Ask HN: What do you use for your cloud VPN? | Hacker News Reader

Ask HN: What do you use for your cloud VPN?

11 pointscamjohnson2621 comments

I have a couple of servers running in digital ocean with some docker web applications on them. I want to block access to these web services from the public internet but allow them from the VPC network. The only out of the box solutions I see for digitalocean are proprietary apps like OpenVPN. WireGuard is a good alternative but requires a surprisingly high amount of configuration, and all the third party UIs are barely maintained.

I can’t believe this isn’t a solved problem so very curious what people are using to access VPCs. Preferably open source.

View on HN

> I have a couple of servers running in digital ocean with some docker web applications on them. I want to block access to these web services from the public internet but allow them from the VPC network.

What you need is a private network[1]. A private VPC will allow instances to communicate with each other, but to access them from the outside a "bastion host" is required. If you install a VPN in the bastion house and add the appropriate routes and settings, you'll be able to connect to your instances internally. This is the "proper" way to create a "private" network.

You could achieve the same thing using Cloud Firewall[2]. The cloud firewall supports droplet as a "source" definition.

UPDATE: You can create a private network using a shared VPN but it is an overkill if instances are on the same data centre.

[1]: https://www.digitalocean.com/docs/networking/vpc/#features

[2]: https://www.digitalocean.com/docs/networking/firewalls/#feat...

This is actually what I’m trying to do, just surprised that this step: “install a VPN in the bastion house and add the appropriate routes and settings” is taking a lot more manual configuration than I expected, was hoping for some out of the box solution in case I mess up a routing rule or network configuration. WireGuard is pretty good but still requires messing with iptables to forward the VPN traffic onto the VPC

I did not get that, sorry.

I would opt for routing instead of NATing if possible.

Have you considered AlgoVPN [0], I've not used it personally but heard positive reviews from those who have. They claim to be "set of Ansible scripts that simplify the setup of a personal WireGuard".

[0] - https://github.com/trailofbits/algo

Hmm didn’t know Algo used WireGuard under the hood. That’s cool but there’s no UI for adding clients, so I would still have to ssh into the server to download certificates and there’s a lot of commands to run, so at that point might as well just install wireguard manually. Wish they had a docker image and bundled something like WireGuard-access-server.

+1 for Algo.

I run this on an inexpensive AWS Lightsail instance. Trivial to move it between regions also.

Tailscale might be an alternative https://tailscale.com/

Thanks for the heads up on this, just switched over from a manual Wireguard install.

Cool!

Looks cool, and $10 a user a month is a lot better than OpenVPN access server which I believe is around $50 a month for more than 2 clients.

> WireGuard is a good alternative but requires a surprisingly high amount of configuration

Not really. It has a bit of a learning curve, but once you get past it it's actually a total joy to use.

But if you want something even simpler, I could suggest https://github.com/jedisct1/dsvpn

I thought OpenVPN was free, and cursory searching suggests that the "Community Edition" version is indeed GPL.

Are there features you need from the non-CE version?

All the docker images I’ve found are for openvpn-as, just want to keep configuration as simple as possible for security

Also thought it was free but the digital ocean app and the docker image both request a $700 a year license for more than 2 clients.

> I can’t believe this isn’t a solved problem so very curious what people are using to access VPCs.

I'm actually facing the same scenario, but I thought that a bastion ssh server between the VPC and the internet was enough. I'm totally new to these things, so could someone tell me the differences between a VPN and a VPC+bastion server?

Pretty sure a bastion server will work for ssh but not for web services

What about an LB sitting between the VPC and the internet?

Could work but I’d rather have it behind a firewall, stuff like Vault and Grafana

ZeroTier is another option worth looking at for your use case.

https://www.zerotier.com/

Wire guard on mullvad. They have OpenVPN support as well.

OpenVPN + PiHole on DigitalOcean

Reply on news.ycombinator.com