Comment by gonzo | Hacker News Reader

Comment by gonzo | Hacker News Reader

Parent Full thread

We're currently sitting a a version of pfSense 2.1 that can run on EC2. (Ob disclosure, I own over half of ESF, the company behind pfSense.)

Amazon said they didn't want anything powered by FreeBSD in AWS. There are currently negotiations about running on a larger instance that supports the HVM, and avoids the 'Windows tax', but there are significant usage fees for that tier (today that´s the cluster compute and M3 instances) as well.

We could release a variant of the AMI as a "public" AMI. It wouldn't be in AWS then, but it would be available. If your account is new enough, it would allow a completely free VPN service on Amazon's "free tier".

It would also allow people to setup their own VPN service (OpenVPN and IPSEC are both fully supported.) Hosting on top of EC2 isn't perfect (there are possible key recovery attacks from others hosted on the same infrastructure), but, correctly configured, Law Enforcement would need more than a pen register order to obtain anything beyond the enclosing IP packet data. Since, in theory, you would be your own provider, the FBI (or an equivalent in other EC2 zones) would have a higher burden to install even a pen register.

My question is: should we bother? Anyone with sufficient clue could setup a linux instance to do the same thing.

> My question is: should we bother? Anyone with sufficient clue could setup a linux instance to do the same thing.

You indeed could setup some basic stuff this way, but I wouldn't recommend it as a long term strategy. The way that our privacy product was built protected users from a variety of issues. I also wouldn't recommend using AWS for this till you can install your own trusted hypervisor and encrypt memory/disk/etc.

You can run on bare-metal providers like SoftLayer, which allows you run your own trusted hypervisor or OS. This, as you said, isn't currently possible on AWS.

Incidentally, PrivateCore has a trusted, remotely-attested hypervisor that encrypts memory and runs on providers like SoftLayer: http://www.privatecore.com

PrivateCore has some very cool stuff, I think they're one of the only solutions available right now.

Where did you hear that Amazon doesn't want FreeBSD on AWS? Colin Percival's postings on the matter seem to indicate otherwise however its just not very high on their priority list. Also I believe there are FreeBSD images in the Marketplace.

If you don't think we've been working closely with Colin, ... you're wrong.

We heard it directly from Amazon. To quote:

"After reviewing with our team and leadership, we will not be able to list the product in its current form. Only products built on supported file systems are allowed, and specifically we are not accepting any new FreeBSD products into Marketplace."

As I indicated above, we are continuing to work with them. The "supported file systems" is about the process used to build the AMI. (And yes, Colin uses exactly the same process.)

I figured you would have been working with him, I was just going off of what his older posts has said. I didn't know they had somewhat changed their policies.

BTW, thanks for the work on PFSense, while I don't use it at the moment, its been very useful in the past.

Before i got to the end of you comment I was going to suggest that anyone with an internet connection could do this. Indeed most home "nas devices" actually have VPN applications. I'm not familiar with more than a couple of commodity home wifi routers but i know some also carried this functionality.

I guess the issue with needing a VPN is that you need one far away from where you are geographically.

Maybe i have misunderstood the whole thing.

Depends on what your goal is. Consumer VPNs have been used for an assortment of reasons. Some of these you would need a VPN server that is close-by, while others should be far away:

0) Remote access to small business office 1) Connect to home router to access home network 2) To avoid ISP throttling of YouTube, etc 3) Download torrents, usenet 4) Commit crimes (routed through unallied nations) 5) To watch Netflix or Hulu from Europe ...

Yes, please. I'm cobbling together pfsense-on-aws for my own use and an actual pfsense-created AMI would be much nicer...

Well, get in touch. email address is in my profile here.

You'll want to put it in the public field, your email in your profile is not publicly visible.

thanks. fixed.

Reply on news.ycombinator.com