Item — HN Reader

+1 for tinc. I've used it for years in VPS providers and from home to VPS to cloak DNS from the ISP eyes and tampering.

It's not as fast as strongswan or wireguard, but it has dynamic mesh routing. If one of my nodes is down, I route through the others automagically, all in user space without having to enable forwarding on any nodes. This is handy when backbone providers are having issues.

3 comments

>I've used it for years in VPS providers and from home to VPS to cloak DNS from the ISP eyes and tampering.

what's the logic behind that? are vps providers somehow more trustworthy than ISPs?

In the UK residential ISPs are required by law to store logs of your browsing data, and to make it available to ~50 government departments with no warrant or any other kind of oversight required.

https://en.wikipedia.org/wiki/Investigatory_Powers_Act_2016

> In the UK residential ISPs are required by law to store logs of your browsing data, and to make it available to ~50 government departments with no warrant or any other kind of oversight required.

Super scary. It would be cool if someone currently working at one of those 50+ government agencies would make an AMA, maybe using a throwaway account.

It would be scary if it was true, but it isn't true, it's scare-mongering bollocks.

The sad reality of human nature is that if you give some people a power, sooner or later one will abuse it. I can’t think of a counter example.

I feel like this would be a bad idea seeing as their employers are in the business of watching your internet traffic and catching such shenanigans.

That's a dishonest misrepresentation of the law, and your link says so.

Could you be more specific as to where the poster is going wrong? Is it merely a correction that it's the domains stored and not the individual pages? (not that that's possible over SSL anyway). Or is there more to what you say has been misrepresented?

Definitely. Wikipedia says :

"required communication service providers (CSPs) to retain UK internet users' "Internet connection records" – which websites were visited but not the particular pages and not the full browsing history – for one year;[41]"

Which part do you believe I have misrepresented?

>are vps providers somehow more trustworthy than ISPs?

Random small providers from lowendtalk or whatever may not be, but yeah vast majority of hosting providers will be far more trustworthy than any residential ISP.

However, life tends to be much easier if you avoid VPS providers and just get a cheap dedicated server from somebody like OVH instead.

"just get a cheap dedicated server "

what does one consider to be "cheap" for a dedicated server these days?

Scaleway virtual private servers go for 3 euros monthly (US$ 3.68).

They asked for dedicated servers explicitly to avoid VPSs.

Kimsufi 7eur

10 euros.

> but yeah vast majority of hosting providers will be far more trustworthy than any residential ISP.

[citation needed]

1) Incentives, residential ISPs obviously have a far bigger incentive to try and monetize your traffic.

2) No lock-in for hosting products, way more competitive hosting market, hosting companies have incentive to provide better service than residential ISPs.

3) Residential ISPs tend to have a far bigger attack surface and less trained staff. I hacked many of the worlds biggest ISPs and hosting companies, the ISPs were always running Solaris from a decade ago.

One reason is that you and your ISP are almost certainly under the same jurisdiction. So your ISP is more likely subject to coercion by your government, compared with VPS providers in other jurisdictions. Further, you can choose VPS providers in jurisdictions where such coercion will not likely be successful.

It’s a good way to avoid traffic throttling as well. VPS providers are doing much different traffic shaping than an ISP.

But the VPN traffic itself may be shaped as well.

Absolutely. Depending on your use case, you can queue downloads to your VPS nodes, then prune out things you don't need and even compress data before pulling it to your home.

I agree, VPS providers don't inherently provide any added security or privacy.There's not much that would stop these providers from jumping at an offer to hand over your data for a pile of cash. If you want privacy, use Tor. If you want to beef up security, check SSL and URL before entering creds. If you need to evade corporate firewall rules, a VPN can do the trick.

For my use case, yes. My DNS requests are cached / forwarded on my VPS nodes. My ISP can neither see nor tamper with my DNS requests. I do something unorthodox and set a min-ttl both on my home linux router and on my VPS resolvers using Unbound DNS.

I should add that my ISP used to mess with my traffic ages ago, then laws changed to prevent that. Those laws were recently changed again, allowing ISP's to start mucking about again. Maybe they won't, but I will stick with my current traffic model.

You could just use a VPS, SSH and sshuttle. It does forward DNS requests through the tunnel as well.

Mostly the same feedback, though I’m curious on the performance differences you’re seeing with strongswan.

In my setups, strongswan seems to induce ~25% hit, compared to ~15% with tincd. I’m a noob with strongswan so I’m sure it’s something with my setup.

Are you also doing UDP encapsulation and any additional NAT's? I'm using transport mode on strongswan. I get about 3% overhead with strongswan and about 5% with tinc, but the throughput on tinc caps out much sooner for me than with strongswan when dealing with high RTT. It could be the tun driver in CentOS causing my issues, possibly.

Overhead over what, and at which line speed? 1 Gbit/s, 10 Gbit/s?

Tinc on bare metal hardware has pretty low CPU usage at 1 Gbit/s, but not so at 10 Gbit/s.

Interesting, I usually just ssh tunnel (I liked the idea of https://github.com/apenwarr/sshuttle/) but I like the idea of making things a bit easier on myself, gonna have to checkout tinc.

The apenwarr/sshuttle is abandoned - the current sshuttle, which is under active development, is here:

https://github.com/sshuttle/sshuttle

Highly recommended. Allows you to use any server running SSH as a VPN endpoint with no configuration necessary - you just need a working login.

Do you know if it has leak protection built in (prevent traffic when sshuttle's connection drops)? I can't see it mentioned in the documentation.

Thank you very much!