Hacker News Reader

Comment by omnicognate | Hacker News Reader

> Second, even if I installed a VPN on my main machine, what about my phone? My laptop? My desktop? Every device would need the VPN running, and I’d have to remember to connect it before browsing. It’s messy.

This is what routers are for. My router (a cheap fanless box with several network ports running linux) is the only thing on my network that knows there's a VPN. I can selectively route whatever I want through it, including having a separate SSID/VLAN from which everything is routed through the VPN. It's wireguard based so there's no "installing a VPN", just an interface/network configured in systemd-networkd (once, on the router).

Edit: Routing by domain name could be tricky, though. I haven't had a need for that, and a proxy with local DNS override (as in the article) might needed if it came to that. I'd still do it on the router, though.

View on HN

This is it. For years, I had a stable IPSec connection from Germany to the US, where packets would be routed selectively for the convenience of web browsing without geo-blocks. It was a bit excessive for what it did, but the technical challenge of trying it was worth it. [1]

[1]: https://du.nkel.dev/blog/2021-11-19_pfsense_opnsense_ipsec_c...

IPsec to be precise, not IPSec.

You can just use FoxyProxy instead of a separate browser instance. This firefox addon will use a proxy based on URL patterns.

You don't even need an extension - FF can do it natively via proxy file

You can do this in the configuration for Firefox containers too.

> This is what routers are for.

Useless in modern days though. IP addresses with anything backed by any cloud/CDN can vanish whenever they want, you'll always need to keep track of the upstream DNS responses.

That's extra fun if you do site-to-site-VPNs with a major customer. Won't name names, but they do have a habit of going through IP renumbering sprees every year or two and it's a true pain to keep the routing table, Zerotrust provider config and firewall rulesets in sync.

> a cheap fanless box with several network ports running linux

Do you remember the name of the product?

Two devices I use - both running Debian, and both being open-source hardware to some degree or other:

PC Engines APU2, AMD x86_64, 4-core, 4GiB, 3x Gigabit Ethernet, 3 x mini PCIe, SIM slot, USB 3, Serial, SATA ports. Mine has dual band WiFi in one mPCIe, SSD in another.

Turris Mox, Marvel aarch64. This can expand via plug and go via a range of extension modules. I've got one with 25 Gigabit (3 x 8-port modules) Ethernet, 1 x SFP, 5 x USB3, Wifi, Serial.

Just a heads up that PC Engines is winding down. The chip they use in the APU2 is EOL, and they've decided to shut down altogether.

https://pcengines.ch/eol.htm

Wildly ironic that an EU company doesn't ship to the EU.

Regulatory compliance shouldn't be hard. The idea is to quell negative externalities, not to shut off innovation itself.

> Because of unbelievably bureaucratic recycling regulations, PC Engines will NOT sell directly to end users within the EU.

https://pcengines.ch/order.htm

> EU - a single market ?

> Far from it, there are separate registration and recycling schemes for each of the 28+ EU member jurisdictions (and even a few of their provinces). What part of COMMON MARKET was so hard to understand for EU lawmakers ? Since there is no single registration available, and separate registration would involve mindboggling complexity, bureaucracy and costs, we do not sell to EU end users until the EU gets their act together. Please order from EU based distributors, or as a business customer.

> Business customers are expected to meet their obligations by registering in the EU countries they sell in.

https://pcengines.ch/recycle.htm

Being based in Switzerland, which is not a member state, PC Engines is not an EU company.

And in the end, 90% of people will throw it in the trash with everything else. I'm actually in the other 10%, but I live in the middle of a big city where I have electronic waste container like 300m away.

Btw, that's an awful website. I like simple minimalistic websites, but some people confuse "simple" with "give literally 0 fucks about the reader" and then I have 50-word long lines to read on my 32" monitor. Just put something like {max-width: 1200px; margin: 0 auto;} on the body at least.

You’re lucky. For people without cars anything other than curbside recycling is usually a nightmare. Ironically.

Yeah, that was my point, it's easy for me, but that's not the case for most people in the country. And I guess that most people living near me don't think about putting electronics in the dedicated container anyway, even if that container is near them.

> And in the end, 90% of people will throw it in the trash with everything else.

And if they don't, the "recycling" company will do it.

Reuse is dead.

> Wildly ironic that an EU company doesn't ship to the EU.

Switzerland is not part of the EU in this timeline... But their rant sounds very much like an excuse, the WEEE is in effect at least since 2021:

"All EU Member States are required to adopt the Waste Electrical and Electronic Equipment (WEEE) Directive 2012/19/EU, which sets rules for the collection, treatment, and recycling of electronic waste. However, some countries were granted an extension until August 2021 to meet the collection targets due to infrastructure limitations, including Bulgaria, Czechia, Latvia, Lithuania, Hungary, Malta, Poland, Romania, Slovenia, and Slovakia" - courtesy Google AI overview

Well maybe if they cared a bit more about customers they wouldn't be needing to wind down

Qotom is a good chinesium brand for small cheap fanless multi-NIC PCs: https://qotom.net

+1, have had 10/10 experience with my Qotom - in fact I had to look up the brand to be sure that was what I had. Forgettability (due to reliability) is exactly what you want in router hardware.

I like protectli boxes. x86, low power, coreboot options, lots of network interfaces. The apus everyone recommends (myself included) are no longer available :(

Not the poster you're responding to, but...

I'm running OPNSense on a GMKtec G9 (a N150-based NUC with dual 2.5Gbps NICs), and a cheap managed switch. All-in, you can get it today for well under $300. Even that is rather overpowered for running my house.

The toughest component to pin down was a mesh wifi system that supports tagging VLAN segments. That's almost exclusively enterprise territory, so it's hard to find something affordable.

Is there a mesh wifi system that can run open source firmware? I imagine that might be the best bet for VLAN tagging too in the "affordable" sense too.

Not that I'm aware of, and I suspect that the whole idea of mesh radio is necessarily so closely tied to the specific hardware that for this to be practical, there's have to be some canonical physical implementation available for developers to program to.

For what it's worth, what I settled on is EnGenius's FitXpress products. But I'm not necessarily recommending that, I'm a bit ambivalent to it. Within its normal operational envelope it works well, but its range is far lesser than the TP-Link device I replaced, and rebooting one of the WAPs in the mesh takes seemingly forever (like, 10 minutes!).

Also not the OP, but I use a NanoPi M5 for my home router. I've got OpenWRT (technically FriendlyWRT, but it's the same) running on it with Docker for running NgINX and PiHole.

https://www.friendlyelec.com/index.php?route=product/product...

You can do it like this, or (easier IMO if your router doesn't support it) you can just setup a raspberry pi as a VPN router then set you dhcp server on your router to hand out the RPIs address. You can then switch on to the normal connection at any point you need by just changing your default gateway back to .1

2GB Pi5 maxes out the 1Gb port.

my solution to this is to have centralised VPN splitter (x-ray/singbox) sitting on RPi, with tailscale attached to it. This makes it available from anywhere if the device is on TS network. With added benefit of rule based geo splitting to various zones.

Reply on news.ycombinator.com