If you’re worried about your VPN provider but you can trust your VPS provider, try an SSH Tunnel.
https://joeldare.com/ssh-tunnels-my-vpn-alternative-for-priv...
back
5 comments
This is the way: SOCKS5 via SSH
You do need some minimal technical understanding and some scripting.
Pick any cloud provider that can give you a VM with SSH access.
Read up on doing this on your local device or another device on your LAN:
ssh -NT -g -D 10001 -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5 -i your_ssh_private_key your_cloud_login@any_cloud_provider_ip
Now read up on how your browser points to a SOCKS5 proxy. For Firefox, I create a separate profile. For chromium based, I use the command line.
You are now virtually located to whatever region you chose for your VM.
I mentioned some scripting. It's simple enough that I have a /bin/sh script to spin up the VM, set up the SSH SOCKS5 proxy, launch the browser, then spin the VM down when the browser exits.
> For Firefox, I create a separate profile.
Firefox supports per-container (and as such per-tab) SOCKS proxies, which I find really useful.
So useful, in fact, that I've come full circle and I am now running a userspace Wireguard to SOCKS proxy [1] in order to have that convenience for a VPN which does not have any host I could SSH to.
If you're using Tailscale you can install it on your Apple TV (if you also happen to have one of those devices).
Now you can use your home connection as a proxy through wireguard when traveling.
Tailscale is great, but by itself is the wrong tool for the task of routing traffic over some host only for a single browser tab (but to all destinations for that browser tab), as it seems to be "all or nothing" when it comes to using a remote exit node.
It's probably possible to set up a local SOCKS proxy that knows to use some Tailscale non-exit-node for egress, and to manually allow that traffic within Tailscale and on the remote node, but not out of the box as far as I can tell.
Installing a SOCKS proxy on the remote node, reachable only over Tailscale, would be an alternative, but that doesn't work on an Apple TV.
Major issue I faced in this method is the network egress costs the cloud providers charge. I had to remind myself not to accidentally land on YouTube or some other video streaming sites.
Are there any cloud providers who don’t charge for network egress?
> Major issue I faced in this method
Biggest issue regular user might find with this is that basically all the VPS host' IP ranges are known, and plenty of websites give you a different (worse) experience compared to when using residential addresses, or straight up block you.
Personally I found the hassle to great, compared to using existing VPN services.
Exact same experience here. In the 2010s I ran my own VPN exit node on a dirt cheap VPS so I could access streaming content in my country of birth. Worked great for years, but nowadays so many sites simply block non-residential IP ranges that I gave up ages ago now.
It's a shame because deploying WireGuard was a simple two command process: git checkout followed by a `docker compose up -d` for me etc on a fresh VPS instance.
Yes, but search for "VPS" instead of "Cloud". "Cloud" is a marketing buzzword used to make people pay 10x-500x more than they have to. Although VPS providers are catching on, and starting to label their VPS services as "cloud" now.
Many! OVH has unmetered plans, for example.
Has anyone benchmarked this against running e.g. Wireguard and how it is, performance wise? I'd expect Wireguard to be faster, but don't really know.
VPS tunnels have their place, but they have one major downside: Your outward-facing IP address will (most likely) be static. And because you are the only one using that VPS, it is easy to link your internet activity across different sites. If you want to use this method to protect your privacy, then you need to frequently discard your VPS and pick a new one.
I like to use dsvpn: https://github.com/jedisct1/dsvpn
Seems to have triggered the netsec community on reddit though.
This, and FoxyProxy for domain-based proxy settings is my go to when connecting to some websites (self-hosted bit bucket/confluence, etc) behind Corp intranet boundaries.
Thanks for the link. How does this work on the server side? It gets packets on 8080 and then what? The article needs to explain the server config, even if it is just how to install ssh-server.
I have tried setting up OpenVPN on my own VPS and I didn't get very far with it. I have also had to use OpenVPN in the day job and I much prefer just using ssh without some extravagant OpenVPN layer.
My experience of failing to configure a VPN of my own (primarily for testing GeoIP) led me to try a few VPNs and the amount of junk adverts and whatnot made me wonder if it was time to fdisk my computer and start over due to the virus-vibes I was getting from a VPN. This was in the days before VPN adverts on lame YouTube channels, so I presume the product has improved since then.
In theory, someone smarter than me can rent a VPS and get OpenVPN on there, or, better still, a remote desktop so that only the screen image goes over the internet from the VPS to the PC, X-Window style but better. This could be further obfuscated by using 443 and one's own special ROT13 'encryption'.
Presumably a skilled person that knows what they are doing could get it all setup in an hour, to write concise instructions that 'civilians' can work through in pretty much the same time.
If you were highly invested in porn, watching Netflix in foreign countries and with even worse stuff to hide, you would think that some investment in getting a proper VPN with your own VPS would be the way to go, but no. Cost isn't the problem if you are deeply into something worth hiding, so why do so few people roll their own VPN?
The reality is that the typical product is marketed with FUD and the goal is to turn you into a 'sleeping giant'. A 'sleeping giant' is a customer that has a standing order or other payment arrangement that is for a service that is not used, and for that to not be noticed on bank statements. Everyone wants you to be a 'sleeping giant', including some 'worthy' charities, dating websites and every software subscription service. They aren't using FUD marketing though.
The commercial VPNs have mastered the art of selling a product that deserves technical knowledge to understand to the masses, so you have got to respect the hustle.
VPS's that you can easily spin up for an hour or two tend to charge $$$$ for egress bandwidth, which makes them an unattractive option for streaming video over.
There are very simple options to selfhost a VPN nowadays. For example, Amnezia allows you to just type your server ssh credentials into their mobile app, and it will automatically set up AmneziaWG on your server and add it to the app. You can then create Amnezia or plain WireGuard config files from extra devices right from there.
That sounds like I'm putting a lot of trust in an app. Also giving it control over my server, which I guess is not a big deal if the server is a disposable VPS
It's all open source though, so you can verify the scripts it's using, which are all here
https://github.com/amnezia-vpn/amnezia-client/tree/dev/clien...
But even without that, there are solutions like wg-easy that let you spin up a WireGuard server with a single Docker container
it's very easy to setup your own VPN on your own server. I'm using AWS Lightsail because of virtually unlimited bandwidth and the locations I like, but any VPS would work well. I used to have my own scripts but I found this lately which is doing this much better than what I was doing https://github.com/angristan/wireguard-install
The only advantage of professional VPN is the ability to use obfuscation, so to bypass VPN restrictions in countries like Egypt or others.
That is brilliant, many thanks for that and the Lightsail suggestion. Now I just need a legitimate use case, which will probably be a locked down origin server with even more security than what I had before with ssh things.
I too recently tried to set up OpenVPN on a VPS and it was a huge pain in the @ss, even while following a (very long) tutorial. If I figure out an easier way to do this I'll message you in this thread
OpenVPN is just really complicated, which makes sense because of the context and history. But even me who've done plenty of OpenVPN setups through the years, found Wireguard a lot simpler and easier to both learn and use effectively. So if you haven't tried Wireguard, give it a go, the simplicity is pretty nice.
Note: Wireguard is good because it's simple. It makes point-to-point tunnels, it does that well, and that's all it does. You're on your own for the rest.