Hacker News Reader

Comment by justicz | Hacker News Reader

If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard!

[0] https://github.com/trailofbits/algo

View on HN

This. I can set up and connect to a new OpenVPN instance under my own control in less than seven minutes (5:59 last I clocked) from my phone.

Anyone can do this, it’s not nearly as complicated to launch and secure as some would have us believe. (https://github.com/jenh/sevenminutevpn)

You do lose anonymity with personal VPN, but it all depends on your use case.

But the problem remain the same. Whoever manages the network that hosts your instance will see your traffic...

Yes, it's not a perfect solution. You're basically deciding who you trust the least and avoiding just them.

You choose the business model to trust. VPN serve customers who to pay to be private. That seems like a high value target. ISPs serve connectivity, but apparently in the US, spying on their users is part of their core business and have strong local monopolies. Due to fierce competition and trust being pretty much one of the business requirements (I'd expect a lot more due diligence in b2b), hosting providers seem like the least big evil to me.

There are places that rent boxes for XMR if you want a hosting provider who doesn't have your information.

Any examples?

If you already have a DigitalOcean droplet up and running and you have ssh access, you can use sshuttle [0].

e.g. run this from the command line:

  sshuttle -r example.com 0/0 -x example.com --dns

[0] https://github.com/sshuttle/sshuttle

OpenSSH also includes a SOCKS proxy which you can use with no additional software: https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-fil...

Whether it grants you any significant anonymity is debatable, but it works well for evading content filters and tunneling your traffic onto a more trustworthy network.

Speaking from experience, sshuttle is way easier and more robust than using OpenSSH's built-in SOCKS proxy.

I use sshuttle all the time when working from "restricted" networks (car dealerships, airports, etc.) For some reason, my local Honda dealer has a guest WiFi that restricts outgoing traffic to a small number of ports, and apparently SSH isn't on that list, so I can't push/pull to GitHub. Firing up sshuttle on port 80 punches right through the filter and allows me to do real work while I wait for my oil change.

Another option is Outline VPN, Jigsaw/Google's open source implementation of Shadowsocks:

https://getoutline.org

https://github.com/Jigsaw-Code/outline-client

https://github.com/Jigsaw-Code/outline-server

Shadowsocks is more resistant to censorship from adverse actors (such as the Great Firewall) than OpenVPN.

Outline's user experience is the best I've seen among self-hosted VPN solutions, as it includes apps for both the server and the client. The server app is suitable for use in organizations, and can manage VPN profiles for multiple individuals.

It's an alternative for sure and has specific use cases, but calling Outline a VPN is disingenuous. It's just a Socks proxy with some obfuscation built in.

Shadowsocks handles all of the use cases of a VPN. When all of a device's internet traffic is routed through Shadowsocks, there is no functional difference to the user. This is the default behavior for all Outline clients (desktop and mobile).

There's also Streisand[0], that gives a lot more options.

[0] https://github.com/StreisandEffect/streisand

Came here to post this. I’ve been using streisand for a long time with no problems. I’ve given out logins to a few trusted friends / colleagues and all have had good experiences as far as I know.

Plus I really enjoyed learning about the in’s and outs of setting it up. I poke around in the VM just for giggles.

Ive done this but have found that most services (Netflix, etc) recognize DO as a VPN. Does anyone know of a hosting provider that isn't blacklisted but I can still setup wireguard on?

Run it on https://1984hosting.com. I've heard it's good although I can't attest personally.

The problem with this is that jumping out onto the net from a VPS-allocated IP causes all sorts of trouble for "normal" internet use. For example you won't be able to use Netflix doing something like this.

I can see why Netflix would try to block it, but I haven't run into any issues with it myself (OpenIKEd on OpenBSD on a $3.50/mo Vultr server as detailed here: https://www.snazz.xyz/how-to/2019/09/13/vpn.html). A lot of websites seem aggressive towards Tor users, but my VPS IP address was treated the same as my home, work, and LTE addresses. Are there any other documented cases I should be aware of?

Vultr is a lesser-known VPS, ymmv. I had issues with several websites using Linode. I don't have a list, but iirc it was some gaming related service that took issue with the IP.

Is Algo really 1 ip = 1 user? I always assumed multiple things could be running on one IP since IPv4 is getting scarce, but bare metal networking is not my expertise.

I use Algo for the exact reason you mention ("this lan is sketchy") and have been pleased, but I always assumed even if my traffic was mingling, one (possibly secret) court order would out me since I paid with a CC tied to my real name.

Nothing on this page or on the trailofbits blog article tells me why I should actually use this. Why should I trust DigitalOcean more than <insert VPN provider here>? Especially when it says "Does not claim to provide anonymity or censorship avoidance" - why would I use a VPN if it can't even attempt to provide some measure of anonymity?

Thanks for this. Just got it up and running in about 15 minutes (most of that was waiting on DO setup and scripts to run).

I was getting ready to paste the same thing; the command-line instructions make Algo, effectively, a somewhat technical solution, but it really does just work.

And for those who have used various VPN solutions over the years but not Wireguard: it really is pretty magic. It Just Works, with fantastic performance.

If you are looking to spin up your own vpn server with wireguard and pihole there is an excellent guide here https://drexl.me/guides/wireguard-pihole-vpn-setup.html

Reply on news.ycombinator.com