4 ms·

We're currently sitting a a version of pfSense 2.1 that can run on EC2. (Ob disclosure, I own over half of ESF, the company behind pfSense.) Amazon said they

by gonzo 13y ago

We're currently sitting a a version of pfSense 2.1 that can run on EC2. (Ob disclosure, I own over half of ESF, the company behind pfSense.) Amazon said they didn't want anything powered by FreeBSD in AWS. There are currently negotiations about running on a larger instance that supports the HVM, and avoids the 'Windows tax', but there are significant usage fees for that tier (today that´s the cluster compute and M3 instances) as well. We could release a variant of the AMI as a "public" AMI. It wouldn't be in AWS then, but it would be available. If your account is new enough, it would allow a completely free VPN service on Amazon's "free tier". It would also allow people to setup their own VPN service (OpenVPN and IPSEC are both fully supported.) Hosting on top of EC2 isn't perfect (there are possible key recovery attacks from others hosted on the same infrastructure), but, correctly configured, Law Enforcement would need more than a pen register order to obtain anything beyond the enclosing IP packet data. Since, in theory, you would be your own provider, the FBI (or an equivalent in other EC2 zones) would have a higher burden to install even a pen register. My question is: should we bother? Anyone with sufficient clue could setup a linux instance to do the same thing.

easytiger 13y ago
Before i got to the end of you comment I was going to suggest that anyone with an internet connection could do this. Indeed most home "nas devices" actually have VPN applications. I'm not familiar with more than a couple of commodity home wifi routers but i know some also carried this functionality. I guess the issue with needing a VPN is that you need one far away from where you are geographically. Maybe i have misunderstood the whole thing.
- dismiss21x 13y ago
  Depends on what your goal is. Consumer VPNs have been used for an assortment of reasons. Some of these you would need a VPN server that is close-by, while others should be far away: 0) Remote access to small business office 1) Connect to home router to access home network 2) To avoid ISP throttling of YouTube, etc 3) Download torrents, usenet 4) Commit crimes (routed through unallied nations) 5) To watch Netflix or Hulu from Europe ...
rsync 13y ago
Yes, please. I'm cobbling together pfsense-on-aws for my own use and an actual pfsense-created AMI would be much nicer...
- gonzo 13y ago
  Well, get in touch. email address is in my profile here.
  - X-Istence 13y ago
    You'll want to put it in the public field, your email in your profile is not publicly visible.
    - gonzo 13y ago
      thanks. fixed.
bifrost 13y ago
> My question is: should we bother? Anyone with sufficient clue could setup a linux instance to do the same thing. You indeed could setup some basic stuff this way, but I wouldn't recommend it as a long term strategy. The way that our privacy product was built protected users from a variety of issues. I also wouldn't recommend using AWS for this till you can install your own trusted hypervisor and encrypt memory/disk/etc.
- sweis 13y ago
  You can run on bare-metal providers like SoftLayer, which allows you run your own trusted hypervisor or OS. This, as you said, isn't currently possible on AWS. Incidentally, PrivateCore has a trusted, remotely-attested hypervisor that encrypts memory and runs on providers like SoftLayer: http://www.privatecore.com http://www.privatecore.com
  - bifrost 13y ago
    PrivateCore has some very cool stuff, I think they're one of the only solutions available right now.
oijaf888 13y ago
Where did you hear that Amazon doesn't want FreeBSD on AWS? Colin Percival's postings on the matter seem to indicate otherwise however its just not very high on their priority list. Also I believe there are FreeBSD images in the Marketplace.
- gonzo 13y ago
  If you don't think we've been working closely with Colin, ... you're wrong. We heard it directly from Amazon. To quote: "After reviewing with our team and leadership, we will not be able to list the product in its current form. Only products built on supported file systems are allowed, and specifically we are not accepting any new FreeBSD products into Marketplace." As I indicated above, we are continuing to work with them. The "supported file systems" is about the process used to build the AMI. (And yes, Colin uses exactly the same process.)
  - oijaf888 13y ago
    I figured you would have been working with him, I was just going off of what his older posts has said. I didn't know they had somewhat changed their policies. BTW, thanks for the work on PFSense, while I don't use it at the moment, its been very useful in the past.

by gonzo 13y ago

easytiger 13y ago

Before i got to the end of you comment I was going to suggest that anyone with an internet connection could do this. Indeed most home "nas devices" actually have VPN applications. I'm not familiar with more than a couple of commodity home wifi routers but i know some also carried this functionality. I guess the issue with needing a VPN is that you need one far away from where you are geographically. Maybe i have misunderstood the whole thing.

dismiss21x 13y ago
Depends on what your goal is. Consumer VPNs have been used for an assortment of reasons. Some of these you would need a VPN server that is close-by, while others should be far away: 0) Remote access to small business office 1) Connect to home router to access home network 2) To avoid ISP throttling of YouTube, etc 3) Download torrents, usenet 4) Commit crimes (routed through unallied nations) 5) To watch Netflix or Hulu from Europe ...

rsync 13y ago

Yes, please. I'm cobbling together pfsense-on-aws for my own use and an actual pfsense-created AMI would be much nicer...

gonzo 13y ago
Well, get in touch. email address is in my profile here.
- X-Istence 13y ago
  You'll want to put it in the public field, your email in your profile is not publicly visible.
  - gonzo 13y ago
    thanks. fixed.

bifrost 13y ago

> My question is: should we bother? Anyone with sufficient clue could setup a linux instance to do the same thing. You indeed could setup some basic stuff this way, but I wouldn't recommend it as a long term strategy. The way that our privacy product was built protected users from a variety of issues. I also wouldn't recommend using AWS for this till you can install your own trusted hypervisor and encrypt memory/disk/etc.

sweis 13y ago
You can run on bare-metal providers like SoftLayer, which allows you run your own trusted hypervisor or OS. This, as you said, isn't currently possible on AWS. Incidentally, PrivateCore has a trusted, remotely-attested hypervisor that encrypts memory and runs on providers like SoftLayer: http://www.privatecore.com http://www.privatecore.com
- bifrost 13y ago
  PrivateCore has some very cool stuff, I think they're one of the only solutions available right now.

oijaf888 13y ago

Where did you hear that Amazon doesn't want FreeBSD on AWS? Colin Percival's postings on the matter seem to indicate otherwise however its just not very high on their priority list. Also I believe there are FreeBSD images in the Marketplace.

gonzo 13y ago
If you don't think we've been working closely with Colin, ... you're wrong. We heard it directly from Amazon. To quote: "After reviewing with our team and leadership, we will not be able to list the product in its current form. Only products built on supported file systems are allowed, and specifically we are not accepting any new FreeBSD products into Marketplace." As I indicated above, we are continuing to work with them. The "supported file systems" is about the process used to build the AMI. (And yes, Colin uses exactly the same process.)
- oijaf888 13y ago
  I figured you would have been working with him, I was just going off of what his older posts has said. I didn't know they had somewhat changed their policies. BTW, thanks for the work on PFSense, while I don't use it at the moment, its been very useful in the past.