11 ms·

Build your own private WireGuard VPN with PiVPN

552 points by ingve 4y ago

megous 4y ago
> Note: Security is a major concern here—don't set up a VPN if you don't know what you're doing. If someone gets access through the VPN to your home network, they can (and will) hack into your house! While possible, many people already give access to their home networks via multi-homed devices they carry in their pockets everywhere they go. Relying on anything below the application layer for security is not very good these days.
cellu 4y ago
Anyone found a way to to split tunnelling on MacOS?
pwpw 4y ago
I set all of this up about 3 weeks ago. Wish I had come across this guide then! It's a great solution that has made my dev work and media consumption so much easier on the go. One thing that tripped me up on arch linux with KDE Plasma was that importing the downloaded WireGuard configuration didn't work in NetworkManager using the gui. After a bit of tinkering, I finally discovered that you can download the conf file to your computer and then run the following command: nmcli connection import type wireguard file [CONF_FILE] That adds it to NetworkManager, making it easy to connect to from the gui.
kdot 4y ago
Would a solution that uses IKEv2.
blutack 4y ago
If your router supports OpenWRT that's a good alternative that doesn't require any additional boxes/boards and is simpler to set up networking-wise. There's a nice UI that generates the QR codes or config files ready for import into client devices. 1: https://openwrt.org/docs/guide-user/services/vpn/wireguard/basics https://openwrt.org/docs/guide-user/services/vpn/wireguard/b...
- alpenbazi 4y ago
  OpenWRT on a BananaPI R2 with WG wirks like a charm for ~ 2 years now
- flas9sd 4y ago
  yes the webui now has some convenience options for generating and importing configs, but there's still a gap (as in default package installed) in client profile management or network management on cli. What pivpn (and similar tooling wrapping lower level commands) bring along is this client management and even some network topology/routing management : https://docs.pivpn.io/wireguard/ https://docs.pivpn.io/wireguard/ and https://github.com/pivpn/pivpn/tree/master/scripts/wireguard https://github.com/pivpn/pivpn/tree/master/scripts/wireguard I think it's a interesting spectrum between wg-cli and tailscale.
kgersen 4y ago
I moved to Tailscale, until I find something simpler, I'm not moving back.
- lostlogin 4y ago
  Why would that even look like? When I set it up it promised a 10 minute install time. For me a fair portion of that 10 minutes was trying to work out if it was working as my line speed was higher than I thought possible. It’s scary how quick it is to configure.
  - SparkyMcUnicorn 4y ago
    Just install tailscale on something in your home network, and start it up advertising as an exit node. On your laptop, select the exit node from the tailscale menu. Now all your internet traffic will go through that machine.
- mightybyte 4y ago
  Have you tried Nebula (https://nebula.defined.net https://nebula.defined.net)? I set up a personal Nebula network a few months ago and have been very happy with it thus far. It has the ability to do mesh-style direct routing so you don't necessarily have to pay the out-and-back latency cost if you're connecting to a location that is closer.
  - tssva 4y ago
    Tailscale peers will directly connect.
  - ttyprintk 4y ago
    Nebula works great. I don’t need some of the emergent bells and whistles of Tailscale, and Nebula works on devices which don’t yet have WireGuard.
- 6ak74rfy 4y ago
  Use Tailscale on an iOS device and you’ll move away within a day. It’sa major battery hogger on iOS.
otterpro 4y ago
Before going to a long 3 month trip to Asia last year, I installed WireGuard on my Raspberry Pi 1 (original model B from 2012) which was running at home in US. I found PiVPN to be the easiest way to install Wireguard. I didn't know if I even needed a VPN but I was glad, and I was able to use internet as if I were at home. It was weird, but a lot of sites are blocked oversea, even though it shouldn't. For example, I couldn't access Homedepot.com. I also couldn't make payment to my Target card as the website refused connection. Apparently a lot of US business sites refuse to connect from oversea IP because of too many hacking attempts, or they just don't want to deal with it. Anyway, I was glad I had set up a VPN before I left for the trip. Also, the original Pi (2012) was able to run Wireguard well enough for light VPN, although I didn't push it too much since I didn't use it for anything heavy like video streaming.
- eddieroger 4y ago
  I don't know first hand, nor am I speaking for my employer (who happens to be one of the two companies you mentioned), but if it was me, I would assume that if my company doesn't do business outside of the United States, then may as well deny traffic for services that wouldn't be available outside of the United States, since it is more often than not problematic traffic. This means sometimes legit traffic would be inconvenienced, as you were, and sorry about that, but it is a realistic scenario that the small amount of legit pain is worth the incredibly reduced risk footprint. Of course, baddies could get VPNs, too, but that's all part of the game.
  - LVDOVICVS 4y ago
    My Canadian stepfather died. Family is not close and I’m in the US. The Canadian newspaper where his obit would be doesn’t allow connections from the US. More than a “small amount of legit pain” was the result.
    - couchand 4y ago
      I'm sorry for your loss. Do they have a phone?
    - 4y ago
Hamuko 4y ago
I use PiVPN on a Dell Wyse 3040, an absolutely pathetic thin-client I got for 67€ from Ebay, to access my home network. It's the only thing accessible from the outside world and it works pretty well. Don't remember if I've ever had issues with it.
rbut 4y ago
Or just use a Mikrotik router which has Wireguard support built-in.
- mobilio 4y ago
  This is only for Mikrotiks that uses ARM processor. Some older that runs on MIPS doesn't get this update.
  - rbut 4y ago
    Wireguard support comes with RouterOS 7 (ros7). I'm running ros7 on a MIPS device (mAP) and it works fine. What device(s) are you talking about?
  - vetinari 4y ago
    Wireguard is available on all architectures, since RouterOS 7.0. Zerotier is the arm/arm64-only package that you probably had on your mind.
    - mobilio 4y ago
      Hm... probably this confuses me.
- xioxox 4y ago
  Yes. My FritzBox also has built-in Wireguard.
syntaxing 4y ago
With the cost of raspberry pi nowadays, you’re better off buying something like a GL.iNet GL-SFT1200 for $40.
- JosephRedfern 4y ago
  The article explicitly mentions this: "PiVPN, luckily, runs on any other Pi-like device, though, as long as it's running a Debian or Pi-OS-like distro. Something like a Libre Computer Le Potato should work in a pinch, without breaking the bank—though if you want faster networking, you'll have to pony up a little more cash, at least until the Pi shortage abates."
mobilio 4y ago
Or you can use ZeroTier.
- a_subsystem 4y ago
  ZeroTier kept having random disconnects, long wait times until connection is established/settled, and desktop app weirdness/inconsistencies. Have these problems been fixed? (Last used it years ago).
  - piceas 4y ago
    Yes and no in my experience. The past year I have had some trouble but the Linux clients seem to be good again. Win11 is getting worse for me unfortunately.
  - mobilio 4y ago
    Seems fixed. I'm using it from 2 or 3 years and it's very strong. Mostly used to connect few Linux boxes behind NAT or double NAT without opening ports on router. Also running on macOS.
Severian 4y ago
The one problem I encounter with Wireguard is the use of UDP. Some publicly accessible Wifi nets at shops don't allow UDP at all, and this effectively breaks use of the VPN. Yeah, there are utilities like setting up udptunnel or udp2raw and similar, but what a headache. I really don't agree with Wireguard's developers justification that it makes speeds terrible. Who cares? It'll be terrible using those utilities anyway. Give us the option, JFC.
- mr_mitm 4y ago
  Yeah, OpenVPN even supports authenticated web proxies, which is a really nice feature for tunneling. But I realize that I'm probably far from a typical user.
- OrderlyTiamat 4y ago
  VPN over TCP really is quite a bit slower than over UDP, which makes it quite undesirable for me. I think it's quite reasonable of them not to want to complicate the wg project by adding and maintaining the option of UDP over TCP. Remember, wg is supposed to be a minimal project. If you really need TCP traffic, you could always use openVPN. With quic on the way, this problem will diminish with time anyway.
  - uriah 4y ago
    There's complicating the protocol and complicating the client. It would definitely be nice if they would add a solution to this to the official clients, particularly mobile ones. VPN over UDP is quite a bit slower than over TCP when the ISP blocks/throttles the UDP traffic...
- cyberpunk 4y ago
  A little trick for this is to listen on udp/53 which is almost always unblocked, even before captive portals
  - unethical_ban 4y ago
    Actually, I found ATT blocking inbound port 53 to my home. Maybe udp 443 could work?
Snawoot 4y ago
Or just consider some HTTP over TLS proxy like this one: https://github.com/Snawoot/dumbproxy https://github.com/Snawoot/dumbproxy It may appear a bit more flexible option, especially if forwarding all traffic to VPN entirely is undesirable.
cloudripper 4y ago
It might be more of a rabbithole, but if you're going the 'self-hosting' homelab route, I'm a big fan of OPNsense to give you more freedom and control of your network (which has support for Wireguard [0]). While ARM support is lacking, it can be run on a cheap or spare x86-64 box if you had one. Otherwise, I really like the premise of Tailscale for quick and easy implementation. [0]: https://docs.opnsense.org/manual/how-tos/wireguard-client.html https://docs.opnsense.org/manual/how-tos/wireguard-client.ht...
geokon 4y ago
Anyone know if these kinds of setups get your around the Chinese firewall? Or is this kind of traffic pretty fingerprintable?
- Snawoot 4y ago
  Wireguard is known to be fingerprintable[1]. But at this moment it is unlikely UDP traffic will be filtered by Chinese GFW[2]. But this may change any moment. [1]: https://lists.zx2c4.com/pipermail/wireguard/2018-September/003290.html https://lists.zx2c4.com/pipermail/wireguard/2018-September/0... [2]: https://gfw.report/publications/usenixsecurity23/en/#sec:residual https://gfw.report/publications/usenixsecurity23/en/#sec:res...
  - fest 4y ago
    I don't think it's true that UDP is completely unfiltered. I tried setting up a Wireguard site-to-site tunnel for $WORKs Chinese office to access EU office- it stopped working within a day.
- npteljes 4y ago
  Many VPNs get around it just fine, according to the random experiences I saw online. The issue is not technical, but legal: the traffic is fingerprintable, and that the parties involved (user, ISP) are legally required to store some of the traffic, and to make that available for authorities to check later [0]. I imagine that they handle this like how they handle other law enforcement - by applying it when they feel like. So at the end of the day, don't get caught. [0] https://en.wikipedia.org/wiki/Cybersecurity_Law_of_the_People%27s_Republic_of_China https://en.wikipedia.org/wiki/Cybersecurity_Law_of_the_Peopl...
chaxor 4y ago
Base wireguard is pretty easy to setup, especially with wg-quick, so idk why anything would be required to make it easier. Also, Rosenpass is quite great and easy to use, which really improves the security further. Hopefully Rosenpass will become part of the base implementation at some point.
- a_subsystem 4y ago
  People keep saying this, but it hasn't been true for me. I've had to reinstall PiVPN a few times, I assume because automatic updates may have broken it somehow. I tried manually configuring wireguard every time but just could not get it to work after hours of trying. PiVPN has always been extremely easy to install and configure.
  - dspillett 4y ago
    Have you tried investigating the config it produces and comparing that to what you ended up with on your failed attempts? Way back when I first started using OpenVPN installing a quick-setup in a VM was how I found a glaring mistake I'd been making (with routing, it turned out, not the OpenVPN config itself). Not that it massively matters if you are happy with PiVPN of course, but understanding more may help you diagnose issues should PiVPN ever fail.
- firstlink 4y ago
  After skimming both the GitHub and the protocol specification for rosenpass, I still have no idea what benefit it provides on top of wireguard and therefore why I should use it.
  - computershit 4y ago
    It's below the fold on rosenpass.eu but: > Rosenpass is a key-exchange protocol using techniques that are secure against attacks from quantum computers. It achieves the same security guarantees as WireGuard, using two strong post-quantum key exchange methods – Classic McEliece and Kyber. > To use Rosenpass, you don't have to get rid of WireGuard; Rosenpass handles post-quantum security, WireGuard handles pre-quantum security and high-speed data transmission.
Toutouxc 4y ago
If your main usecase is accessing Home Assistant or exposing a few HTTP endpoints from your home network, you're maybe stuck under several NATs and you don't mind Cloudflare, then I can't not recommend Cloudflare Tunnel. You just run their app on your home server, set up forwarding as if you were setting up nginx or something, click a few buttons in their GUI and your home stuff is online, on HTTPS, with DDoS protection and a nice dashboard. And you'll likely easily fit into the free tier.
- beardog 4y ago
  If you have the same usecase but DO mind Cloudflare, you can rent a cheap server and use SSH reverse TCP tunneling (ssh -R 8080:localhost:80 proxy@example.com)
- nirav72 4y ago
  Do you have any security cameras configured in Home assistant showing a live feed? Reason I'm asking - it seems that CF has some clauses in their TOS that forbids anything but static content. So audio/video stream is a no-no. I'm also using CF tunnel. Just not for home assistant because of their restrictions. For HASS, I go through tailscale.
briancmoses 4y ago
At the price Raspberry Pis are being sold (scalped) for it's discouraging and disappointing to see content creators continually going to that well. You can buy a travel router like the GL.iNet GL-SFT1200 (Opal) for $39.99. All of Gl.iNet's devices run OpenWRT already. Setting up Wireguard on OpenWRT is easy, and using Tailscale is even easier! Edit: Jeff's been creating awesome Raspberry Pi content for a long time and I'm glad that he's not stopping given the current circumstances. I hope that his audience has an abundant supply of unused RPis looking to be utilized. In Jeff's shoes I'd want to speak to those in his audience who DON'T have a Raspberry Pi and save them from paying scalpers prices until things return to normal--assuming that they ever do.
- 7839284023 4y ago
  > GL.iNet GL-SFT1200 (Opal) According to https://docs.gl-inet.com/en/4/tutorials/tailscale/ https://docs.gl-inet.com/en/4/tutorials/tailscale/ the GL-SFT1200 (Opal) does not support Tailscale but different models from GL.iNet do.
  - lanrat 4y ago
    I made a open-wrt repo that auto-builds Tailscale for my older GL-Inet router for this exact use case: https://lanrat.github.io/openwrt-tailscale-repo/ https://lanrat.github.io/openwrt-tailscale-repo/
- shocks 4y ago
  Did you read the article? > PiVPN, luckily, runs on any other Pi-like device, though, as long as it's running a Debian or Pi-OS-like distro.
  - LeSaucy 4y ago
    So…Linux?
    - ryanpandya 4y ago
      ARM architecture I guess
lenova 4y ago
I have never met Jeff (the author of this blog post), but I come across his work randomly all of the time. Jeff, if you're reading this, I've always been impressed by your efforts, you're a work horse!
- _joel 4y ago
  Should follow him on youtube, always fun vids.
- geerlingguy 4y ago
  Thanks! Didn't think this blog post would hit HN, but apparently it did, while I was on a flight back to the US lol. I figured most of us here are VPN'ed out. It served me well on my trip and I was able to see all the things from local media that are geo restricted out of the US.
distantsounds 4y ago
And then you hit CPU bottlenecks whenever you do literally anything bandwidth intensive. The limits of using hobbyist hardware, you get hobbyist level performance. A Raspberry Pi is a horrible solution for running Wireguard. You can get a tiny 1L PC running on an actual Intel or AMD processor with far more perf/$.
- Proven 4y ago
  [dead]
- FeistySkink 4y ago
  I'm not sure what's the max throughput is, but I just tested 50 Mbit down/80 Mbit up passthrough from a cafe Wi-Fi to my 3B with Wireguard (using wg-quick) at home. Seems enough for anything I'd use it for.
  - Shared404 4y ago
    Heck, that's more than what most people I know get at home
  - geerlingguy 4y ago
    My home Internet upload speed is 35 Mbps. A Pi 1 can handle that speed, much less a Pi 3 or 4 :) But the nice thing is PiVPN works great on any little PC. Or even a VM.
    - FeistySkink 4y ago
      That was just my anecdotal point that a Pi can handle typical home internet speeds over Wireguard without overtaxing the CPU. IMHO, Wireguard's setup is pretty trivial as is, especially moving to it after years (decades at this point) of various OpenVPN setups that require much more tinkering. So no need for external tools. But I'm glad they exist for those who find them useful. Either way, keep up the good work with your knowledge sharing, I'm a big fan of what you do.
- xp84 4y ago
eatbitseveryday 4y ago
A nice dynamic DNS provider is afraid.org
gbraad 4y ago
I do tailscale. wireguard and having to host an entrypoint is too much trouble
indeyets 4y ago
WireGuard/Tailscale are fine if you don't need to deal with state-wide censorship. They might be blocked quite easily. Outline/Shadowsocks has better chances to keep working (though it is not a true vpn, more like a private proxy) https://getoutline.org/ https://getoutline.org/
- Denvercoder9 4y ago
  In what way is WireGuard easier to block than SOCKS?
  - indeyets 4y ago
    that's "shadowsocks" wireguard is fingerprintable. it's trivial to look at packets and see "this is wireguard". and block the packets Outline traffic looks much more like noise (pre-shared keys, lack of handshake, …)
    - Denvercoder9 4y ago
      > that's "shadowsocks" I'm not familiar with the software, but according to Wikipedia it's a client to connect to a SOCKS5 proxy: > Shadowsocks is not a proxy on its own, but (typically) is the client software to help connect to a third-party SOCKS5 proxy, which is similar to a Secure Shell (SSH) tunnel. Are you saying that's incorrect?
      - indeyets 4y ago
        that's oversimplification. raw socks5 is a low-level thing without encryption. shadowsocks puts a solid cryptolayer on top of it, designed specifically to be hard to detect. its Chinese origin gives a hint here: it is created to circumvent detection by "great firewall" outline builds a user-friendly toolset on top of it
    - fasthandle 4y ago
      Shadowsocks is defunct now. Has been for a while; a connected server's IP can be detected and blocked within hours. That means Outline's defunct in a lot of places too. What's currently 'hot', in large part, is v2ray [1], be that vless, vmess, trojan, etc. [1] https://zh.m.wikipedia.org/wiki/V2Ray https://zh.m.wikipedia.org/wiki/V2Ray
mmlkrx 4y ago
Another simple solution I installed on my existing server in actually 5 min via docker run is https://github.com/WeeJeWel/wg-easy https://github.com/WeeJeWel/wg-easy. The interface is very simple, and all in all it took 10 min to have the VPN up and running, download the client applications, and connect to it!
- vxNsr 4y ago
  Yea this is the route I took, I’m a sucker for a good gui, and this is super simple. If you use cloudflare for your domain you can use cloudflare-ddns[0] to automatically update your ip if/when it changes. [0] https://github.com/timothymiller/cloudflare-ddns https://github.com/timothymiller/cloudflare-ddns
divyenduz 4y ago
I have done something similar with Raspberry Pi and Tailscale. Really happy with the setup. Almost 6 months in and works like a charm. https://twitter.com/divyenduz/status/1597863894055518208 https://twitter.com/divyenduz/status/1597863894055518208
- bovem 4y ago
  Hey I saw you are facing some issue with reauthentication on reboot. If you are running it on a docker container then having a persistent state directory for tailscale might help (TS_STATE_DIR=/var/lib/tailscale). I use it on my system and it works flawlessly on restarts.
twodave 4y ago
If you're going this far, might as well do as the author did and add a pi-hole to the mix, issue some credentials to your phone and block ads and/or other stuff via DNS everywhere you go. I also use this to remote into my work computer from wherever I am, using my travel laptop, an iPad or even just my cell phone.
- BrandoElFollito 4y ago
  This. I started to tunnel my traffic via my Wireguard VPN (when outside) to cut these 30% of connections that are blocked by Pihole. Pihole is really a great piece of work. It uses standard components (dnsmasq, standard lists) and does it well. I used to have it in a docker container but moved it to the ISP box when I got a new one (a French ISP called Free provides you with an Internet box that has a built-in VPN (WG or OpenVPN) and allows you to create VMs - this is where I ultimately moved Pihole because it is my DNS and DHCP server)
- philsnow 4y ago
  pihole is really lightweight, you could just run it on your local laptop and save yourself the hop to your home network for all DNS requests
  - twodave 4y ago
    I could set up pihole on my local laptop. And on my wife's laptop. And on my kids' phones. And on my work laptop. And... Or I could just set it up on one tiny server (doesn't have to be a pi, but I happen to have one that isn't doing anything else), point my gateway at it for DNS, and give my whole family + any VPN connections filtering for free.
- abap_rocky 4y ago
  This is precisely what I do and it's great. Built myself a workstation desktop last year that I wanted to access remotely via an older laptop and it's worked beautifully, even when I was out in Europe for a week last summer.
jrm4 4y ago
Personally, if you're looking for "your own private" thing, I'm a much bigger fan of Tinc. The wireguards and zerotiers seem more appropriate for bigger, more corporate things? I do wish Tinc had a slightly easier onboarding process, but once it's up, there's a great deal of stuff that I see people dealing with that Tinc users don't have to much think about, especially, e.g. the Mesh deal.
- nirav72 4y ago
  Wireguard has a dead simple onboarding process as well. For users you want to grant access - providing a QR code and them installing the wireguard client app on their mobile device is all that is needed. Also wireguard server itself is a easy setup and has very little overhead. Took me like few minutes to install and setup on a raspberry pi 3. Of course, you do have to open up a port on your router. That's the only downside. I've since switched to Tailscale for that specific reason.
- spaniard89277 4y ago
  I don't think there are a lot of stuff easier to set up than ZeroTier, honestly. For me it has been a godsend.
- jasonjayr 4y ago
  Tinc was my goto for years, but there is a non-trivial performance penalty for it's userspace implementation. If you can enumerate all your endpoints into wireguard, and squint, it'll kinda-sorta act like a mesh. And if you want to go a little crazy with it, You can run https://github.com/m13253/VxWireguard-Generator https://github.com/m13253/VxWireguard-Generator + babeld, and get routing around failures in the mesh.
stzsch 4y ago
I keep a pi with wireguard as a way to reboot my homeserver remotely if something goes wrong. A gpio pin connected to an optocoupler acts as second power switch on the motherboard. Works well for testing stuff remotely or messing with VPN configurations on the server itself without leaving it stranded for good.
ye-olde-sysrq 4y ago
I run wg-easy https://github.com/WeeJeWel/wg-easy https://github.com/WeeJeWel/wg-easy for this sort of thing. I use the docker container, and it's great. "Just works". Also, unrelated, I just decided I don't like the sentiment of "PiMyProjectName" branding. I know most projects don't just run on a Pi, and that the intent is to say "you can self-host thing", but at this point if you want to run a home server sort of thing, just buy some cheap 100-200 dollar minipc thing. That's how much you'd pay for a Pi now anyway, and it comes with such great features as: * just establishing an ssh connection doesn't take multiple seconds * the ethernet doesn't go over a usb hub * it doesn't run on an sd card that is going to fail within a year I'm pretty dismissive of ARM chips for homelab stuff at this point. There's super cheap minipcs with "real" processors that will just destroy even an expensive ARM board. Pi's shine with their ability to run both a real/full Linux and also do gpio type stuff that otherwise is usually an arduino board. I don't have anything against low-level programming but damn is it just a lot more fun to do in python. I love the Rpi zero w 2 products for this, just enough juice to run wifi and a python loop, plus the gpio pins. Too bad they've been sold out for literally years.
- MallocVoidstar 4y ago
  I bought a used Lenovo mini-pc for ~$40 and it is significantly more capable/reliable than the Pi 3 it replaced. If I need non-server stuff (I2C, GPIO) I stick to microcontrollers now.
- regularfry 4y ago
  Teeny tiny detail: > just establishing an ssh connection doesn't take multiple seconds That's almost certainly power saving on the WiFi. Annoying but fixable. Seems to be on by default, and a `/sbin/iwconfig wlan0 power off` line in rc.local should fix it.
- lxgr 4y ago
  > I run wg-easy https://github.com/WeeJeWel/wg-easy https://github.com/WeeJeWel/wg-easy for this sort of thing. I use the docker container, and it's great. "Just works". This looks great, thank you! My current home router(s) fortunately support Wireguard natively, but I'll look into this if I'm ever again forced to use a shitty CPE. > I'm pretty dismissive of ARM chips for homelab stuff at this point. There's super cheap minipcs with "real" processors [...] What makes an ARM SoC a "non-real processor"? I'm typing this on a laptop with an ARM CPU, and it's the fastest hardware I've ever worked on.
appleaday1 4y ago
I have tried a lot of wireguard installation solutions, this one is pretty great.
vrglvrglvrgl 4y ago
[dead]
goodpoint 4y ago
curl | bash ?? For something as critical as a VPN? No thanks. You know you can just do apt install wireguard right?
tzs 4y ago
Up until late 2014 when I occasionally worked at home, I used what I called the poor man's VPN. There was one machine at my company that I had ssh access to from outside and that could reach all the internal machines I needed. Call that machine ssh.example.com. My requirements for comfortably working from home were: 1. Nothing special needs to be done at work. I don't have to ask for anything new to be installed there, or firewall rules to be changed, or anything like that. 2. I wanted to be able to refer to work machines by the same names they had on the internal network at work, and I wanted to access things on the same ports. A script that worked when run from my office should work with no changes when run from my living room. 3. It only needed to support host:port combinations that were explicitly specified. Here's what I did. Let's say I've got 3 machines I need to use: db.example.com: MySQL server mail.example.com: mail server web.example.com: web server I need to use MySQL on the first (port 3306), IMAPS on the second (port 993), and HTTP/HTTPS on the third (ports 80 and 443), and I want to use ssh (port 22) on all of them. I'd ssh to the machine at work that I have ssh access to, with my ssh config file including this: Host poor_vpn Hostname ssh.example.com User tzs UserKnownHostsFile ~/.ssh/poor_vpn.hosts LocalForward 7777 db.example.com:22 LocalForward 7778 db.example.com:3306 LocalForward 7779 mail.example.com:22 LocalForward 7780 mail.example.com:993 LocalForward 7781 web.example.com:22 LocalForward 7782 web.example.com:80 LocalForward 7783 web.example.com:443 I'd add this to /etc/hosts: 10.10.10.1 db.example.com 10.10.10.2 mail.example.com 10.10.10.3 web.example.com (My LAN used 192.168.0.x addresses) Finally, a little ipfw fiddling on my Mac to bring it all together: ipfw add 100 fwd 127.0.0.1,7777 tcp from any to 10.10.10.1 22 ipfw add 101 fwd 127.0.0.1,7778 tcp from any to 10.10.10.1 3306 ipfw add 102 fwd 127.0.0.1,7779 tcp from any to 10.10.10.2 22 ipfw add 103 fwd 127.0.0.1,7780 tcp from any to 10.10.10.2 993 ipfw add 104 fwd 127.0.0.1,7781 tcp from any to 10.10.10.3 22 ipfw add 105 fwd 127.0.0.1,7782 tcp from any to 10.10.10.3 80 ipfw add 106 fwd 127.0.0.1,7783 tcp from any to 10.10.10.3 443 On Linux that would have been something like this: iptables -t nat -A OUTPUT -p tcp -d 10.10.10.1 --dport 22 REDIRECT --to-port 7777 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.1 --dport 3306 REDIRECT --to-port 7778 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.2 --dport 22 REDIRECT --to-port 7779 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.2 --dport 993 REDIRECT --to-port 7780 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.3 --dport 22 REDIRECT --to-port 7781 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.3 --dport 80 REDIRECT --to-port 7782 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.3 --dport 443 REDIRECT --to-port 7783 That worked great for several years. I've got a script that can take a list of files that describe host:port combination and generate the ssh config, hosts, and ipfw or iptabes rules so it was easy to add or remove machines. It broke in late 2014 when I switch to MacOS Yosemite. Apple had switched to using PF in Lion in 2011 and deprecated ipfw, and removed it in Yosemite. By then we had an openvpn setup at work and I switched to using that.
carride 4y ago
Algo project still works well. Very quickly launch a WireGuard VPN to several popular cloud providers, or any Linux instance you already have access to, including your rPi. https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- byteflip 4y ago
  Yes, I've been using this since I moved overseas. Works great, was able to add NextDNS for ad blocking. I still find some websites will block you as your traffic will be originating from a datacenter (if going cloud option like me), but most work. I find this setup also works for some services that do not work via VPNs such as Mullvad. If you want to talk to other devices check out the `BetweenClients_DROP` setting ("road warrior")
mdmglr 4y ago
I’ve recently built a VPN into my network using Cloudflare Zero Trust and Cloudflare Tunnels. Highly recommend over maintaining Wireguard or anything else. Much more comprehensive security controls.
fionaellie 4y ago
I use DietPi, which includes WireGuard and other things like PiHole. I've had my RPi 4 running without issue for more than 2 years, and can get 200mbps up and down.
fionaellie 4y ago
I quickly installed Outline on a free-forever Oracle VPS. This might be the best option for someone who doesn't want to buy a RPi, worry about SD card corruption, use any additional electricity at home, or spend any money. Even with the tiny free VPS provided for free, I'm getting great speeds of over 200mbps. And you can choose multiple locations to set up your free VPS.
samgranieri 4y ago
I'm using https://github.com/burghardt/easy-wg-quick https://github.com/burghardt/easy-wg-quick for this. It works beautifully. I simply port forward to my raspberry pi that handles all of this.
blipvert 4y ago
Taking an opportunity here for a completely shameless plug for an enterprise-y wg based corporate VPN. Uses mTLS for device auth, wg (obvs), OIDC to authenticate users/set up firewall access (Azure AD and Keycloak tested). Runs as a redundant cluster and can be hooked in via BGP. Very early and no docs to speak of yet, but raise an issue if interested. Works with standard WireGuard app on computers/phones, but an integrated app using the API might be in the works … https://github.com/davidcoles/gpn https://github.com/davidcoles/gpn
- devaler 4y ago
  Interesting and interested. I’ll be following, for the learning experience if nothing else.
  - blipvert 4y ago
    Will update with some docs next week, then.
6451937099 4y ago
[dead]
6451937099 4y ago
[dead]
tristanb 4y ago
I run my own WireGuard VPN for my home devices, and I have had a hell of a time getting MDNS to work over it. I tried various reflectors and couldn't get them to work, has anyone made this simple?
sobkas 4y ago
For me HPE ProLiant MicroServer G10+ is better solution but I couldn't find wireless pcie card that reliable could be used as AP. I have QNAP QWA-AC2600 bought in Europe but Linux driver is crippled and sets regulatory region to US because ROM doesn't have it set properly. And there is no way to change it. Driver developers think it's a feature and won't revert it. I really appreciate that driver developers know better than me where I use hardware, but for now I don't want to use US settings in for example Poland. Or all frequencies are tagged as not for AP use. My question is, is there any pcie card that could be used as AP?
mlerner 4y ago
[flagged]
- abtinf 4y ago
  Please don’t do this here. From the guidelines: > Please don't use Hacker News for political or ideological battle. That tramples curiosity.

552 points by ingve 4y ago

> Note: Security is a major concern here—don't set up a VPN if you don't know what you're doing. If someone gets access through the VPN to your home network, they can (and will) hack into your house! While possible, many people already give access to their home networks via multi-homed devices they carry in their pockets everywhere they go. Relying on anything below the application layer for security is not very good these days.

cellu 4y ago

Anyone found a way to to split tunnelling on MacOS?

pwpw 4y ago

I set all of this up about 3 weeks ago. Wish I had come across this guide then! It's a great solution that has made my dev work and media consumption so much easier on the go. One thing that tripped me up on arch linux with KDE Plasma was that importing the downloaded WireGuard configuration didn't work in NetworkManager using the gui. After a bit of tinkering, I finally discovered that you can download the conf file to your computer and then run the following command: nmcli connection import type wireguard file [CONF_FILE] That adds it to NetworkManager, making it easy to connect to from the gui.

kdot 4y ago

Would a solution that uses IKEv2.

blutack 4y ago

If your router supports OpenWRT that's a good alternative that doesn't require any additional boxes/boards and is simpler to set up networking-wise. There's a nice UI that generates the QR codes or config files ready for import into client devices. 1: https://openwrt.org/docs/guide-user/services/vpn/wireguard/basics https://openwrt.org/docs/guide-user/services/vpn/wireguard/b...

alpenbazi 4y ago
OpenWRT on a BananaPI R2 with WG wirks like a charm for ~ 2 years now
flas9sd 4y ago
yes the webui now has some convenience options for generating and importing configs, but there's still a gap (as in default package installed) in client profile management or network management on cli. What pivpn (and similar tooling wrapping lower level commands) bring along is this client management and even some network topology/routing management : https://docs.pivpn.io/wireguard/ https://docs.pivpn.io/wireguard/ and https://github.com/pivpn/pivpn/tree/master/scripts/wireguard https://github.com/pivpn/pivpn/tree/master/scripts/wireguard I think it's a interesting spectrum between wg-cli and tailscale.

kgersen 4y ago

I moved to Tailscale, until I find something simpler, I'm not moving back.

lostlogin 4y ago
Why would that even look like? When I set it up it promised a 10 minute install time. For me a fair portion of that 10 minutes was trying to work out if it was working as my line speed was higher than I thought possible. It’s scary how quick it is to configure.
- SparkyMcUnicorn 4y ago
  Just install tailscale on something in your home network, and start it up advertising as an exit node. On your laptop, select the exit node from the tailscale menu. Now all your internet traffic will go through that machine.
mightybyte 4y ago
Have you tried Nebula (https://nebula.defined.net https://nebula.defined.net)? I set up a personal Nebula network a few months ago and have been very happy with it thus far. It has the ability to do mesh-style direct routing so you don't necessarily have to pay the out-and-back latency cost if you're connecting to a location that is closer.
- tssva 4y ago
  Tailscale peers will directly connect.
- ttyprintk 4y ago
  Nebula works great. I don’t need some of the emergent bells and whistles of Tailscale, and Nebula works on devices which don’t yet have WireGuard.
6ak74rfy 4y ago
Use Tailscale on an iOS device and you’ll move away within a day. It’sa major battery hogger on iOS.

otterpro 4y ago

Before going to a long 3 month trip to Asia last year, I installed WireGuard on my Raspberry Pi 1 (original model B from 2012) which was running at home in US. I found PiVPN to be the easiest way to install Wireguard. I didn't know if I even needed a VPN but I was glad, and I was able to use internet as if I were at home. It was weird, but a lot of sites are blocked oversea, even though it shouldn't. For example, I couldn't access Homedepot.com. I also couldn't make payment to my Target card as the website refused connection. Apparently a lot of US business sites refuse to connect from oversea IP because of too many hacking attempts, or they just don't want to deal with it. Anyway, I was glad I had set up a VPN before I left for the trip. Also, the original Pi (2012) was able to run Wireguard well enough for light VPN, although I didn't push it too much since I didn't use it for anything heavy like video streaming.

eddieroger 4y ago
I don't know first hand, nor am I speaking for my employer (who happens to be one of the two companies you mentioned), but if it was me, I would assume that if my company doesn't do business outside of the United States, then may as well deny traffic for services that wouldn't be available outside of the United States, since it is more often than not problematic traffic. This means sometimes legit traffic would be inconvenienced, as you were, and sorry about that, but it is a realistic scenario that the small amount of legit pain is worth the incredibly reduced risk footprint. Of course, baddies could get VPNs, too, but that's all part of the game.
- LVDOVICVS 4y ago
  My Canadian stepfather died. Family is not close and I’m in the US. The Canadian newspaper where his obit would be doesn’t allow connections from the US. More than a “small amount of legit pain” was the result.
  - couchand 4y ago
    I'm sorry for your loss. Do they have a phone?
  - 4y ago

Hamuko 4y ago

I use PiVPN on a Dell Wyse 3040, an absolutely pathetic thin-client I got for 67€ from Ebay, to access my home network. It's the only thing accessible from the outside world and it works pretty well. Don't remember if I've ever had issues with it.

rbut 4y ago

Or just use a Mikrotik router which has Wireguard support built-in.

mobilio 4y ago
This is only for Mikrotiks that uses ARM processor. Some older that runs on MIPS doesn't get this update.
- rbut 4y ago
  Wireguard support comes with RouterOS 7 (ros7). I'm running ros7 on a MIPS device (mAP) and it works fine. What device(s) are you talking about?
- vetinari 4y ago
  Wireguard is available on all architectures, since RouterOS 7.0. Zerotier is the arm/arm64-only package that you probably had on your mind.
  - mobilio 4y ago
    Hm... probably this confuses me.
xioxox 4y ago
Yes. My FritzBox also has built-in Wireguard.

syntaxing 4y ago

With the cost of raspberry pi nowadays, you’re better off buying something like a GL.iNet GL-SFT1200 for $40.

JosephRedfern 4y ago
The article explicitly mentions this: "PiVPN, luckily, runs on any other Pi-like device, though, as long as it's running a Debian or Pi-OS-like distro. Something like a Libre Computer Le Potato should work in a pinch, without breaking the bank—though if you want faster networking, you'll have to pony up a little more cash, at least until the Pi shortage abates."

mobilio 4y ago

Or you can use ZeroTier.

a_subsystem 4y ago
ZeroTier kept having random disconnects, long wait times until connection is established/settled, and desktop app weirdness/inconsistencies. Have these problems been fixed? (Last used it years ago).
- piceas 4y ago
  Yes and no in my experience. The past year I have had some trouble but the Linux clients seem to be good again. Win11 is getting worse for me unfortunately.
- mobilio 4y ago
  Seems fixed. I'm using it from 2 or 3 years and it's very strong. Mostly used to connect few Linux boxes behind NAT or double NAT without opening ports on router. Also running on macOS.

Severian 4y ago

The one problem I encounter with Wireguard is the use of UDP. Some publicly accessible Wifi nets at shops don't allow UDP at all, and this effectively breaks use of the VPN. Yeah, there are utilities like setting up udptunnel or udp2raw and similar, but what a headache. I really don't agree with Wireguard's developers justification that it makes speeds terrible. Who cares? It'll be terrible using those utilities anyway. Give us the option, JFC.

mr_mitm 4y ago
Yeah, OpenVPN even supports authenticated web proxies, which is a really nice feature for tunneling. But I realize that I'm probably far from a typical user.
OrderlyTiamat 4y ago
VPN over TCP really is quite a bit slower than over UDP, which makes it quite undesirable for me. I think it's quite reasonable of them not to want to complicate the wg project by adding and maintaining the option of UDP over TCP. Remember, wg is supposed to be a minimal project. If you really need TCP traffic, you could always use openVPN. With quic on the way, this problem will diminish with time anyway.
- uriah 4y ago
  There's complicating the protocol and complicating the client. It would definitely be nice if they would add a solution to this to the official clients, particularly mobile ones. VPN over UDP is quite a bit slower than over TCP when the ISP blocks/throttles the UDP traffic...
cyberpunk 4y ago
A little trick for this is to listen on udp/53 which is almost always unblocked, even before captive portals
- unethical_ban 4y ago
  Actually, I found ATT blocking inbound port 53 to my home. Maybe udp 443 could work?

Snawoot 4y ago

Or just consider some HTTP over TLS proxy like this one: https://github.com/Snawoot/dumbproxy https://github.com/Snawoot/dumbproxy It may appear a bit more flexible option, especially if forwarding all traffic to VPN entirely is undesirable.

cloudripper 4y ago

It might be more of a rabbithole, but if you're going the 'self-hosting' homelab route, I'm a big fan of OPNsense to give you more freedom and control of your network (which has support for Wireguard [0]). While ARM support is lacking, it can be run on a cheap or spare x86-64 box if you had one. Otherwise, I really like the premise of Tailscale for quick and easy implementation. [0]: https://docs.opnsense.org/manual/how-tos/wireguard-client.html https://docs.opnsense.org/manual/how-tos/wireguard-client.ht...

geokon 4y ago

Anyone know if these kinds of setups get your around the Chinese firewall? Or is this kind of traffic pretty fingerprintable?

Snawoot 4y ago
Wireguard is known to be fingerprintable[1]. But at this moment it is unlikely UDP traffic will be filtered by Chinese GFW[2]. But this may change any moment. [1]: https://lists.zx2c4.com/pipermail/wireguard/2018-September/003290.html https://lists.zx2c4.com/pipermail/wireguard/2018-September/0... [2]: https://gfw.report/publications/usenixsecurity23/en/#sec:residual https://gfw.report/publications/usenixsecurity23/en/#sec:res...
- fest 4y ago
  I don't think it's true that UDP is completely unfiltered. I tried setting up a Wireguard site-to-site tunnel for $WORKs Chinese office to access EU office- it stopped working within a day.
npteljes 4y ago
Many VPNs get around it just fine, according to the random experiences I saw online. The issue is not technical, but legal: the traffic is fingerprintable, and that the parties involved (user, ISP) are legally required to store some of the traffic, and to make that available for authorities to check later [0]. I imagine that they handle this like how they handle other law enforcement - by applying it when they feel like. So at the end of the day, don't get caught. [0] https://en.wikipedia.org/wiki/Cybersecurity_Law_of_the_People%27s_Republic_of_China https://en.wikipedia.org/wiki/Cybersecurity_Law_of_the_Peopl...

chaxor 4y ago

Base wireguard is pretty easy to setup, especially with wg-quick, so idk why anything would be required to make it easier. Also, Rosenpass is quite great and easy to use, which really improves the security further. Hopefully Rosenpass will become part of the base implementation at some point.

a_subsystem 4y ago
People keep saying this, but it hasn't been true for me. I've had to reinstall PiVPN a few times, I assume because automatic updates may have broken it somehow. I tried manually configuring wireguard every time but just could not get it to work after hours of trying. PiVPN has always been extremely easy to install and configure.
- dspillett 4y ago
  Have you tried investigating the config it produces and comparing that to what you ended up with on your failed attempts? Way back when I first started using OpenVPN installing a quick-setup in a VM was how I found a glaring mistake I'd been making (with routing, it turned out, not the OpenVPN config itself). Not that it massively matters if you are happy with PiVPN of course, but understanding more may help you diagnose issues should PiVPN ever fail.
firstlink 4y ago
After skimming both the GitHub and the protocol specification for rosenpass, I still have no idea what benefit it provides on top of wireguard and therefore why I should use it.
- computershit 4y ago
  It's below the fold on rosenpass.eu but: > Rosenpass is a key-exchange protocol using techniques that are secure against attacks from quantum computers. It achieves the same security guarantees as WireGuard, using two strong post-quantum key exchange methods – Classic McEliece and Kyber. > To use Rosenpass, you don't have to get rid of WireGuard; Rosenpass handles post-quantum security, WireGuard handles pre-quantum security and high-speed data transmission.

Toutouxc 4y ago

If your main usecase is accessing Home Assistant or exposing a few HTTP endpoints from your home network, you're maybe stuck under several NATs and you don't mind Cloudflare, then I can't not recommend Cloudflare Tunnel. You just run their app on your home server, set up forwarding as if you were setting up nginx or something, click a few buttons in their GUI and your home stuff is online, on HTTPS, with DDoS protection and a nice dashboard. And you'll likely easily fit into the free tier.

beardog 4y ago
If you have the same usecase but DO mind Cloudflare, you can rent a cheap server and use SSH reverse TCP tunneling (ssh -R 8080:localhost:80 proxy@example.com)
nirav72 4y ago
Do you have any security cameras configured in Home assistant showing a live feed? Reason I'm asking - it seems that CF has some clauses in their TOS that forbids anything but static content. So audio/video stream is a no-no. I'm also using CF tunnel. Just not for home assistant because of their restrictions. For HASS, I go through tailscale.

briancmoses 4y ago

At the price Raspberry Pis are being sold (scalped) for it's discouraging and disappointing to see content creators continually going to that well. You can buy a travel router like the GL.iNet GL-SFT1200 (Opal) for $39.99. All of Gl.iNet's devices run OpenWRT already. Setting up Wireguard on OpenWRT is easy, and using Tailscale is even easier! Edit: Jeff's been creating awesome Raspberry Pi content for a long time and I'm glad that he's not stopping given the current circumstances. I hope that his audience has an abundant supply of unused RPis looking to be utilized. In Jeff's shoes I'd want to speak to those in his audience who DON'T have a Raspberry Pi and save them from paying scalpers prices until things return to normal--assuming that they ever do.

7839284023 4y ago
> GL.iNet GL-SFT1200 (Opal) According to https://docs.gl-inet.com/en/4/tutorials/tailscale/ https://docs.gl-inet.com/en/4/tutorials/tailscale/ the GL-SFT1200 (Opal) does not support Tailscale but different models from GL.iNet do.
- lanrat 4y ago
  I made a open-wrt repo that auto-builds Tailscale for my older GL-Inet router for this exact use case: https://lanrat.github.io/openwrt-tailscale-repo/ https://lanrat.github.io/openwrt-tailscale-repo/
shocks 4y ago
Did you read the article? > PiVPN, luckily, runs on any other Pi-like device, though, as long as it's running a Debian or Pi-OS-like distro.
- LeSaucy 4y ago
  So…Linux?
  - ryanpandya 4y ago
    ARM architecture I guess

lenova 4y ago

I have never met Jeff (the author of this blog post), but I come across his work randomly all of the time. Jeff, if you're reading this, I've always been impressed by your efforts, you're a work horse!

_joel 4y ago
Should follow him on youtube, always fun vids.
geerlingguy 4y ago
Thanks! Didn't think this blog post would hit HN, but apparently it did, while I was on a flight back to the US lol. I figured most of us here are VPN'ed out. It served me well on my trip and I was able to see all the things from local media that are geo restricted out of the US.

distantsounds 4y ago

And then you hit CPU bottlenecks whenever you do literally anything bandwidth intensive. The limits of using hobbyist hardware, you get hobbyist level performance. A Raspberry Pi is a horrible solution for running Wireguard. You can get a tiny 1L PC running on an actual Intel or AMD processor with far more perf/$.

Proven 4y ago
[dead]
FeistySkink 4y ago
I'm not sure what's the max throughput is, but I just tested 50 Mbit down/80 Mbit up passthrough from a cafe Wi-Fi to my 3B with Wireguard (using wg-quick) at home. Seems enough for anything I'd use it for.
- Shared404 4y ago
  Heck, that's more than what most people I know get at home
- geerlingguy 4y ago
  My home Internet upload speed is 35 Mbps. A Pi 1 can handle that speed, much less a Pi 3 or 4 :) But the nice thing is PiVPN works great on any little PC. Or even a VM.
  - FeistySkink 4y ago
    That was just my anecdotal point that a Pi can handle typical home internet speeds over Wireguard without overtaxing the CPU. IMHO, Wireguard's setup is pretty trivial as is, especially moving to it after years (decades at this point) of various OpenVPN setups that require much more tinkering. So no need for external tools. But I'm glad they exist for those who find them useful. Either way, keep up the good work with your knowledge sharing, I'm a big fan of what you do.
xp84 4y ago

eatbitseveryday 4y ago

A nice dynamic DNS provider is afraid.org

gbraad 4y ago

I do tailscale. wireguard and having to host an entrypoint is too much trouble

indeyets 4y ago

WireGuard/Tailscale are fine if you don't need to deal with state-wide censorship. They might be blocked quite easily. Outline/Shadowsocks has better chances to keep working (though it is not a true vpn, more like a private proxy) https://getoutline.org/ https://getoutline.org/

Denvercoder9 4y ago
In what way is WireGuard easier to block than SOCKS?
- indeyets 4y ago
  that's "shadowsocks" wireguard is fingerprintable. it's trivial to look at packets and see "this is wireguard". and block the packets Outline traffic looks much more like noise (pre-shared keys, lack of handshake, …)
  - Denvercoder9 4y ago
    > that's "shadowsocks" I'm not familiar with the software, but according to Wikipedia it's a client to connect to a SOCKS5 proxy: > Shadowsocks is not a proxy on its own, but (typically) is the client software to help connect to a third-party SOCKS5 proxy, which is similar to a Secure Shell (SSH) tunnel. Are you saying that's incorrect?
    - indeyets 4y ago
      that's oversimplification. raw socks5 is a low-level thing without encryption. shadowsocks puts a solid cryptolayer on top of it, designed specifically to be hard to detect. its Chinese origin gives a hint here: it is created to circumvent detection by "great firewall" outline builds a user-friendly toolset on top of it
  - fasthandle 4y ago
    Shadowsocks is defunct now. Has been for a while; a connected server's IP can be detected and blocked within hours. That means Outline's defunct in a lot of places too. What's currently 'hot', in large part, is v2ray [1], be that vless, vmess, trojan, etc. [1] https://zh.m.wikipedia.org/wiki/V2Ray https://zh.m.wikipedia.org/wiki/V2Ray

mmlkrx 4y ago

Another simple solution I installed on my existing server in actually 5 min via docker run is https://github.com/WeeJeWel/wg-easy https://github.com/WeeJeWel/wg-easy. The interface is very simple, and all in all it took 10 min to have the VPN up and running, download the client applications, and connect to it!

vxNsr 4y ago
Yea this is the route I took, I’m a sucker for a good gui, and this is super simple. If you use cloudflare for your domain you can use cloudflare-ddns[0] to automatically update your ip if/when it changes. [0] https://github.com/timothymiller/cloudflare-ddns https://github.com/timothymiller/cloudflare-ddns

divyenduz 4y ago

I have done something similar with Raspberry Pi and Tailscale. Really happy with the setup. Almost 6 months in and works like a charm. https://twitter.com/divyenduz/status/1597863894055518208 https://twitter.com/divyenduz/status/1597863894055518208

bovem 4y ago
Hey I saw you are facing some issue with reauthentication on reboot. If you are running it on a docker container then having a persistent state directory for tailscale might help (TS_STATE_DIR=/var/lib/tailscale). I use it on my system and it works flawlessly on restarts.

twodave 4y ago

If you're going this far, might as well do as the author did and add a pi-hole to the mix, issue some credentials to your phone and block ads and/or other stuff via DNS everywhere you go. I also use this to remote into my work computer from wherever I am, using my travel laptop, an iPad or even just my cell phone.

BrandoElFollito 4y ago
This. I started to tunnel my traffic via my Wireguard VPN (when outside) to cut these 30% of connections that are blocked by Pihole. Pihole is really a great piece of work. It uses standard components (dnsmasq, standard lists) and does it well. I used to have it in a docker container but moved it to the ISP box when I got a new one (a French ISP called Free provides you with an Internet box that has a built-in VPN (WG or OpenVPN) and allows you to create VMs - this is where I ultimately moved Pihole because it is my DNS and DHCP server)
philsnow 4y ago
pihole is really lightweight, you could just run it on your local laptop and save yourself the hop to your home network for all DNS requests
- twodave 4y ago
  I could set up pihole on my local laptop. And on my wife's laptop. And on my kids' phones. And on my work laptop. And... Or I could just set it up on one tiny server (doesn't have to be a pi, but I happen to have one that isn't doing anything else), point my gateway at it for DNS, and give my whole family + any VPN connections filtering for free.
abap_rocky 4y ago
This is precisely what I do and it's great. Built myself a workstation desktop last year that I wanted to access remotely via an older laptop and it's worked beautifully, even when I was out in Europe for a week last summer.

jrm4 4y ago

Personally, if you're looking for "your own private" thing, I'm a much bigger fan of Tinc. The wireguards and zerotiers seem more appropriate for bigger, more corporate things? I do wish Tinc had a slightly easier onboarding process, but once it's up, there's a great deal of stuff that I see people dealing with that Tinc users don't have to much think about, especially, e.g. the Mesh deal.

nirav72 4y ago
Wireguard has a dead simple onboarding process as well. For users you want to grant access - providing a QR code and them installing the wireguard client app on their mobile device is all that is needed. Also wireguard server itself is a easy setup and has very little overhead. Took me like few minutes to install and setup on a raspberry pi 3. Of course, you do have to open up a port on your router. That's the only downside. I've since switched to Tailscale for that specific reason.
spaniard89277 4y ago
I don't think there are a lot of stuff easier to set up than ZeroTier, honestly. For me it has been a godsend.
jasonjayr 4y ago
Tinc was my goto for years, but there is a non-trivial performance penalty for it's userspace implementation. If you can enumerate all your endpoints into wireguard, and squint, it'll kinda-sorta act like a mesh. And if you want to go a little crazy with it, You can run https://github.com/m13253/VxWireguard-Generator https://github.com/m13253/VxWireguard-Generator + babeld, and get routing around failures in the mesh.

stzsch 4y ago

I keep a pi with wireguard as a way to reboot my homeserver remotely if something goes wrong. A gpio pin connected to an optocoupler acts as second power switch on the motherboard. Works well for testing stuff remotely or messing with VPN configurations on the server itself without leaving it stranded for good.

ye-olde-sysrq 4y ago

I run wg-easy https://github.com/WeeJeWel/wg-easy https://github.com/WeeJeWel/wg-easy for this sort of thing. I use the docker container, and it's great. "Just works". Also, unrelated, I just decided I don't like the sentiment of "PiMyProjectName" branding. I know most projects don't just run on a Pi, and that the intent is to say "you can self-host thing", but at this point if you want to run a home server sort of thing, just buy some cheap 100-200 dollar minipc thing. That's how much you'd pay for a Pi now anyway, and it comes with such great features as: * just establishing an ssh connection doesn't take multiple seconds * the ethernet doesn't go over a usb hub * it doesn't run on an sd card that is going to fail within a year I'm pretty dismissive of ARM chips for homelab stuff at this point. There's super cheap minipcs with "real" processors that will just destroy even an expensive ARM board. Pi's shine with their ability to run both a real/full Linux and also do gpio type stuff that otherwise is usually an arduino board. I don't have anything against low-level programming but damn is it just a lot more fun to do in python. I love the Rpi zero w 2 products for this, just enough juice to run wifi and a python loop, plus the gpio pins. Too bad they've been sold out for literally years.

MallocVoidstar 4y ago
I bought a used Lenovo mini-pc for ~$40 and it is significantly more capable/reliable than the Pi 3 it replaced. If I need non-server stuff (I2C, GPIO) I stick to microcontrollers now.
regularfry 4y ago
Teeny tiny detail: > just establishing an ssh connection doesn't take multiple seconds That's almost certainly power saving on the WiFi. Annoying but fixable. Seems to be on by default, and a `/sbin/iwconfig wlan0 power off` line in rc.local should fix it.
lxgr 4y ago
> I run wg-easy https://github.com/WeeJeWel/wg-easy https://github.com/WeeJeWel/wg-easy for this sort of thing. I use the docker container, and it's great. "Just works". This looks great, thank you! My current home router(s) fortunately support Wireguard natively, but I'll look into this if I'm ever again forced to use a shitty CPE. > I'm pretty dismissive of ARM chips for homelab stuff at this point. There's super cheap minipcs with "real" processors [...] What makes an ARM SoC a "non-real processor"? I'm typing this on a laptop with an ARM CPU, and it's the fastest hardware I've ever worked on.

appleaday1 4y ago

I have tried a lot of wireguard installation solutions, this one is pretty great.

vrglvrglvrgl 4y ago

[dead]

goodpoint 4y ago

curl | bash ?? For something as critical as a VPN? No thanks. You know you can just do apt install wireguard right?

tzs 4y ago

Up until late 2014 when I occasionally worked at home, I used what I called the poor man's VPN. There was one machine at my company that I had ssh access to from outside and that could reach all the internal machines I needed. Call that machine ssh.example.com. My requirements for comfortably working from home were: 1. Nothing special needs to be done at work. I don't have to ask for anything new to be installed there, or firewall rules to be changed, or anything like that. 2. I wanted to be able to refer to work machines by the same names they had on the internal network at work, and I wanted to access things on the same ports. A script that worked when run from my office should work with no changes when run from my living room. 3. It only needed to support host:port combinations that were explicitly specified. Here's what I did. Let's say I've got 3 machines I need to use: db.example.com: MySQL server mail.example.com: mail server web.example.com: web server I need to use MySQL on the first (port 3306), IMAPS on the second (port 993), and HTTP/HTTPS on the third (ports 80 and 443), and I want to use ssh (port 22) on all of them. I'd ssh to the machine at work that I have ssh access to, with my ssh config file including this: Host poor_vpn Hostname ssh.example.com User tzs UserKnownHostsFile ~/.ssh/poor_vpn.hosts LocalForward 7777 db.example.com:22 LocalForward 7778 db.example.com:3306 LocalForward 7779 mail.example.com:22 LocalForward 7780 mail.example.com:993 LocalForward 7781 web.example.com:22 LocalForward 7782 web.example.com:80 LocalForward 7783 web.example.com:443 I'd add this to /etc/hosts: 10.10.10.1 db.example.com 10.10.10.2 mail.example.com 10.10.10.3 web.example.com (My LAN used 192.168.0.x addresses) Finally, a little ipfw fiddling on my Mac to bring it all together: ipfw add 100 fwd 127.0.0.1,7777 tcp from any to 10.10.10.1 22 ipfw add 101 fwd 127.0.0.1,7778 tcp from any to 10.10.10.1 3306 ipfw add 102 fwd 127.0.0.1,7779 tcp from any to 10.10.10.2 22 ipfw add 103 fwd 127.0.0.1,7780 tcp from any to 10.10.10.2 993 ipfw add 104 fwd 127.0.0.1,7781 tcp from any to 10.10.10.3 22 ipfw add 105 fwd 127.0.0.1,7782 tcp from any to 10.10.10.3 80 ipfw add 106 fwd 127.0.0.1,7783 tcp from any to 10.10.10.3 443 On Linux that would have been something like this: iptables -t nat -A OUTPUT -p tcp -d 10.10.10.1 --dport 22 REDIRECT --to-port 7777 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.1 --dport 3306 REDIRECT --to-port 7778 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.2 --dport 22 REDIRECT --to-port 7779 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.2 --dport 993 REDIRECT --to-port 7780 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.3 --dport 22 REDIRECT --to-port 7781 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.3 --dport 80 REDIRECT --to-port 7782 iptables -t nat -A OUTPUT -p tcp -d 10.10.10.3 --dport 443 REDIRECT --to-port 7783 That worked great for several years. I've got a script that can take a list of files that describe host:port combination and generate the ssh config, hosts, and ipfw or iptabes rules so it was easy to add or remove machines. It broke in late 2014 when I switch to MacOS Yosemite. Apple had switched to using PF in Lion in 2011 and deprecated ipfw, and removed it in Yosemite. By then we had an openvpn setup at work and I switched to using that.

carride 4y ago

Algo project still works well. Very quickly launch a WireGuard VPN to several popular cloud providers, or any Linux instance you already have access to, including your rPi. https://github.com/trailofbits/algo https://github.com/trailofbits/algo

byteflip 4y ago
Yes, I've been using this since I moved overseas. Works great, was able to add NextDNS for ad blocking. I still find some websites will block you as your traffic will be originating from a datacenter (if going cloud option like me), but most work. I find this setup also works for some services that do not work via VPNs such as Mullvad. If you want to talk to other devices check out the `BetweenClients_DROP` setting ("road warrior")

mdmglr 4y ago

I’ve recently built a VPN into my network using Cloudflare Zero Trust and Cloudflare Tunnels. Highly recommend over maintaining Wireguard or anything else. Much more comprehensive security controls.

fionaellie 4y ago

I use DietPi, which includes WireGuard and other things like PiHole. I've had my RPi 4 running without issue for more than 2 years, and can get 200mbps up and down.

fionaellie 4y ago

I quickly installed Outline on a free-forever Oracle VPS. This might be the best option for someone who doesn't want to buy a RPi, worry about SD card corruption, use any additional electricity at home, or spend any money. Even with the tiny free VPS provided for free, I'm getting great speeds of over 200mbps. And you can choose multiple locations to set up your free VPS.

samgranieri 4y ago

I'm using https://github.com/burghardt/easy-wg-quick https://github.com/burghardt/easy-wg-quick for this. It works beautifully. I simply port forward to my raspberry pi that handles all of this.

blipvert 4y ago

Taking an opportunity here for a completely shameless plug for an enterprise-y wg based corporate VPN. Uses mTLS for device auth, wg (obvs), OIDC to authenticate users/set up firewall access (Azure AD and Keycloak tested). Runs as a redundant cluster and can be hooked in via BGP. Very early and no docs to speak of yet, but raise an issue if interested. Works with standard WireGuard app on computers/phones, but an integrated app using the API might be in the works … https://github.com/davidcoles/gpn https://github.com/davidcoles/gpn

devaler 4y ago
Interesting and interested. I’ll be following, for the learning experience if nothing else.
- blipvert 4y ago
  Will update with some docs next week, then.

6451937099 4y ago

[dead]

6451937099 4y ago

[dead]

tristanb 4y ago

I run my own WireGuard VPN for my home devices, and I have had a hell of a time getting MDNS to work over it. I tried various reflectors and couldn't get them to work, has anyone made this simple?

sobkas 4y ago

For me HPE ProLiant MicroServer G10+ is better solution but I couldn't find wireless pcie card that reliable could be used as AP. I have QNAP QWA-AC2600 bought in Europe but Linux driver is crippled and sets regulatory region to US because ROM doesn't have it set properly. And there is no way to change it. Driver developers think it's a feature and won't revert it. I really appreciate that driver developers know better than me where I use hardware, but for now I don't want to use US settings in for example Poland. Or all frequencies are tagged as not for AP use. My question is, is there any pcie card that could be used as AP?

mlerner 4y ago

[flagged]

abtinf 4y ago
Please don’t do this here. From the guidelines: > Please don't use Hacker News for political or ideological battle. That tramples curiosity.