4 ms·

How do you connect back to your home from the outside? - your ISP IP change all the time - You need to open port - You need to forward port to something else

by Thaxll 4y ago

How do you connect back to your home from the outside? - your ISP IP change all the time - You need to open port - You need to forward port to something else where the IP does not change ( wireguard server) - You need to setup wireguard - You need to manage auth / authz Lot of things can go wrong and it's a lot of things to setup / maintain properly.

wmf 4y ago
Stop introducing facts; you're killing the outrage.
Arnavion 4y ago
>How do you connect back to your home from the outside? >- your ISP IP change all the time I have a static v6 IP on the WG server (home router, running OPNsense). Even if I did have a changing IP, I have a programmable DNS server that points to the WG server's IP. >- You need to open port One time setup on the server. >- You need to setup wireguard Installed just like any other distro package, plus one-time setup to generate the key and import it and the server's public key into systemd-networkd / NetworkManager. >- You need to manage auth / authz You generate a key on each device and register the public key with the server. There's literally nothing else to it. >Lot of things can go wrong and it's a lot of things to setup / maintain properly. I set it up about two years ago and it's been working unchanged since.
- yardstick 4y ago
  > Even if I did have a changing IP, I have a programmable DNS server that points to the WG server's IP. I believe that WG resolves the domain only once, upon config load. Not much help if the server IP changes after starting the WG client. Up to the user to realise and stop/start- not so convenient for eg embedded WG clients in travel routers
  - greyface- 4y ago
    If the client is online when the server changes IPs, WireGuard's built-in roaming will handle it transparently: https://www.wireguard.com/#built-in-roaming https://www.wireguard.com/#built-in-roaming
    - tssva 4y ago
      If the client is still at the same address it was last time it contacted the server and the server sends data to the client it will be transparently handled. This means that persistent keepalives should be used on both sides. It also still leaves open the possibility of the connection being lost if IP addresses on both sides change during the period between the keepalives or if there is any kind of network disruption preventing traffic from the server to the client during the period the server IP address changes. I had this become an issue for me a few times when I ran a wireguard server at home.
    - zaarn 4y ago
      This won't work if the server is being blocked. My mobile ISP blocks incoming UDP traffic unless the phone establishes the "connection" first. Since change of the server's public IP means that "connection" is broken, all unrelated UDP packets never arrive. Wireguard does not handle this transparently.
  - Arnavion 4y ago
    The NetworkManager WG integration re-resolves. systemd-networkd doesn't, though it has an open PR for it, though that PR has been stalled for a long time.
- zaarn 4y ago
  >I have a static v6 IP on the WG server (home router, running OPNsense). Excuse my snark, but not everyone has a static v6 IP. I don't. >One time setup on the server Unless you happen to be behind a CGNAT or you're on a mobile network or or or or... >Installed just like any other distro package, plus one-time setup to generate the key and import it and the server's public key into systemd-networkd / NetworkManager. And if that won't work you're gonna be stuck debugging the network setup. I certainly do always end up debugging the VPN network stack eventually. >You generate a key on each device and register the public key with the server. There's literally nothing else to it. This won't scale to more than like 5 devices without being a major work item if a key was compromised or needs to be rotated (what if it turns out the RNG device was bad on your kernel at the time? Happened to SSH Keys on RPi's). >I set it up about two years ago and it's been working unchanged since. Not everyone is that lucky.
  - Arnavion 4y ago
    >Excuse my snark, but not everyone has a static v6 IP. I don't. My ISP doesn't have it either. (They've been promising it for 2 years but keep delaying working on it.) I have an HE tunnel. Also you ignored the sentence after that, which I had written to hopefully preempt this response. >Unless you happen to be behind a CGNAT or you're on a mobile network or or or or... Your server needs to have a globally reachable IP, yes. >This won't scale to more than like 5 devices without being a major work item if a key was compromised or needs to be rotated (what if it turns out the RNG device was bad on your kernel at the time? Happened to SSH Keys on RPi's). Depends on which key, of course. If a device's key needs to be rotated, you only touch that device and the server. If you rotate the server's key, then yes you touch every device. >And if that won't work you're gonna be stuck debugging the network setup. >if a key was compromised or needs to be rotated >Not everyone is that lucky. Sure. I know these things that happen never or rarely (currently, never), so I'm okay with doing them manually when they happen instead of outsourcing. I don't make decisions for other people or claim that what I do is best for other people. You should make decisions for yourself by evaluating the pros and cons for yourself.
    - zaarn 4y ago
- tatersolid 4y ago
  A VPN solution for your home network is a very different thing than what is needed for any 50+ employee org. Bare wireguard is pretty useless in a business environment; this is why Tailscale is growing so fast.
drexlspivey 4y ago
You use a $5 VPS as the server, both home and phone are connected to it.
- mjg59 4y ago
  Why do you think the sort of provider that offers $5 VPSes is more trustworthy than Tailscale?
  - megous 4y ago
    Why would VPS provider need to be trustworthy at all? They just need to be reliable. Having VPN doesn't absolve you from securing hosts within it, like you would in any other network. VPN just simplifies the networking. And if they're not reliable, VPS providers are much easier to switch than "Tailscale".
    - mjg59 4y ago
      If the VPS provider doesn't need to be trustworthy, why does Tailscale?
      - megous 4y ago
        I was not claiming Tailscale has to be trustworthy. Though, thinking about it, it's a privileged software running on every node in the virtual network, that is controllable from outside (cloud). So yeah, it needs to be way more trustworthy than some static wireguard setup you setup on a VPS.
  - drexlspivey 4y ago
    What scenario are you imagining where your vpn is compromised through Hetzner or Digital Ocean for example? This is a standalone server set up just for you, not sure how tailscale works but does it spin up a segregated server for each customer without a single point of failure?
fps_doug 4y ago
I use a dyndns provider and SSH. Setup took maybe 15 minutes total.

by Thaxll 4y ago

wmf 4y ago

Stop introducing facts; you're killing the outrage.

Arnavion 4y ago

>How do you connect back to your home from the outside? >- your ISP IP change all the time I have a static v6 IP on the WG server (home router, running OPNsense). Even if I did have a changing IP, I have a programmable DNS server that points to the WG server's IP. >- You need to open port One time setup on the server. >- You need to setup wireguard Installed just like any other distro package, plus one-time setup to generate the key and import it and the server's public key into systemd-networkd / NetworkManager. >- You need to manage auth / authz You generate a key on each device and register the public key with the server. There's literally nothing else to it. >Lot of things can go wrong and it's a lot of things to setup / maintain properly. I set it up about two years ago and it's been working unchanged since.

yardstick 4y ago
> Even if I did have a changing IP, I have a programmable DNS server that points to the WG server's IP. I believe that WG resolves the domain only once, upon config load. Not much help if the server IP changes after starting the WG client. Up to the user to realise and stop/start- not so convenient for eg embedded WG clients in travel routers
- greyface- 4y ago
  If the client is online when the server changes IPs, WireGuard's built-in roaming will handle it transparently: https://www.wireguard.com/#built-in-roaming https://www.wireguard.com/#built-in-roaming
  - tssva 4y ago
    If the client is still at the same address it was last time it contacted the server and the server sends data to the client it will be transparently handled. This means that persistent keepalives should be used on both sides. It also still leaves open the possibility of the connection being lost if IP addresses on both sides change during the period between the keepalives or if there is any kind of network disruption preventing traffic from the server to the client during the period the server IP address changes. I had this become an issue for me a few times when I ran a wireguard server at home.
  - zaarn 4y ago
    This won't work if the server is being blocked. My mobile ISP blocks incoming UDP traffic unless the phone establishes the "connection" first. Since change of the server's public IP means that "connection" is broken, all unrelated UDP packets never arrive. Wireguard does not handle this transparently.
- Arnavion 4y ago
  The NetworkManager WG integration re-resolves. systemd-networkd doesn't, though it has an open PR for it, though that PR has been stalled for a long time.
zaarn 4y ago
>I have a static v6 IP on the WG server (home router, running OPNsense). Excuse my snark, but not everyone has a static v6 IP. I don't. >One time setup on the server Unless you happen to be behind a CGNAT or you're on a mobile network or or or or... >Installed just like any other distro package, plus one-time setup to generate the key and import it and the server's public key into systemd-networkd / NetworkManager. And if that won't work you're gonna be stuck debugging the network setup. I certainly do always end up debugging the VPN network stack eventually. >You generate a key on each device and register the public key with the server. There's literally nothing else to it. This won't scale to more than like 5 devices without being a major work item if a key was compromised or needs to be rotated (what if it turns out the RNG device was bad on your kernel at the time? Happened to SSH Keys on RPi's). >I set it up about two years ago and it's been working unchanged since. Not everyone is that lucky.
- Arnavion 4y ago
  >Excuse my snark, but not everyone has a static v6 IP. I don't. My ISP doesn't have it either. (They've been promising it for 2 years but keep delaying working on it.) I have an HE tunnel. Also you ignored the sentence after that, which I had written to hopefully preempt this response. >Unless you happen to be behind a CGNAT or you're on a mobile network or or or or... Your server needs to have a globally reachable IP, yes. >This won't scale to more than like 5 devices without being a major work item if a key was compromised or needs to be rotated (what if it turns out the RNG device was bad on your kernel at the time? Happened to SSH Keys on RPi's). Depends on which key, of course. If a device's key needs to be rotated, you only touch that device and the server. If you rotate the server's key, then yes you touch every device. >And if that won't work you're gonna be stuck debugging the network setup. >if a key was compromised or needs to be rotated >Not everyone is that lucky. Sure. I know these things that happen never or rarely (currently, never), so I'm okay with doing them manually when they happen instead of outsourcing. I don't make decisions for other people or claim that what I do is best for other people. You should make decisions for yourself by evaluating the pros and cons for yourself.
  - zaarn 4y ago
tatersolid 4y ago
A VPN solution for your home network is a very different thing than what is needed for any 50+ employee org. Bare wireguard is pretty useless in a business environment; this is why Tailscale is growing so fast.

drexlspivey 4y ago

You use a $5 VPS as the server, both home and phone are connected to it.

mjg59 4y ago
Why do you think the sort of provider that offers $5 VPSes is more trustworthy than Tailscale?
- megous 4y ago
  Why would VPS provider need to be trustworthy at all? They just need to be reliable. Having VPN doesn't absolve you from securing hosts within it, like you would in any other network. VPN just simplifies the networking. And if they're not reliable, VPS providers are much easier to switch than "Tailscale".
  - mjg59 4y ago
    If the VPS provider doesn't need to be trustworthy, why does Tailscale?
    - megous 4y ago
      I was not claiming Tailscale has to be trustworthy. Though, thinking about it, it's a privileged software running on every node in the virtual network, that is controllable from outside (cloud). So yeah, it needs to be way more trustworthy than some static wireguard setup you setup on a VPS.
- drexlspivey 4y ago
  What scenario are you imagining where your vpn is compromised through Hetzner or Digital Ocean for example? This is a standalone server set up just for you, not sure how tailscale works but does it spin up a segregated server for each customer without a single point of failure?

fps_doug 4y ago

I use a dyndns provider and SSH. Setup took maybe 15 minutes total.