Hacker News Reader

Comment by alistproducer2 | Hacker News Reader

I guess it depends on what you're using your VPN for, but I prefer to run my own VPN on a vps. I use vultr and pay $5/mo. I also get to host a collabra server for my nextcloud setup on the same server so it just makes economic sense to use a vps rather than paying $5/mo (or more) to just get a VPN and also not have control of my data.

View on HN

There is a slight problem with this strategy if you are running a VPN to avoid tracking, as you have a static exit IP in your name which only you use.

VPN providers usually have multiple IP and often many users coming from the same one.

Are you guys vpn’ing on your phones too? Do you just use the built in vpn connection profiles? I’m having trouble getting mine to stay connected to a plain old IPSec tunnel running on my raspberry pi and thinking I probably need a special client for “always on” to work.

I use Wireguard on both mobile and laptop, setting it up is easy and fast (with my Ansible playbook it's just play then get configs).

Wireguard is its own protocol separate from IPSec or l2tp right?

On iOS the only way I found for “always on” to work well was with the IKE protocol using the built-in VPN client. I set up a cheap Vultr VM and used this:

https://github.com/jawj/IKEv2-setup

One caveat: Reconnects worked poorly until I disabled the iptables rate limiting the script imposes.

Outside of that, it’s worked really well. I pointed the VM’s DNS at Adguard so I get some good filtering as part of it.

I'm trying wireguard at the moment for the always on feature. Setup was absurdly easy.

Cool. When I set my VPN up, Wireguard didn’t do iOS yet, but I’m interested in it. Please post back to this thread with a short experience report, if you wouldn’t mind. :-)

So far it's been really good. It's very good at staying on all the time and it was really easy to setup. Right now it's running on a raspberry pi but since I took down my ipsec vpn container, my ram/temp/cpu usage has gone down quite a bit.

I still need to spend a minute configuring things like dynamic dns in case my IP changes but I'm really impressed right now.

Thanks! Just ordered an Rpi4 for home routing duties, I’ll give it a try there first.

Btw, I also highly recommend a case cooling case for the rpi4. I got the aluminum one at https://flirc.tv but I think anything like it will do. It dropped the idle temperature by quite a bit. I think it went from ~75ish to about 45

Good call. Those are pretty cases.

I saw some tests indicating open+fan really dropped temps vs closed+fan so I ordered one of these: https://www.amazon.com/dp/B01LXSMY1N

I'd be curious to see what the idle temperatures land on.

The problem with this is that it quickly gets expensive when you have more than a little traffic. Most VPS up to 5$/month only include 1 TB, so if you need more than that you have to pay more.

Do you have a puppet or bash script for that process?

How about an ansible script? https://github.com/StreisandEffect/streisand

I think algo is considered to be the best solution for this: https://github.com/trailofbits/algo

Agreed - I consider it more of a general purpose VPN (and what I use personally). Streisand is more opinionated, in ways that folks that use Proton services might find appealing.

I maintain this script: https://github.com/Nyr/openvpn-install

It's a simple bash script which just gets the job done fast, without dependencies or too much trouble.

Reply on news.ycombinator.com