(untitled)

Has anyone stood up their own VPN at home and what are your thoughts on how secure it is? Is it worth doing instead of having to pay for a service like Nord or PIA and are you able to encrypt your traffic yourself before it gets sent out?

You don't mean running a VPN off hardware in your home, do you? Because all that's good for is letting you securely connect to your home LAN remotely (which is useful if you have network shares or such). If you're aiming for anonymity then you'll have to rely on another machine somewhere else on the internet to route all your traffic through. Whether that's by paying for a service or by installing a VPN server on a machine in another location, that's up to you.

>>7189 I see, yea I don't need remote access to my network type VPN I'm looking to route/encrypt my traffic but I've seen people mention running OpenVPN on their own box or VPS but I don't get how if it's a box at home how the location is anonymized (if that's even a thing?) Sorry new to this..

>>7190 They might be suggesting running such a VPN on some VPS in another country to tunnel your traffic such that it only comes out from there. This could work for things like torrenting from Switzerland or something. It doesn't do much for your actual privacy, just keeps copyright trolls away.

setting up a vpn on a vps is good for some things, like encrypting all your traffic as far as the vps, and connecting to remote sites from an ip address other than your home ip. however, you're trusting the vps provider. i've done it before and it works ok. setting up a vpn on your home computer is pretty useless except for encrypted communication from a remote site to it.

Would'nt it be secure if I configured a home hosted VPN for some friends and my family so they can fill my network wirh regular traffic?

>>7199 sure, if you want secure incoming traffic to your home pc/lan. you could also use retroshare for that.

https://github.com/trailofbits/algo

>>7206 >Does not install Tor, OpenVPN, or other risky servers What did they mean by this?

depends what you want. obviously if you want to hide internet traffic from your ISP a VPN to your home doesn't do soykaf. you could put the gateway on a rented VPS if you really want to do everything yourself instead of using a VPN provider. personally, i use both. i have a nordvpn subscription that i use as an encrypted proxy and an openvpn server on my home router that i use to remotely access devices on my home network. it's not hard to do. key management is the most difficult part, but openvpn itself just takes some tinkering with a config file.

>>7207 What are you even asking? Are there two ways to read that?

>>7209 presumably >in what way is Tor/OpenVPN "risky"? i was wondering the same thing

>>7210 Tor relays (even Tor traffic) violates the AUP of a lot of VPS providers. OpenVPN has a huge codebase and attack surface. What they're trying to say though is that they're not Streisand.

>>7212 go back to fud school. you're not impressing anyone here.

https://gist.github.com/joepie91/5a9909939e6ce7d09e29

>>7217 /facepalm He wasn't trying to impress you. A lot of VPS providers don't accept tor relays in their ToS. Algo was trying to say that they are not like the Streissand project (also on github) as they don't install a huge amount of third-party scripts. A Tor relay can be risky in 2 cases; If you have a exit relay on your server, if someone do illegal soykaf online using tor and your exit relay, the IP of your relay will appear in the victim logs. It can be a big deal in some countries. Exit nodes get raided often. The 2nd case will be if you host a entry relay (entry node); if someone get infected with a ransomeware like wannacry, the victim's machine will try to connect to the Command and Control server of the attacker using the tor network and it can be your node. Police raided entry nodes in 2017 in France when Wannacry was around. So yeah, tor can be considered "risky". No one here is trying to sound smart, we're anonymous ffs no one cares.

(and they don't JUST raid you, they send you legal papers asking you to come in person most of the time. A "love letter". At least I know 2 countries that are doing it.)

Running a VPN from home is a mean to anonymize your connection. It's used so that when you connect to someone else wifi when you're out, it's like you connected to your own home wifi; thus being able to access your equipements at home.

>>7241 IS NOT ! I MEANT IS NOT A MEAN TO ANONYMIZE YOUR CONNECTION

>>7241 That prevents eavesdropping, nothing else.

>>7254 i didn't meant to write what i said, i forgot the 'not'

>>7209 Why is OpenVPN a "risky" server? Conflating it with TOR with no explanation how OpenVPN is risky is pure FUD. Is there another systemd hater club for OpenVPN? Do they have a terrible security track record? Is it a NSA product? What makes OpenVPN risky?

>>7268 Openvpn is cool do not worry. Now you don’t use Tor for the same things you would use openvpn for.

>>7269 Running a (non-exit-node) Tor relay is also not risky.

How is there no mention of WireGuard in this thread? I'm disappointed, lainons.

i do this. i use a VPN server that runs inside of my sister's house regularly. some people might say that's pointless, but actually it has extremely high bandwidth and data for a tiny fraction of the cost of a mainstream VPN that you don't even have total control of, and when i go to europe soon, my copious ****posting on /p*** will not actually get me *insert /p***-tier anti-EU joke here* thanks to my US-based VPN. however much we complain, sometimes the 1st amendment does actually mean something in the real world, from the outside.

>>7292 i read some article about wireguard a while ago. imo people exaggerate how difficult it is to set up openvpn, but wireguard did actually sound like an improvement. i haven't bothered trying it out because my openvpn setup still works fine. do you use it? how does it compare to openvpn?

>>7471 I should add: if you want to pay for a vpn service instead of (or in addition to) self-hosting, you're going to have very limited options if you need it to support wireguard clients. even vpn services that support openvpn are the minority.

>>7188 I have vpn on my router and it's safe like if you want to be safe while using public internet it's perfect. ofcourse it won't move you to other country or anyhing but for public internet totally safe

>>7188 I mean, I've stood up my own OpenVPN server. Didn't really benefit me other than a secure tunnel to my ESXi server, which is all I needed. If you want to be s00per l33t and make your own "h4ck3r vpn" out of "your" machines, I guess that's your prerogative, but ask yourself what benefit you'd have over just using SOCKS proxies. Not saying one is better than the other, but one is definitely less cumbersome to set up in a hurry.

>>7564 I don't see how public wireless networks are a problem these days when 99% of websites have encrypted connection, and other 1% are not worth phishing because they're abandonware hobby projects and totally not e-bank accounts.

>>7574 >getting mitm'ed is fine because the important things are encrypted Sounds like you need to get educated. http://gen.lib.rus.ec/search.php?req=the+browser+hacker+handbook

>>7208 What would be the drawbacks of setting up OpenVPN on a VPS like Digital Ocean?

>>7582 If both your DNS and other protocols are encrypted, and the initial bootstrap step of certificate verification has been done before, you'd normally just fail to establish any functional connections. Ignoring the possibility of either/all endpoints having been compromised.

>>7600 >if if if.... That's not what was said. >>7574 >I don't see how public wireless networks are a problem these days when 99% of websites have encrypted connection

>>7603 welcome to /sec/ >>7574 >neurosuggesting I mean, these aren't the days of sslstrip any more but it's not impossible... Hell, have you ever stood up a malicious AP? Creds nearly every time without fail.

>>7604 >have you ever stood up a malicious AP? >Creds nearly every time without fail. This is just a method of getting mitm. It doesn't address "99% of websites have encrypted connection". Are you illiterate or just don't know what you're talking about?

>>7582 Name a non-glow-in-the-dark adversary who would make my browser accept fraudulent certificates. If they can do this on rogue access points in some soykafty mcdolans, they'd have more success over doing it on very popular VPN service and end up catching some big fish, and if they target me specifically, a l33t hackerman who has his own VPN at home, why don't they mitm my home ISP instead?

>>7618 >Are you illiterate or just don't know what you're talking about? Oof, how toxic. I worded my response poorly but don't break your arm jerking yourself off. I was agreeing with what you said but my whole point was just that MITM is still possible by other means.(Always argue in good faith and avoid using personal attacks.)

>>7620 >Name a non-glow-in-the-dark adversary who would make my browser accept fraudulent certificates Just because "important" websites use TLS someone can still hijack your DNS and inject javascript in unencrypted pages and replace downloads with malicious files. Using a VPN still matters. >>7624 >being this autistic welcome to /sec/(Always argue in good faith and avoid using personal attacks.)

>>7642 How was that autistic? >I can't handle someone restating their point Please tsukichan yourself.

>>7642 Also modern browsers filter out mixed content, you fuarrrking retard. Please at least know what you're talking about before you try to be snarky.

>>7651 You made an impolite comment then chimped out when somebody responded in kind. A lack of social awareness on this scale is consistent with autism. >Also modern browsers filter out mixed content, you fuarrrking retard. Obviously they don't or you wouldn't get the scary "some elements on this page are not encrypted" warning but that's not the point. The point was that encrypting all the "important" sites doesn't make you safe because a skilled attacker doesn't need to inject content into an "important" webpage to ruin your day. The browser hacker's handbook liked from >>7582 is an entire book filled with things you can do to a webbrowser from a in a mitm situation regardless of "important" websites using TLS.

>>7654 That was in no way directed at you, or with any intent to be impolite. I do see how I sperged out, which was unnecessary. Moving on: >Obviously they don't or you wouldn't get the scary "some elements on this page are not encrypted" warning but that's not the point That's the entire point of segregating active content and passive content. https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content >The point was that encrypting all the "important" sites doesn't make you safe because a skilled attacker doesn't need to inject content into an "important" webpage to ruin your day. And? Of course it doesn't matter, I never argued you can't inject content when it's not encrypted. E.G. it doesn't matter at all that facebook is served over TLS if I can inject into another site being loaded over HTTP. My whole point was, unless you renegotiate SSL/TLS for clients you're MITM-ing, you won't be able to inject active content. Now I'm not saying people aren't dumb enough to ignore SSL/TLS cert warnings, it happens all the time. Inevitably If you do inject into active content by any means, then yes, you will have succeeded. None of this would be an issue if you use a VPN.

>>7690 >Starting in Firefox 23, mixed active content is blocked by default (and mixed display content can be blocked by setting a preference). Fair enough.

I pay 19 Canadian dollars a year for a vps, and I installed openvpn on it. I found a script that basically asked a few questions and configured it for me. I never use it though. Sorry no link.

I use a dVPN (sentinel), which does not have the main disadvantage of normal VPN, which is that you have to trust the company to not keep logs, etc. It is also possible to choose a node with an outgoing tor connection or (soon) multi-hopping, with each server belonging to a different person/organisation.

>>7188 Maybe set up a Raspberry Pi with openvpn and leave it at an internet cafe and then send your traffic to that.

>>7849 How do you keep the device powered and at the same time undetectable to staff/visitors? What steps do you take to make sure the police don't come straight to your frontdoor when somebody does find it?

machines like that use little electricity and little space, if it's a poorly managed public network interface, as many cafes' are, they probably don't really do anything, cause it's usually either a marketing stunt (minimum effort only on outage or sharing the password), or it's in a place where free internet access from cafe's is usual (moderate effort, probably don't do too much monitoring, maybe have periodic checks). either way, if it is set up to look like a 'normal person' (e.g. observing and mimicking 'normal' traffic, which will probably include limiting traffic to 'busy' business hours, using new link-layer adresses, and only for a short while, aleatory starting times, for aleatory time lengths, determined by the observed distributions. you'd probably have to schedule your traffic in advence, but you can always have your system pad the traffic with noise traffic if it's needed to avoid suspicion), then you'll be OK.