Hacker News Reader

Comment by bendiksolheim | Hacker News Reader

Roll your own! Setting up your own, private VPN can be done quite easily with https://github.com/jlund/streisand and a DigitalOcean account. Costs $5 per month. It doesn't require a whole lot of technical competence either, as the Streisand project configures just about everything for you.

View on HN

If you do roll your own, consider trying out WireGuard, the VPN protocol I've been working on. It's a lot faster and simpler than anything else. I'd appreciate all the feedback I can get. https://www.wireguard.io

I haven't take a look yet but will do soon.

If this can be used under ARM cpu and has smaller memory footprint compared to openvpn, I am going to use it.

Very often point of using VPN is to get away from one jurisdiction and censorship to a provider which offers endpoints in more countries. Getting own server with VPN basically puts a person under different jurisdiction, you're on you're own with supporting and maintaining it. Public-IP VPNs mix your traffic with other traffic and make single person harder to track. It requires a lot of specialized knowledge about protocols and encryptions, heart-beats, pings, system network buffers, setting up firewalls, will I ever need IPSec or PPTP? I don't know... I tried, learnt a lot and gave up quite quickly, too much stuff to handle.

~ Happy TorGuard and TigerVPN user.

What about when you need to update the box? How does it handle protecting and maintaining the vm? What if there is a critical vulnerability in either the client or the server, how will you find out?

I know i'm capable of running my own VPN, but I'd rather pay someone else to manage the details and I just get an endpoint I can connect to that will always work (and will be shut off if there is a major security problem).

unattended-upgrades is enabled by default, so security updates are handled automatically. You can also just destroy and recreate the box once in a while, without any extra cost.

But it is of course completely up to you. If you trust your VPN provider when they say they don't log anything, I guess you are fine.

If you want a VPN so that your activity is not logged, how will hosting your own under your own digital ocean account help you?

Sure, your activities may no longer be logged, but does that matter when 100% if the traffic coming from your droplet IP must be yours?

This is definitely a valid point. In my case, I share my VPN with friends and family, and also use it from a number of different devices (several laptops, and mobile devices). Anyway, the point is not necessarily to make it impossible for anyone to connect my internet traffic to me, but rather make it harder to monitor me.

That's great! Until something breaks.

Destroy the broken droplet and spin up a new one. I bet someone has written a cloud-init script so you never even have to login to the droplet.

But then you are responsible for the security of the server which you probably don't have a lot of time for.

A firewall is configured as part of this setup. unnattended-upgrades is also enabled, so security updates are automatically installed (which of course might be a security problem itself). If you are really paranoid, you can destroy and recreate the box every so often, as the whole process takes about 10 minutes.

And in some ways it reduces the chance of a security problem because VPN's with alot of users is a bigger target than one with just you.

If you're a student you can get the GitHub Student Pack (https://education.github.com/pack) with 50$ platform credit on DigitalOcean.

I'm using this with streisand, very very easy to set up.

What a GREAT idea. Thank you!

Reply on news.ycombinator.com