Hacker News Reader

Comment by olalonde | Hacker News Reader

If you're serious about using a VPN, I strongly recommend getting an OpenWRT capable router and setting up your VPN there. Some benefits:

- It's physically impossible for your devices to bypass the VPN.

- It also works with devices that have poor or non existent VPN support (e.g. Roku, smart TV, etc.).

- You only have to configure it once vs having to configure it on all your devices.

- You can easily and quickly toggle the VPN by switching to a Wifi that doesn't have VPN setup.

I've been using GL.iNet's travel routers for many years and can't recommend enough (no affiliation other than being a customer). Just ordered their new Beryl router[0].

[0] https://www.gl-inet.com/products/gl-mt1300/

View on HN

Unfortunately the web is harder and harder to use with VPNs. So many websites just completely block you for using them, including etsy and Craigslist off the top of my head.

Also some non-web services can act weirdly with them. In my personal experience Google's voice to text including Assistant commands and transcription often just fails to go through, or takes tens of seconds to get a response over a VPN.

Just curious, how do they detect the fact that the connection is from a VPN? Are they subscribing to IP blacklists, or is there some other method?

Yes, it's IP blacklists AFAIK.

And for sites with a lot of traffic, you probably don't even need an external subscription, you can deduce the ranges yourself simply by checking for IP addresses that wind up having logged-in users from all over the world in a short time frame.

Pretty easy to do accurately with a short set of heuristics.

Many geo-ip services also offer VPN or server detection (e.g. is the IP in one of the EC2 ranges).

In a previous job at an online gambling company we found that a large percentage of fraudulent user accounts came from VPNs so ended up banning them at the geo lookup stage.

Easy. How many users are logging in from the same IP address is a big clue.

IP addresses are assigned in blocks, and these blocks are assigned to registered companies - Long story short you can roughly determine whether an IP address is from a datacenter or is "residential" without too much issue - All DigitalOcean droplets are given IP addresses within DO's range for example.

Basically if the IP is from a datacenter - it's likely a VPN.

Because unfortunately bots hide behind them in mass and the easy way of handling that is to block the VPN ips.

I assume you mean a "Proxy as a Service" when you say "VPN," right?

Without that focus, web sites would have a lot of trouble identifying IP traffic routed over a personal VPN from any other traffic. I suppose they could just block entire clouds, for those who run VPN servers on AWS, Azure, et al. But that would cause a lot of other problems.

I just route all of my devices through a single node I run at one physical location that appears like a genuine client node. I've never seen anything blocking it.

The one specific example I'm aware of is Delta Airlines seemingly blocking traffic that exits from my Digital Ocean droplet running OpenVPN... a service that, annoyingly, I mostly use when I am traveling and on public access points.

This has to be a false statement. Some sites blacklist subnets they believe to belong to VPN services, that's true. No web site has the information to know the difference between a tunneled packet and a non-tunneled packet. They could try looking at MTU but then they'd block all sorts of "legitimate" traffic due to use of PPPoE and so on inside ISP networks.

Is this true for self-operated VPNs? I run an openVPN instance on an old laptop in my apartment that also handles a pi hole instance and a minecraft server -- I'd think that any "VPN blocking" could apply to VPNs as a service, but not a VPN that I rolled and hosted myself.

You never get captchas and other annoying "security" measures when using openvpn? I get them all the time, but I assume that it's because the IP addresses are from mullvad and not as trusted as your ISP. What you have is a good setup for working in various untrusted environments but it's not the same for those people who do torrenting or say skipping past oppressive governments where they're trying to be anonymous via VPN.

I'm self-hosting a VPN server on Digital Ocean, and whenever I'm using it, some websites notice that my IP address belongs to a hosting provider, so I start to get lots of CAPTCHAs. So yes, at least Google and Cloudflare detect that.

> You can easily and quickly toggle the VPN by switching to a Wifi that doesn't have VPN setup.

I feel like "quickly" and "easily" a little overstated. Then again, this is someone who is willing to install their a separate firmware on a router, so...

Once you have it set up, toggling it would just involve connecting to a different SSID. That's pretty quick and easy; two or three mouse clicks in most OSes I've used.

Yes, setting it up in the first place may be fairly involved.

Second this. I have the same router and it's extremely easy to setup, and it supports Wireguard out of the box, which I love for its simplicity. It has a simple interface on top of openWRT, for non-experts like me. Support is a bit crap as it's all in Chinese but it works like a charm.

I have to chime in with a third; I have been very happy with my AR300M from the same supplier for the last CPI years and I am planning on a new one from them soon.

I used my router for this purpose until recently. It was difficult to keep up with updates, partly because openwrt versions for my router lagged other versions for long periods.

I replaced my router recently and changed my strategy. Now the router is only a router (and firewall of course).

I have a raspi sitting next to it providing the wireguard vpn. This is easy to update and everything actually works better than in past. I attribute a large part of that to wireguard over openvpn, though...

I've done that a few months ago on an ubiquity router. Two VLANs, one with normal access and one with a Wireguard tunnel into my self hosted dropplet that also runs pihole. Works like a charm.

> I strongly recommend getting an OpenWRT capable router and setting up your VPN there

Double it, OpenWRT functionality beats any production router firmware. Bought Linksys some time ago, now searching a cable to flash OpenWRT on it 'cause original firmware feels crazy dumb.

It's better to go with something like a $150 Intel NUC running pfsense (free) to connect to the VPN because the vast majority of Wi-Fi routers don't have enough CPU to decipher 256bit AES encryption in real-time. Once you fire up the VPN on even a top-tier router, you're likely to see your overall connection speed drop to 15 mbit/sec or less. A cheap NUC has no problem doing 256bit AES at 200+ mbit/sec.

So, is it easy to set this up using a phone when you get to a hotel, for example? Do you simply select the hotel wifi to use?

No, it is not easy. It is messy, the codebase is showing its age, configuration is a nightmare, and throughput overall is pretty shit with so many layers of unoptimized linux piled ontop of hardware that was never optimized to handle this type of packet generation and mangling.

> and throughput overall is pretty shit with so many layers of unoptimized linux piled ontop of hardware that was never optimized to handle this type of packet generation and mangling

That's a very broad generalization. I use a https://pcengines.ch/ based router with openwrt and mullvad as my VPN and performance is very close to non-vpn traffic.

Sure, if you run your VPN on bad hardware you might get bad performance but that is not true for everyone.

I have a similar setup with a travel router running OpenWRT and it is as simple as connecting to the hotel WiFi.

I'm almost never looking for all my devices to be going over VPN. Rather it's generally one one device at a time and even within that I'd often prefer it to be one app at a time. I have run a VM with the VPN only running in the VM but the overhead of the VM itself is not worth it.

I've tried this approach but often i would find traffic going down - especially YT and occassionaly router would crash. Frankly it's like 5 years old now. Are there any modern routers easily handling VPN?

Linksys LRT224 has been great for me, I run a permanent VPN to my aws resources.

I don't think age is factor here, routers shouldn't "crash" just because you push some bits through it, 5 years old or not.

Except, what’s crazy is that they do. I have an ISP-provided Xyzel C1100 modem, and sometimes it does just randomly crash and take about a minute to reload if we’re doing to much. I’d buy a good DSL modem, but it happens just under the threshold where I’d buy a $100 modem to fix it.

Except they do.

And I have no idea why either, just like you said, passing bit around.

They are often not actively cooled and not build for high CPU usage and the heat that generates.

In my experience, stay away from consumer routers and a lot of these sorts of issues go away. Even something as simple and inexpensive as Ubiquiti is miles ahead of anything in the consumer space. I haven't had a router issue in years. And I use VPN every day.

I use OP's router (https://www.gl-inet.com/products/gl-mt1300/) and it supports Wireguard out of the box and so far it worked very well (used it for 2 months).

how do you do that for a multiple VPN setup (for work obviously) and that would need to route the connection to different devices, while working only during office hours and take into account the usual MFA crap?

How well do they deal with IPv6 ?

For some proprietary software at one of my jobs we had to disable IPv6 for it to work.

>It's physically impossible for your devices to bypass the VPN

It's not true. There are bugs and vulnerabilities, some of them can be exploited remotely. OpenWRT is no exception here. Better than many maybe, but not invulnerable.

And please, let's stick to professional terminology and call these "VPNs" what they are - transparent L2/L3 proxies.

Bugs and vulnerabilities are an ever-present thing. You don’t really need to mention them when making a statement like the parent’s.

Also I don’t think your terminology is really all that helpful. These services are literally VPNs. Trying to make a distinction doesn’t really add anything when VPN is already an established well understood term. This just adds confusion when there are already L3 proxies.

Reply on news.ycombinator.com