5 ms·

I also like that they let you download the raw wireguard config files so that you can connect without having to use their client. You can just plop them onto yo

by simias 4y ago

I also like that they let you download the raw wireguard config files so that you can connect without having to use their client. You can just plop them onto your filesystem and use wg-quick to get going. Since I'm also a ProtonMail user and I considered switching to them for VPN as well but their python client doesn't seem to work correctly on my Arch Linux install and it doesn't give me anything useful to debug it beyond "An unknown error has occured" so I couldn't be bothered to investigate beyond that.

lukvol 4y ago
I think you can also get the raw wireguard config files for ProtonVPN: https://protonvpn.com/support/wireguard-configurations/ https://protonvpn.com/support/wireguard-configurations/
- simias 4y ago
  I did not know that! Thanks a lot. I'll definitely give it another try.
- clairity 4y ago
  i just set it up to try it out (on macOS): created a free config on the proton dashboard, downloaded it, stuck it in the wireguard client, and it worked (without downloading their vpn client app). make sure your firewall isn't blocking the traffic though (something that caught me at first).
citilife 4y ago
Been using protonmail on arch for years, you have to setup the configs a tad more manually and do some editing (I forget now); definitely doable and protonmail lets you download the configs (which work out of the box depending what you use).
banana_giraffe 4y ago
Be aware, at least Nord clearly does something different with their client than with the OpenVPN files they provide ( https://news.ycombinator.com/item?id=21664692 https://news.ycombinator.com/item?id=21664692 ). When I dug into this, I found similar cases with other major VPN providers, but my notes are sufficiently out of date, they shouldn't be trusted anymore. Sometimes the differences are subtle, sometimes they're rather complex like this case. Personally, sketchy stuff like this is why I've moved all of my VPN use to a personal cloud instance running WireGuard.
- rafale 4y ago
  What cloud do you use? A lot of websites will flag any AWS or data center IP as a bot.
  - banana_giraffe 4y ago
    So, I do have two VPN servers running, one on my home connection, and one on AWS, for just the reason you state. That said, I got back from a week long trip a few weeks ago. I kept my AWS tunnel up the entire trip. For the set of websites I visit for personal and work reasons, it was never an issue. I'm sure I could find some website that doesn't work, but for me, it's just not a problem. It's also super useful, since I can whitelist my AWS instance's IP on services that demand such things, and never have to worry about where I am as I move from network to network. I've also reserved the Elastic IP so I can stop/terminate my server when I want without needing to whitelist the IP again when I spin it back up
  - yellowapple 4y ago
    Thankfully I never encountered that as an issue with e.g. Amazon Workspaces.
  - runnerup 4y ago
    I use whatbox.ca as my global/universal VPN. So far I haven’t seen any issues. It works in places where most VPNs are banned or heavily throttled (like Saudi/Abu Dhabi/Qatar, my workplace, AT&T cellular data, etc)
    - charsi 4y ago
      Isn't whatbox.ca mainly aimed at hosting seedboxes? They are accordingly higher priced than a VPN. Whats the rationale for using them as a VPN ?
      - runnerup 4y ago
        1) It’s the only VPN that worked in areas where they work hard to block most VPNs 2) it’s still not very expensive 3) it’s absurdly fast for a “VPN”! Like 400Mbit symmetric. 4) I also use it as a seedbox. Speaking of…does anyone have an invitation a private tracker to replace what.cd because I miss that. Or a no/low compression movie tracker.
iqkznnft 4y ago
I've read some articles online, but I still haven't managed to understand the hype around wireguard. It's lighter than OpenVPN, but has more obscure primitives? Doesn't seem like a great trade off...
- number6 4y ago
  It is also much faster and allows p2p networks
  - iqkznnft 4y ago
    What does "allow p2p networks" mean exactly?
    - dcow 4y ago
      It's not hub and spoke. Any existing network topology can be mirrored essentially 1:1 with wireguard. With hub and spoke VPNs the model constrains your deployment somewhat. Now I'm not saying key distribution with wireguard is easy, that's a different problem. But wireguard is literally like "let's take your existing network interface and give it modern fast impossible to fuck up encryption".
      - iqkznnft 4y ago
        I have no idea what you just said. Can you dumb it down maybe?
        number6 4y ago
        Traditionally you have a server and all clients connect to this server (Hub and spoke). Wireguard can connect clients like you would in your network. You can mesh clients if you like. The hard part is getting the keys to all peers in the network.
- dcow 4y ago
  Wireguard is your plumbing layer. OpenVPN is an entire application stack. Wireguard is super simple because it's low level. If you wanted to compare something (as a user in terms of feature parity, etc.) to OpenVPN a more accurate comparison would probably be nebula or tailscale (private/mesh network management tools that are built atop wireguard). I'm a wireguard fan and it's true that its crypto is much simpler, smaller, and harder to fuck up than OpenVPN but that is really only something that matters to the security hats.

by simias 4y ago

lukvol 4y ago

I think you can also get the raw wireguard config files for ProtonVPN: https://protonvpn.com/support/wireguard-configurations/ https://protonvpn.com/support/wireguard-configurations/

simias 4y ago
I did not know that! Thanks a lot. I'll definitely give it another try.
clairity 4y ago
i just set it up to try it out (on macOS): created a free config on the proton dashboard, downloaded it, stuck it in the wireguard client, and it worked (without downloading their vpn client app). make sure your firewall isn't blocking the traffic though (something that caught me at first).

citilife 4y ago

Been using protonmail on arch for years, you have to setup the configs a tad more manually and do some editing (I forget now); definitely doable and protonmail lets you download the configs (which work out of the box depending what you use).

banana_giraffe 4y ago

Be aware, at least Nord clearly does something different with their client than with the OpenVPN files they provide ( https://news.ycombinator.com/item?id=21664692 https://news.ycombinator.com/item?id=21664692 ). When I dug into this, I found similar cases with other major VPN providers, but my notes are sufficiently out of date, they shouldn't be trusted anymore. Sometimes the differences are subtle, sometimes they're rather complex like this case. Personally, sketchy stuff like this is why I've moved all of my VPN use to a personal cloud instance running WireGuard.

rafale 4y ago
What cloud do you use? A lot of websites will flag any AWS or data center IP as a bot.
- banana_giraffe 4y ago
  So, I do have two VPN servers running, one on my home connection, and one on AWS, for just the reason you state. That said, I got back from a week long trip a few weeks ago. I kept my AWS tunnel up the entire trip. For the set of websites I visit for personal and work reasons, it was never an issue. I'm sure I could find some website that doesn't work, but for me, it's just not a problem. It's also super useful, since I can whitelist my AWS instance's IP on services that demand such things, and never have to worry about where I am as I move from network to network. I've also reserved the Elastic IP so I can stop/terminate my server when I want without needing to whitelist the IP again when I spin it back up
- yellowapple 4y ago
  Thankfully I never encountered that as an issue with e.g. Amazon Workspaces.
- runnerup 4y ago
  I use whatbox.ca as my global/universal VPN. So far I haven’t seen any issues. It works in places where most VPNs are banned or heavily throttled (like Saudi/Abu Dhabi/Qatar, my workplace, AT&T cellular data, etc)
  - charsi 4y ago
    Isn't whatbox.ca mainly aimed at hosting seedboxes? They are accordingly higher priced than a VPN. Whats the rationale for using them as a VPN ?
    - runnerup 4y ago
      1) It’s the only VPN that worked in areas where they work hard to block most VPNs 2) it’s still not very expensive 3) it’s absurdly fast for a “VPN”! Like 400Mbit symmetric. 4) I also use it as a seedbox. Speaking of…does anyone have an invitation a private tracker to replace what.cd because I miss that. Or a no/low compression movie tracker.

iqkznnft 4y ago

I've read some articles online, but I still haven't managed to understand the hype around wireguard. It's lighter than OpenVPN, but has more obscure primitives? Doesn't seem like a great trade off...

number6 4y ago
It is also much faster and allows p2p networks
- iqkznnft 4y ago
  What does "allow p2p networks" mean exactly?
  - dcow 4y ago
    It's not hub and spoke. Any existing network topology can be mirrored essentially 1:1 with wireguard. With hub and spoke VPNs the model constrains your deployment somewhat. Now I'm not saying key distribution with wireguard is easy, that's a different problem. But wireguard is literally like "let's take your existing network interface and give it modern fast impossible to fuck up encryption".
    - iqkznnft 4y ago
      I have no idea what you just said. Can you dumb it down maybe?
      - number6 4y ago
        Traditionally you have a server and all clients connect to this server (Hub and spoke). Wireguard can connect clients like you would in your network. You can mesh clients if you like. The hard part is getting the keys to all peers in the network.
dcow 4y ago
Wireguard is your plumbing layer. OpenVPN is an entire application stack. Wireguard is super simple because it's low level. If you wanted to compare something (as a user in terms of feature parity, etc.) to OpenVPN a more accurate comparison would probably be nebula or tailscale (private/mesh network management tools that are built atop wireguard). I'm a wireguard fan and it's true that its crypto is much simpler, smaller, and harder to fuck up than OpenVPN but that is really only something that matters to the security hats.