  As a side note, Tailscale does not use the kernel implementation of Wireguard. Worth considering if you plan to replace your hand configured setup.
- deleted 5y ago
  [deleted]
- euroderf 5y ago
  Seconded. Tailscale installs in a snap and Hey, presto! runs great.
ce4 5y ago
Can the title be corrected to either include the missing g in "Wolfgang's Blog" or just remove those two words? Wolfgang is a german name.
throwaway894345 5y ago
At this point the bigger challenge is getting your hands on a Pi without paying an enormous markup.
password4321 5y ago
Good luck getting a Raspberry Pi these days! https://rpilocator.com https://rpilocator.com, specifically https://twitter.com/rpilocator https://twitter.com/rpilocator https://news.ycombinator.com/item?id=31212413 https://news.ycombinator.com/item?id=31212413 (4 days ago)
- Grimburger 5y ago
  Pi's were overpriced even before they became rare. I'm a fan of odroid's if you want better value.
  - schleck8 5y ago
    Aren't they pricey too though? Last time I checked they went for a similar price at half the memory
  - rschachte 5y ago
    I bought my pi for $5 and it runs a fully functional VPN, DNS server and as blocker on my network. Can run some custom code on there to handle DHCP leases, etc. Chip shortage made things tough but they’re still cheap when you can find one
    - KronisLV 5y ago
      > I bought my pi for $5... How? The licensed reseller that is linked on their homepage has prices starting at 43 dollars: https://www.cytron.io/c-raspberry-pi-4 https://www.cytron.io/c-raspberry-pi-4 Here in Latvia new Pi boards go for around 80-120 euros from what i can tell: https://www.salidzini.lv/cena?q=raspberry+pi+model+b&offset=90 https://www.salidzini.lv/cena?q=raspberry+pi+model+b&offset=... (this is a comparison site, on a page where actual Pi board start, not accessories) Seems like you got a pretty sweet deal, if it would cost me around 16 times more.
      - raptor99 5y ago
        He is more than likely talking about a Pi Zero or even a Pi Zero W (built in wifi). I have bought both before for $5 each also.
650REDHAIR 5y ago
If anyone in the Bay Area wants to sell me a Pi…I gave away all of mine before things got crazy not realizing they were impossible to find!
- GoOnThenDoTell 5y ago
  Whats the going rate for this sort of thing? Some of mine have very low-value uses
  - 650REDHAIR 5y ago
    I’ve seen zero w go for like $50 which is just crazy. The new, higher ram models are more than used optiplex with i5s. I don’t really understand who is paying $50 for a Zero or why.
Nursie 5y ago
Other than the initial writing of the OS to the SD card, is there anything Pi specific about this? It's been a gripe of mine for quite a while that there's now this whole subset of generic linux howtos which are titled "on the Raspberry Pi" for no particular reason. In the end the exact hardware isn't really that relevant to solving the problem.
- stevekemp 5y ago
  It used to be a big thing for SEO/spammers to republish their guides anew every time there was a newly released Linux distribution. You could see this in titles like: * How to install mysql on Dapper Drake * How to install mysql on Edgy Eft * etc. I guess a similar thing here, people will search for Pi-device guides because they've learned such things exist.
  - westernpopular 5y ago
    Same as with tagging on "in $currentyear" at the end of everything
tb131 5y ago
I don't like how the setup procedure for the WireGuard part is simply "Download this script from the internet and run it with sudo". Sounds not very secure and prone to breaking etc.
- input_sh 5y ago
  It's using some sort of a custom installer that also downloads Cloudflare's BoringTun (https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun) directly from the author's website (nyr[.]be), since Cloudflare doesn't seem to offer it as a binary release. Example: { wget -qO- https://wg.nyr[.]be/1/latest/download 2>/dev/null || curl -sL https://wg.nyr.be/1/latest/download ; } | tar xz -C /usr/local/sbin/ --wildcards 'boringtun-*/boringtun' --strip-components 1 I don't have time to go through it in more details, but I would definitely recommend an alternative way of installing it.
rraghur 5y ago
I cry behind my ISP that runs cgnat I get around it with a cheap box on the cloud.. but it kills bandwidth and is brittle
- Zizizizz 5y ago
  I have CGNat and I can reach my pi from anywhere through wireguard (using Tailscale). Still can't host anything externally visible though (as you know)
  - joshbaptiste 5y ago
    You can host your internal services using cloudflare tunnels.. https://www.sakowi.cz/blog/cloudflared-docker-compose-tutorial https://www.sakowi.cz/blog/cloudflared-docker-compose-tutori...
folli 5y ago
Alternatively, I like the option of creating a SOCKS proxy for this purpose, it's actually quite easy: https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-filters/ https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-fil...
Havoc 5y ago
The latest rasp is no longer has a default pi user. Also if your home net has same subnet as the Public wifi you’re on say 192.168.1.1 some stuff on local IPs won’t work
gchadwick 5y ago
As a VPN alternative I recently setup cloudflare tunnel https://www.cloudflare.com/en-gb/products/tunnel/ https://www.cloudflare.com/en-gb/products/tunnel/. Rather than connecting to your local network directly you run a Daemon that connects a machine on the local network to cloudflare. You then connect to cloudflare and it routes the traffic to your local network. Very easy to setup and use, tunnel itself is free if you don't need many users. You do need a domain but not a massive cost. Plus no security worries about having an open port visible to the global internet plus no need to worry about the IP for your home network, dynamic DNS CGNat etc. You can run the Daemon on a raspberry pi (personally I'm using the docker container on a Synology NAS)
bertman 5y ago
The author uses a Fritz!Box router, which is a very popular device in Germany. Note that AVM, the company behind the routers, is working on providing Wireguard natively on their newer routers (no hardware-assisted encryption, though): https://en.avm.de/fritz-lab/fresh-from-development/updates-improvements/wireguard-support-for-simple-setup-of-vpn-connections/ https://en.avm.de/fritz-lab/fresh-from-development/updates-i...
- sofixa 5y ago
  It's telling that none of their devices support fiber...
  - mfontani 5y ago
    To be fair most fibre providers supply their own ONT which you then put in cascade with your router.
  - nebalee 5y ago
    They do: https://avm.de/produkte/fritzbox/fritzbox-5530-fiber/ https://avm.de/produkte/fritzbox/fritzbox-5530-fiber/ https://avm.de/produkte/fritzbox/fritzbox-5590-fiber/ https://avm.de/produkte/fritzbox/fritzbox-5590-fiber/
  - MarkCole 5y ago
    They do have a fiber model[0]. However as someone else mentioned most ISPs provide a modem with Fiber, and you put your router behind it. [0] https://en.avm.de/products/fritzbox/fritzbox-5530-fiber/ https://en.avm.de/products/fritzbox/fritzbox-5530-fiber/
bjord 5y ago
or, let https://pivpn.io https://pivpn.io handle all of that, automatically
spiderfarmer 5y ago
I used https://pivpn.io https://pivpn.io and that was very convenient.
- f311a 5y ago
  Yep. It's very easy to install. I run it on a non-rpi device as well.
aequitas 5y ago
Or just buy a Mikrotik device, something like a HAP lite[0] can be had for much less than a Raspberry Pi + SDcard nowadays. With RouterOS 7 it supports Wireguard and Zerotier out of the box, and you can still even setup OpenVPN or L2TP/IPsec if that's your thing. With any luck you can even replace your ISP router completely and have much better control over your firewall and home network settings. I'm just waiting for container/Docker support to be rolled out again so I can delegate some other tasks that currently run on Raspi's (like MQTT, metrics buffering, IoT, etc). [0] https://mikrotik.com/product/RB941-2nD https://mikrotik.com/product/RB941-2nD
- someotherperson 5y ago
  It appears that the HAP Lite uses a MIPS-based architecture, how quickly do VPNs run on it? When I was working on routers about a decade ago that was a major pain point, it would essentially limit OpenVPN connections to about 6 or 7mbps with a maxed out CPU running at a similar clock speed.
  - evook 5y ago
    Zerotier maxes out based on the model since it's single core. On a ac3 around 20Mbps is the cap. With wireguard I max out at 300Mbps. I can't test openvpn since mikrotik doesn't support tls auth. IPsec was always my given linespeed. Beware that you need fasttrack exclusion rules (via connection mark e.g.) for each vpn interface except zerotier.
    - someotherperson 5y ago
      300Mbps on Wireguard is incredible. Thank you for informing me.
mmcgaha 5y ago
For home I get the most bang for the buck (buck is my time here) by just setting up ssh and dynamic DNS. I port forward if I have to but mostly use socks5 to proxy in.
webmobdev 5y ago
A much simpler solution is to buy the GL.iNet GL-SF1200 (https://www.gl-inet.com/products/gl-sf1200/ https://www.gl-inet.com/products/gl-sf1200/ - costs only $30) which is powered by the opensource OpenWRT router OS and offers VPN support (both as client or server) with built-in OpenVPN or Wireguard. Other costlier GL.Inet routers with more CPU power and more RAM are also available.

Had something like this running before, with an extra tunnel to a VPS, so when I was connecting to this VPS on a specific port, it was eventually connecting to my home VPN - useful with dynamic IPs. I can't remember the tool I used for the tunnel. SSH was quite slow and I remember using something else at the TCP level. Any idea? Bonus for any solution that works with UDP.

rschachte 5y ago
Just run OpenVPN through UDP. It’s supported natively and I get fast speeds. You can use DynDNS or Pihole to avoid needing a static IP

Vladimof 5y ago

that's what I did: https://www.pivpn.io/ https://www.pivpn.io/ (wireguard)

digitallyfree 5y ago

Keep in mind that in the last couple years I've seen a lot of public Wifi (e.g. coffee shop, business guest network) blocking common dynamic dns domains like those from Afraid, Duckdns, etc. They also block most UDP and TCP ports unrelated to web browsing. The only VPN connection I've seen that works everywhere is one on TCP 443, with a domain name that you control. Maybe have a UDP VPN instance on another port for performance but always have the TCP 443 instance avaliable as backup so you won't get blocked out. Personally I use OpenVPN on TCP 443 and have never had issues.

Gigachad 5y ago
Do any OSs support DoH yet? Would solve that issue since cafe wifi wouldn’t be able to block individual domains.
- hansel_der 5y ago
  for a chad in a cafe, maybe solved. but then again you could just connect to the address directly and forgoe doh. dns blocking is mostly not a prohibiting factor, just an annoyance.
Nextgrid 5y ago
Note that running VPNs over TCP has significant performance concerns (as you'd be running TCP within TCP) so it should only be used as a last-resort.
- digitallyfree 5y ago
  That's why you can run a second UDP instance on another port if you need that performance, and have the TCP one available as a fallback if that is blocked. Though to be honest the performance loss really depends on what you're doing on the VPN - if you need a low latency high bandwidth services, then UDP is the way to go. If you just use it for SSH, VDI, browsing, and file transfer I find the performance loss acceptable.
  - Nextgrid 5y ago
    It really depends on packet loss. If you’re on a reliable connection with constant latency & bandwidth, TCP-in-TCP isn’t that bad. However when you have high-packet-loss connections it becomes absolutely terrible.
joshbaptiste 5y ago
If for some reason my Tailscale instance doesn't work at a cafe, last resort is a public cheap VPS where I have sshd listening on port 443 .. to ssh -D localhost:8888 VPS .. and then socks proxy my browser over localhost:8888

elzbardico 5y ago

Nowadays things like Tailscale are far more practical

djbeadle 5y ago
I have spent lots of time fiddling with OpenVPN and Wireguard configurations. On a whim I tried out Tailscale and literally within 10 minutes I was up and running, it totally blew my mind. Not a paid shill and I don't even use it that much but when I do I can count on it to work (which is a level of faith I never had in my own OpenVPN configs).
- aborsy 5y ago
  OpenVPN installer: https://github.com/angristan/openvpn-install https://github.com/angristan/openvpn-install Install, and ready to connect! There is a Wireguard version too, but I haven’t tested it, since 443 is all I have at work. Wireguard is preferred if you have an unfiltered UDP port.
fgblanch 5y ago
TailScale and its exit nodes make this blog post a tweet. Install OS > Install TailScale > set as exit node > You are done.
ptidhomme 5y ago
As a side note, Tailscale does not use the kernel implementation of Wireguard. Worth considering if you plan to replace your hand configured setup.
deleted 5y ago
[deleted]
euroderf 5y ago
Seconded. Tailscale installs in a snap and Hey, presto! runs great.

ce4 5y ago

Can the title be corrected to either include the missing g in "Wolfgang's Blog" or just remove those two words? Wolfgang is a german name.

throwaway894345 5y ago

At this point the bigger challenge is getting your hands on a Pi without paying an enormous markup.

password4321 5y ago

Good luck getting a Raspberry Pi these days! https://rpilocator.com https://rpilocator.com, specifically https://twitter.com/rpilocator https://twitter.com/rpilocator https://news.ycombinator.com/item?id=31212413 https://news.ycombinator.com/item?id=31212413 (4 days ago)

Grimburger 5y ago
Pi's were overpriced even before they became rare. I'm a fan of odroid's if you want better value.
- schleck8 5y ago
  Aren't they pricey too though? Last time I checked they went for a similar price at half the memory
- rschachte 5y ago
  I bought my pi for $5 and it runs a fully functional VPN, DNS server and as blocker on my network. Can run some custom code on there to handle DHCP leases, etc. Chip shortage made things tough but they’re still cheap when you can find one
  - KronisLV 5y ago
    > I bought my pi for $5... How? The licensed reseller that is linked on their homepage has prices starting at 43 dollars: https://www.cytron.io/c-raspberry-pi-4 https://www.cytron.io/c-raspberry-pi-4 Here in Latvia new Pi boards go for around 80-120 euros from what i can tell: https://www.salidzini.lv/cena?q=raspberry+pi+model+b&offset=90 https://www.salidzini.lv/cena?q=raspberry+pi+model+b&offset=... (this is a comparison site, on a page where actual Pi board start, not accessories) Seems like you got a pretty sweet deal, if it would cost me around 16 times more.
    - raptor99 5y ago
      He is more than likely talking about a Pi Zero or even a Pi Zero W (built in wifi). I have bought both before for $5 each also.

650REDHAIR 5y ago

If anyone in the Bay Area wants to sell me a Pi…I gave away all of mine before things got crazy not realizing they were impossible to find!

GoOnThenDoTell 5y ago
Whats the going rate for this sort of thing? Some of mine have very low-value uses
- 650REDHAIR 5y ago
  I’ve seen zero w go for like $50 which is just crazy. The new, higher ram models are more than used optiplex with i5s. I don’t really understand who is paying $50 for a Zero or why.

Nursie 5y ago

Other than the initial writing of the OS to the SD card, is there anything Pi specific about this? It's been a gripe of mine for quite a while that there's now this whole subset of generic linux howtos which are titled "on the Raspberry Pi" for no particular reason. In the end the exact hardware isn't really that relevant to solving the problem.

stevekemp 5y ago
It used to be a big thing for SEO/spammers to republish their guides anew every time there was a newly released Linux distribution. You could see this in titles like: * How to install mysql on Dapper Drake * How to install mysql on Edgy Eft * etc. I guess a similar thing here, people will search for Pi-device guides because they've learned such things exist.
- westernpopular 5y ago
  Same as with tagging on "in $currentyear" at the end of everything

tb131 5y ago

I don't like how the setup procedure for the WireGuard part is simply "Download this script from the internet and run it with sudo". Sounds not very secure and prone to breaking etc.

input_sh 5y ago
It's using some sort of a custom installer that also downloads Cloudflare's BoringTun (https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun) directly from the author's website (nyr[.]be), since Cloudflare doesn't seem to offer it as a binary release. Example: { wget -qO- https://wg.nyr[.]be/1/latest/download 2>/dev/null || curl -sL https://wg.nyr.be/1/latest/download ; } | tar xz -C /usr/local/sbin/ --wildcards 'boringtun-*/boringtun' --strip-components 1 I don't have time to go through it in more details, but I would definitely recommend an alternative way of installing it.

rraghur 5y ago

I cry behind my ISP that runs cgnat I get around it with a cheap box on the cloud.. but it kills bandwidth and is brittle

Zizizizz 5y ago
I have CGNat and I can reach my pi from anywhere through wireguard (using Tailscale). Still can't host anything externally visible though (as you know)
- joshbaptiste 5y ago
  You can host your internal services using cloudflare tunnels.. https://www.sakowi.cz/blog/cloudflared-docker-compose-tutorial https://www.sakowi.cz/blog/cloudflared-docker-compose-tutori...

folli 5y ago

Alternatively, I like the option of creating a SOCKS proxy for this purpose, it's actually quite easy: https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-filters/ https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-fil...

Havoc 5y ago

The latest rasp is no longer has a default pi user. Also if your home net has same subnet as the Public wifi you’re on say 192.168.1.1 some stuff on local IPs won’t work

gchadwick 5y ago

As a VPN alternative I recently setup cloudflare tunnel https://www.cloudflare.com/en-gb/products/tunnel/ https://www.cloudflare.com/en-gb/products/tunnel/. Rather than connecting to your local network directly you run a Daemon that connects a machine on the local network to cloudflare. You then connect to cloudflare and it routes the traffic to your local network. Very easy to setup and use, tunnel itself is free if you don't need many users. You do need a domain but not a massive cost. Plus no security worries about having an open port visible to the global internet plus no need to worry about the IP for your home network, dynamic DNS CGNat etc. You can run the Daemon on a raspberry pi (personally I'm using the docker container on a Synology NAS)

bertman 5y ago

The author uses a Fritz!Box router, which is a very popular device in Germany. Note that AVM, the company behind the routers, is working on providing Wireguard natively on their newer routers (no hardware-assisted encryption, though): https://en.avm.de/fritz-lab/fresh-from-development/updates-improvements/wireguard-support-for-simple-setup-of-vpn-connections/ https://en.avm.de/fritz-lab/fresh-from-development/updates-i...

sofixa 5y ago
It's telling that none of their devices support fiber...
- mfontani 5y ago
  To be fair most fibre providers supply their own ONT which you then put in cascade with your router.
- nebalee 5y ago
  They do: https://avm.de/produkte/fritzbox/fritzbox-5530-fiber/ https://avm.de/produkte/fritzbox/fritzbox-5530-fiber/ https://avm.de/produkte/fritzbox/fritzbox-5590-fiber/ https://avm.de/produkte/fritzbox/fritzbox-5590-fiber/
- MarkCole 5y ago
  They do have a fiber model[0]. However as someone else mentioned most ISPs provide a modem with Fiber, and you put your router behind it. [0] https://en.avm.de/products/fritzbox/fritzbox-5530-fiber/ https://en.avm.de/products/fritzbox/fritzbox-5530-fiber/

bjord 5y ago

or, let https://pivpn.io https://pivpn.io handle all of that, automatically

spiderfarmer 5y ago

I used https://pivpn.io https://pivpn.io and that was very convenient.

f311a 5y ago
Yep. It's very easy to install. I run it on a non-rpi device as well.

aequitas 5y ago

Or just buy a Mikrotik device, something like a HAP lite[0] can be had for much less than a Raspberry Pi + SDcard nowadays. With RouterOS 7 it supports Wireguard and Zerotier out of the box, and you can still even setup OpenVPN or L2TP/IPsec if that's your thing. With any luck you can even replace your ISP router completely and have much better control over your firewall and home network settings. I'm just waiting for container/Docker support to be rolled out again so I can delegate some other tasks that currently run on Raspi's (like MQTT, metrics buffering, IoT, etc). [0] https://mikrotik.com/product/RB941-2nD https://mikrotik.com/product/RB941-2nD

someotherperson 5y ago
It appears that the HAP Lite uses a MIPS-based architecture, how quickly do VPNs run on it? When I was working on routers about a decade ago that was a major pain point, it would essentially limit OpenVPN connections to about 6 or 7mbps with a maxed out CPU running at a similar clock speed.
- evook 5y ago
  Zerotier maxes out based on the model since it's single core. On a ac3 around 20Mbps is the cap. With wireguard I max out at 300Mbps. I can't test openvpn since mikrotik doesn't support tls auth. IPsec was always my given linespeed. Beware that you need fasttrack exclusion rules (via connection mark e.g.) for each vpn interface except zerotier.
  - someotherperson 5y ago
    300Mbps on Wireguard is incredible. Thank you for informing me.

mmcgaha 5y ago

For home I get the most bang for the buck (buck is my time here) by just setting up ssh and dynamic DNS. I port forward if I have to but mostly use socks5 to proxy in.

webmobdev 5y ago

A much simpler solution is to buy the GL.iNet GL-SF1200 (https://www.gl-inet.com/products/gl-sf1200/ https://www.gl-inet.com/products/gl-sf1200/ - costs only $30) which is powered by the opensource OpenWRT router OS and offers VPN support (both as client or server) with built-in OpenVPN or Wireguard. Other costlier GL.Inet routers with more CPU power and more RAM are also available.