8 ms·
Quick VPN Setup with AWS Lightsail and WireGuard
- anshargal 3y agoI wrote a TUI tool (runs over SSH in a terminal) for managing simple WireGuard configuration on the server: https://github.com/andrianbdn/wg-cmd https://github.com/andrianbdn/wg-cmd You just run it on your server and it does most of things, including generating WireGuard keys for clients and showing QR codes.
- 2-718-281-828 3y agoyes, i do trust protonvpn more than german isps.
- thoughtsbykean 3y agocool. I'll give this a try on the weekend.
- jwsteigerwalt 3y ago“why they felt the anonymous VPN operator was more trustworthy than a regulated ISP”: - the VPN operator has never had an employee visit your home. - the VPN operator did not require any type of credit check and/or require extensive personal information. - the barriers to change VPN operator are substantially lower. I’m not a huge fan of the VPN operators, but there are real differences in the trust required with each.
- AviationAtom 3y agoYou not giving any personal data to Mullvad, only sending Bitcoin, doesn't really change that they can still potentially see any of your traffic entering and exiting their infrastructure, to include being able to connect your residential IP to a currently active session. Tor isn't much better, as security services have been able to gain enough control or surveillance ability to match traffic as it ingresses and egresses Tor, to then identify where the traffic originated from. With enough of a tinfoil hat you can perpetually be paranoid and chasing "anonymity" for a long while. It's really about what you're trying to conceal and what effort you put in to securing the infrastructure at the beginning and end of an end-to-end encrypted session, as well as the level of security of the end-to-end encrypted session itself.
- giolekva 3y ago[dead]
- aborsy 3y agoThis VPN setup is great to use in public WiFi. But be aware that the IP address may not be private in cloud instances. Is it known to what extent the traffic is logged on AWS EC2 or Lightsail?
- atomicnumber3 3y ago>traffic logging None! that's an enterprise feature, you'll have to contact sales for pricing
- jesuspiece 3y ago? VPC FLow logs exist, as well as load balancer logs
- slt2021 3y agoif you enable these features and pay for them? so just by not paying for these features will you get privacy naturally?
- aborsy 3y agoI guess your response indicates that the DNS records are not logged. I thought some metadata is logged, at least for security or to fight abuse, but probably for more reasons. But I’m not sure.
- rbanffy 3y agoNot necessarily. If you want to see the logs, you’ll have to pay for them. If your government wants them, they’ll probably get them for free.
- deleted 3y ago[deleted]
- lormayna 3y agoWhy not using an Ansible playbook? You can deploy it on any VPS without vendor lock in.
- brazzledazzle 3y agoMight be the only tooling they have experience using. “When the only thing you have is a hammer everything is a nail” sort of thing.
- deleted 3y ago[deleted]
- Nux 3y agoI didn't care about the AWS and zsh aspects of the article, but what vendor lock-in are you talking about and how exactly would an ansible playbook sort it? All you need is any ubuntu vps - in fact any systemd distro if you ignore the "ufw" commands - and the 50 or so lines following "Wireguard Setup". It doesn't get more simple than this.
- hejcloud 3y agoWell using the aws cli is locking you in to AWS, isn't it? And at least from my experience those "just 50 lines of shell" can get very messy overtime. Eventually, if you add more features (pretty much every project gets more features over time), you will refactor once or twice and end up rewriting it in Python, make it more declarative because it's easier to test and tada, you just reinvented Ansible yourself. I think this question is legit.
- MallocVoidstar 3y agoEasier to use https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- tyingq 3y agoDepending on the instance type, Lightsail easily gets throttled into oblivion. The $3.50/month instance allows for 5% utilization before you start eating up burst capacity. Perhaps WireGuard is light enough that it's okay, but thought it worth mentioning.
- Sohcahtoa82 3y agoLightSail instances are burstable t2/t3 instances under the hood. Which...those types of instances have their use. But the fact that AWS kind of hides the whole CPU credit thing in LightSail is a bit misleading.
- tyingq 3y agoYeah, it's documented, but it's fairly buried in a place where you'll only find it if you already know throttling exists for Lightsail. It's irritating when I read blog posts comparing Lightsail to other, normal VPS offerings because it's not very normal :)
- supriyo-biswas 3y agoYou’ll also discover it if you look around in IMDS, though that’s no excuse for not documenting the throttle limits.
- j45 3y agoLinode isn't too bad for a VPS instance - best ot make sure the IP isn't on many block lists, take your time logging into all your services through it and the rest can be generally smooth sailing. More and more cloud providers look for and block vpn's self-hosted with vps providers, in which case, finding access to residential connections (trading) or a provider is a way to go.
- LeoPanthera 3y agoLinode is now Akamai - and considerably more expensive than Hetzner, and you don't get all that much more for your money.
- thatcherc 3y agoFairly off-topic, but I've been having the hardest time finding a Wireguard configuration guide that lets me connect two peers (my phone and an SBC at my house behind my router) to a VPS peer (with a public IP) in a way that routes all the traffic from my phone through the SBC (via WG) and out to the internet via my home fiber connection. All the blog posts and tutorials I've seen have traffic going out through the VPS peer, with little explanation of how all the firewall and iptables commands might change if I wanted a different configuration. Has anyone seen a configuration like that, or know which networking concepts I should keep searching for to go in the right direction?
- nprateem 3y agoTailscale exit node.
- mutant 3y agoOr headscale.
- Nux 3y agoWhat is an sbc and the phone's relation to it?
- harry8 3y agoSBC - Single Board Computer. Raspberry Pi most famous example? https://en.wikipedia.org/wiki/Single-board_computer https://en.wikipedia.org/wiki/Single-board_computer In this instance consider the SBC a lightweight, low-power, always on server sitting behind his/her router.
- Nux 3y agoI thought it's a VOIP SBC, but don't know how those work to fully understand his issue, hence my question.
- renewiltord 3y ago
- WirelessGigabit 3y agoCareful with using a domain for this. If your domain has an A and an AAAA Wireguard will prefer the A. Which sucks on 464xlat networks, as the proxy dies after a while making you lose incoming connections.
- hejcloud 3y agoQuestion: Assuming PKI is "solved" (whatever that means) isn't mTLS in contrast to sth like a VPN the preferred solution nowadays? Or both? I'm asking because Wireguard itself looks a lot like mTLS to me and I'm curious how HN people currently see that context.
- tptacek 3y agoWireGuard is a better, safer protocol than mTLS. If you can use WireGuard, that's what you should use (often you can't, because you don't want IP addressing between your components).
- computerfriend 3y agomTLS is not a VPN.
- giobox 3y agoI've long given up hosting my own VPN on VPC/cloud providers as means of cheap and quick "browser in another country" hack - so many things block access to known VPC/cloud IP address ranges, especially AWS, and I was previously an advocate for just throwing up a cheap self-run VPN container somewhere too. The big advantage offered by many of the VPN vendors this article looks down on is the fact they can give you a residential IP in the target country - this can be a vast quality of life improvement for many browsing scenarios. ~5-6 years ago a self-hosted VPN exit node in AWS worked so much better than today in my experience, so many services have since added IP range blocks. This really matters for the common use case of trying to access TV streaming services in other countries, as one example. I still run a private WireGuard setup at home to take advantage of my personal residential IP, but that's only good for content in my home country naturally - still handy when traveling, or to get more secure access on public wifi.
- mcoliver 3y agoFair comment on getting a residential IP. I'm not necessarily looking down on commercial VPN providers. I do think a lot of their users don't understand the transfer of trust they are engaging in. As long as you understand that then great. Another benefit is that your traffic can be pooled with other users coming from an exit IP which can be useful (as opposed from a single endpoint you control as I wrote about in this article). Tradeoffs.
- aborsy 3y agoBut there is also the transfer of trust to the VPS provider, no? The cloud provider may have a less favorable privacy policy.
- AviationAtom 3y agoI think you touch on a valid point: we should be focusing less on where our traffic egresses and more on ensuring all of our traffic is end-to-end encrypted as much as possible, as well as ensuring any "meta data" (i.e. DNS) is encrypted too.
- noncoml 3y agoAnd then half of the websites are not working because they think you are a crawler/malicious user.
- josephh 3y agoDoes anyone know the latest on having WG support dynamically assigned IP for peers? There have been some work done[1], but it seems to have stalled for quite some time. 1. https://github.com/WireGuard/wg-dynamic https://github.com/WireGuard/wg-dynamic
- vegardx 3y agoThe stateless nature of Wireguard makes it kind of hard to implement. Having something DHCP-esque makes sense when you have an external mechanism for authentication, like most traditional VPN software does, but with Wireguard you have to exchange public keys with peers that communicate with each other, so you might as well just set up the IP at the same time.
- benr75 3y agoI built this to deploy a wireguard instance to your digital ocean account. Pick the region you want. It’s free, just pay digital ocean for the droplet… Https://vpn.democratize.cloud
- dangerboysteve 3y agoThere are also many scripts to automate the wireguard install and client setup and generate QR codes as well. Example: https://github.com/angristan/wireguard-install https://github.com/angristan/wireguard-install
- caseyf7 3y agoI’m surprised how many hotels block WireGuard now. I’m finding it harder and harder to do this.
- girishso 3y agoYes, I was surprised that internet stopped after connecting to OpenVPN at home. Had to use the mobile network.
- LeoPanthera 3y agoUnlikely they're doing packet analysis, and Wireguard can be run on any port. Just change the port.
- mmwelt 3y agoSuch hotels may simply be blocking UDP traffic entirely.
- aborsy 3y agoI’m curious, if we have a hub and spoke vpn, could we have peer to peer end to end encryption, with the exchange between them facilitated by an untrusted hub on a cloud instance? So, the phone wants to connect to a media server at home. In hub and spoke vpn, both connect to a vpn server. The problem is, the traffic decrypted on VPS. I want the packers from phone go to vps then to home, with end to end encryption. The VPS acts as a relay. The connection between peers need not be direct (peer to peer). The traffic could go through the central hub if needed. I just don’t want the hub to access the decrypted traffic.
- candiodari 3y agoIn professional settings what you're describing is more-or-less what DMVPN provides.
- no_time 3y agoYou basically described Tor.
- aborsy 3y agoMesh VPN is one way. The VPS node will be the coordination server. Tor is another, onion layers of tunnels. But maybe there is an easy networking solution, like creating a route table on VPS implementing a relay or STUN server , that says traffic coming from the peers public key is exchanged on VPS server.
- pluto_modadic 3y agomesh VPNs (tailscale, zerotier) are what you want :) tailscale will do the hole punching for you. :)