Hacker News Reader

Comment by CubicsRube | Hacker News Reader

Maybe a dumb question, but does anyone sets up their VPN server in the cloud? Could cheapest droplet on DigitalOcean [0] handle traffic for browsing or youtube?

[0] https://www.digitalocean.com/pricing/#standard-compute-trigg...

View on HN

I use a VPS at Hetzner, but a whole lot of traffic sites stop working when I am using the VPN.

I bet in part it is due to the CloudFlare's efforts to "Cleaning up Bad Bots" [1]. In this article under how they detect bots they write:

> Another model allows us to determine whether an IP address belongs to a VPN endpoint, a home broadband subscriber, a company using NAT or a hosting or cloud provider. It’s this last group that “Bot Cleanup” targets.

I suspect when use a VPN hosted on a VPS, you often end up classified as a bot to be cleaned up...

1: https://blog.cloudflare.com/cleaning-up-bad-bots/

Tried this, you will encounter a ton of sites that assume you are a bot. You will find it annoying to browse quite a few sites. Some will outright refuse to work.

I've never heard of this. Is this exclusively a Digital Ocean issue?

No, I run into this with my Linode also. Basically any of the large VPS providers and some of the smallest are well known to other services for being used to automate scraping or other things. Linkedin is a great example of one that (used to anyway, haven't tried in a while) completely block any IP that was known to be from a VPS provider.

Nope, this is pretty common. I found out the hard way that Delta doesn’t allow access to their servers from my cloud hosted VPN, which is shitty considering airports are pretty VPN-heavy locations for me. They don’t seem interested in reconsidering this stance either.

Get an ASN, get some IP space, and the issue is no longer a problem.

How does one go about doing that? Getting an ASN I mean?

Edit: did some reading [1]. Clearly it's not easy to get an ASN. Not something a private person would do.

1: https://www.apnic.net/get-ip/faqs/asn/

It can be done.

It's easy if you get sponsored. APNIC is not the only option.

I am personally looking at AFRINIC for their sweet IPv4 space :-)

IP space is getting pretty pricey these days, unless you want to go IPv6-only. And whatever the evangelists say, that's still to un-realistic for most people.

The smallest range that providers are willing to deal with are /24 (256 IPv4 addresses), and each IP is around $20, so that's a minimum of $5,000 [0].

But I only need one IP address, and I'm willing to pay $500 for it. Is there a way to make this happen?

[0] https://www.ipv4connect.com/products/-buy-ipv4-Arin-24/484

You can buy a single ip but it won't be routable on the internet. All major routers on the internet drop any routes smaller than a /24.

Find 256 friends?

Let's say I buy a /24 IP address block and port it to AWS. My friend Bob and I are both on AWS. Would it be possible to share some of my IP addresses with Bob in a secure way?

I know that VPC peering[0] is possible across separate AWS accounts, what I don't know is that:

1. Whether or not my /24 block is "compatible" with VPC peering or not

2. How to prove to Bob that I'm not potentially MitMing him (assign my /24 block to VPC1, peer with Bob using VPC2, and MitM between VPC1 and VPC2 since they're both under my control). Would creating an IAM user with read-only VPC permissions work for this?

AWS is just an example. I would be happy to do this at any major provider (AWS and GCP are the two I know that allows bring-your-own-ip).

[0] https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-p...

Yes it is, and using routing the IP can arrive everywhere in a tunnel, not just AWS.

You only need a good system administrator. I can get you in touch with friends who specializes in that. They will certainly recommend your /24 to be pointing to a more friendly provider of your choice, like one with a flat rate!

/24 with ASN -> friendly provider -> any ip goes where you want (digital ocean, aws, etc.)

But no, you can't prove you aren't MiM. Who has control of the /24 at any point could (ex: the 'friendly' provider)

I have been running wireguard through an AWS instance, so far at least I have had zero issues like you describe.

Can you make edits on Wikipedia? I used to be a big contributor there but can no longer easily contribute because they (understandably) blocked all common VPN IP ranges.

Not sure about the rules on the en wiki, but on the fr wiki you can ask for your account to bypass IP blocks in these situations.

That's because all the malicious actors have started doing that now so we routinely block ips from all common cloud providers.

My wireguard gateway is in the cloud (linode fremont). When I connect to it, the eventual gateway is my home router. If I were to use the VPS as my gateway, then my traffic would be blocked by all sorts of services.

Annoyingly, I have moved, and now have comcast so that brings problems. First, they tamper with DNS traffic. To combat this the resolver is unbound running on the Linode. This creates very occasional problems, usually in the form of a capcha. Additionally, comcast doesn't offer symmetric connections, so my VPN is slower than it should be (1Gbps/30Mbps is such a joke).

Not dumb at all. I'm doing this on a $5 droplet and it's faster than any of the commercial VPN's I'm currently paying for. It's a little less privacy protective than many VPN providers however - Digital Ocean will for example forward DMCA violation nastygrams they receive from content owners.

You'll get recapcha'd like crazy.

Also some e-commerce sites will refuse purchases when made from hosting-allocated IP ranges since it's commonplace for fraud.

At least for me on linode, it's less-bad than others I've seen. Google doesn't typically get nasty; I think I can only think of a few sites that are especially bad (linkedin and arstechnica forums are two that come to mind). That probably has to do with me using the same IP for ~2yrs now, so it doesn't have reputation problems.

I got a special deal at a VPS provider for $1/mo for 1vCPU and 256MB RAM. With only Wireguard running, I experience no issues whatsoever. RAM usage is minimal, sub 100MB, I forget the particulars. I added unbound with a huge DNS blacklist and unbound must do some odd indexing or something because that blew it to around 400MB which required a swap drive. But even with that, the performance is more than fine. I notice no discernible performance loss on my phone and from my 1Gbps connection at home, I see speeds that are comparable with saturating the network of the VPS (~200Mbps).

Can you share more information on the deal? Or is it something you managed to get specially?

It was a promotional deal and I haven't let the lease on the VPS lapse. I didn't know what to do with it at first, but it was too good of a deal to pass up.

Yes, I've been doing this for about a year on a $5 droplet and it's fine. I haven't had any issues with blocking (but maybe its the sites I visit)?

In fact, I also run a pihole on the same droplet, and that's fine too.

Yeah, if you don’t have a home network you want access to, a cloud server would do just fine.

Smallest droplet would probably be fine, if you’re not streaming 4K video. Same goes for the 1TB transfer limit.

I set one up using a free GCP instance and it's been working great so far. Would definitely handle your described usage and save you $5 a month

Aren’t static IPs now excluded from the GCP free tier?

https://github.com/rajannpatel/Pi-Hole-PiVPN-on-Google-Compu...

(I run OpenVPN and PiHole from a GCP micro instance)

A VPN server doesn't strictly need a static IP, you can use dynamic DNS.

Can you explain, or provide a link?

I’m a networking novice, but in my .ovpn profiles I provide, the IP is hard-coded.

Instead of an IP, you can use a domain. Then you can use Dynamic DNS to keep that domain pointed at your current IP (essentially, you run a small program on the same computer as the VPN server, that updates the DNS provider every time the IP changes).

Not quite yet. But also like another user said, DuckDNS

"Note: Starting January 1st, 2020, GCP will charge for VM instance external IP addresses. However, under the Free Tier, in-use external IP addresses will be free until you have used a number of hours equal to the total hours in the current month. Free Tier for in-use external IP addresses apply to all instance types (not just f1.micro instances)."

Isn't there a 1 GB limit on network traffic though?

That's true, I forget about that bc I use it so sparingly

"1 GB network egress from North America to all region destinations per month (excluding China and Australia)"

It should be absolytely enough. I'm using 256 MB extremely weak VPS (1 euro/month) for OpenVPN for few clients. It handles up to 100 Mb/s just fine.

Yes and yes, the $5 droplet is perfect for wireguard.

Reply on news.ycombinator.com