Hacker News Reader

Comment by jchook | Hacker News Reader

Gotta say, if you just want a VPN to work now, definitely check out Algo or Streisand.

You can get a VPN running in an hour or less. Algo even supports wireguard.

I currently have two VPNs — Algo Wireguard & iVPN.

Anecdotally the wireguard VPN rocks— crazy fast in every way, including connection/disconnection.

Sometimes YouTube is slow.. I just hop on WG and it’s fast again. I’ve achieved faster downloads via WG than my bare internet connection (thanks Linode!)

However, some points to consider:

1. If you use a VPS to host your own VPN.. you don’t gain privacy. Usually your IP can (mostly) still identify you. And your VPS company will hold you accountable for your traffic eg DMCA.

2. OpenVPN never borks my resolv.conf but Wireguard often leaves my DNS resolution in a state of confusion.

View on HN

> 1. If you use a VPS to host your own VPN.. you don’t gain privacy. Usually your IP can (mostly) still identify you. And your VPS company will hold you accountable for your traffic eg DMCA.

Unfortunately, the same can be said for your VPN provider, depending on the provider. They can (and more than one does) save your name, address, billing details, as well as your source IP, and which IP and source ports you appear as after VPN translation has occurred.

Even if they don't do this, traffic analysis by the underlying network provider can de-anonymise your VPN'd traffic from your original source traffic too, and it doesn't take a genius to do this either.

"2. OpenVPN never borks my resolv.conf but Wireguard often leaves my DNS resolution in a state of confusion."

Checking the source... excerpt from src/tools/wg-quick/openbsd.bash:

   set_dns() {
   [[ ${#DNS[@]} -gt 0 ]] || return 0
   # TODO: this is a horrible way of doing it. Has OpenBSD no resolvconf?
   cmd cp /etc/resolv.conf    "/etc/resolv.conf.wg-quick-backup.$INTERFACE"
   cmd printf 'nameserver %s\n' "${DNS[@]}" >    /etc/resolv.conf
   }

We're doing something better on other platforms. But for OpenBSD I'm not entirely sure the best way. Suggestions welcome.

did you check what openvpn does? I would assume they have something at a local maximum.

My default-config Streisand server was compromised according to Vultr. Just a heads up because VPNs can’t really afford this.

Compromised due to Streisand being vulnerable or what?

Do you have further details? I mean this could be your server having SSH open and a weak root password, or it could be an exploit which hit Streisand, but we can't tell which ..

Per the sibling comments, I'd definitely like to know more detail. I rely on Streisand when in China and so if it's something to do with Streisand itself then I want to be aware of that.

Replying to myself, I accepted what Vultr had to say and killed the server. Wasn’t really worth me investigating too deeply and I took them on their word.

I did the default Streisand install with all services, and disabled password based login on the box (keys only).

It seems Streisand has some issues updating some components according to their issues board and it seems like the maintainer might have abandoned it.

Next time I’ll probably use algo instead. I just need wireshark anyways ;)

I managed to get StrongSwan IPSEC going in about an hour...

But then I'm looking for a configuration that allows me to route all my traffic via home from wherever I am, not a solution that allows me to route my home traffic via a third party.

Wireguard sounds interesting, and I'm going to learn more about it, but I like where I am with StrongSwan and just being able to issue a new certificate for a new device, and run with it.

I flagged the slow YouTube issues to iVPN (openvpn) previously but got palmed off by support, otherwise they offer an excellent service.

We've been working on a Windows version for the past few years, same idea - instant connection/disconnection, crazy fast, modern encryption. Uses only 10% of a single server cpu at gigabit speed. Almost finished, just adding in encryption for TCP (UDP and DNS already done). Shameless self promotion: https://www.firetrust.com/products/hideaway-secure-unlimited...

Do you mean that your product is built on wireguard?

No, it's not, it's our own implementation (except for the encryption part of course). We did a version similar to how Wireguard does it (UDP only) a few years back, but ran in to issues, so we ended up re-doing it with some different optimizations and UDP and TCP.

Reply on news.ycombinator.com