Show HN: Use Ansible to Run a “friends and Family” OpenVPN Server on Digital Ocean

[cyberferret]

I'd like to hear how this is different from Streisand? [0] (and also Sovereign, which I see someone else posted below).

I set up Streisand on a $5/mo Digital Ocean droplet a while back and the whole family uses it on all our devices with great results. It is pretty much a 'fire and forget' solution that I haven't had to touch in over a year.

[0] - https://github.com/jlund/streisand

[bdarnell]

I've been using streisand for a while (from China) and it's great; the main reason I can see that you might want to use the linked project instead is that it has a lot less surface area so it could be more secure (it's a lot easier to harden/audit openvpn alone than all the services streisand includes).

That said, if I was going to pick one protocol out of the selection offered by streisand, it would be l2tp/ipsec instead of openvpn (assuming you're hosting on digital ocean. The networks on AWS and GCE are more restrictive and you can't serve l2tp/ipsec from there). I found this to be easier to set up (the client-side software is already included in most operating systems) and to have the best performance.

[robbintt]

This project aims to "do one thing and do it well".

I posted this elsewhere but it bears repeating. This project is designed to be simple, auditable, and disposable, and have the minimum attack surface and maintenance costs.

Other tools are great, but the cost of swapping certificates and IP addresses and zone files can weigh you down.

Streisand would do well to have numerous playbooks that remix roles for smaller services (if they don't already).

[cylinder]

Does this work for offshore usage of USA Netflix or do they detect Digital Ocean?

[rosser]

Came here to say the same thing. How is this better than Streisand?

Both even use Ansible.

[NickBusey]

I prefer Sovereign for this. Sets up OpenVPN as well as a bunch of other goodies. https://github.com/sovereign/sovereign

[mos_basik]

Wew, goodies is about right. That's pretty cool.

I have a VPS and I use it for webhosting for myself and some friends. I've thought about (in some cases tried) and then decided against setting up my own mail server, my own irc bouncer, my own xmpp server and my own cloud storage. Each time, the killer was basically "I could do this, but it would take too long to figure out and it would probably not be super secure at the end.

At the very least, a project like Sovereign (written using something as declarative and idempotent as Ansible) would be great to look through and see how it manages certain things.

And that doesn't detract from your project, OP - I like that your focus is tight and your setup instructions detailed. I'm far more likely to actually try installing a small project like yours than a behemoth that will change who knows what throughout my system.

[tlrobinson]

I'm not sure I trust myself to run that many services securely.

I'd be interested in something like this with a strong focus on security.

[tribby]

> Do not check use IPv6

last time I set up an openvpn server on digitalocean without `tun-ipv6`, it leaked my ISP's ipv6 address to the internet while my ipv4 address was correct (a digitalocean address). disabling ipv6 on a vpn by default doesn't make a lot of sense to me if the intention is a layer of privacy around your ISP.

[robbintt]

Hi, thanks for your feedback. Can you submit a github issue? I need to establish a traffic testing method for assessing whether any traffic is leaking. This would be a valuable general tool for all vpn toolchains.

[jwilk]

How did it leak it?

[tedmiston]

I'd like to see some hardening of the box if it's going to be used as a VPN server. My boxes in the DO IP range routinely get targeted by malicious traffic from China and Russia.

[robbintt]

Please add an issue with any reference and ideas for doing this. I would love PRs too.

[andreareina]

Is there a checklist/guide you could point to? I've come across a few but not being experienced I have a hard time judging how good/complete they are.

[lucasjans]

I'm surprised no one's mentioned pritunl. Open source and one click deployment on DO https://pritunl.com

[wstrange]

Given that most families probably want to use this to torrent, would this not violate Digital Ocean's terms of service?

[robbintt]

This tool is to protect you from verizon supercookies and comcast deep packet inspection. These companies sell access to this data to local law enforcement without requiring a warrant. LEO make choices based on the narrative about you they can build. We need to protect ourselves from people who would do us harm in clever and careful ways.

[caspereeko]

You can also use Oh-My-VPN to install OpenVPN with a one-liner. https://github.com/alaa/oh-my-vpn

[jlgaddis]

Any one have a similar project but based on CentOS that they use and recommend?

[vxNsr]

This is really great! I didn't even know this was possible thanks!

[cabalamat]

Why not just use:

    ssh -D {port} {server}

?

[insubstantive]

A VPN on the cloud. Totally private. Great idea.

[andreareina]

Depending on your threat model it's perfectly fine. It won't work against a nation-state-level adversary, but I don't get the feeling it's meant to. Against opportunistic passive sniffing or active MitM in cafés and such it's adequate.

[eeZah7Ux]

/s

[scoot]

Name checks out! (As they like to say on a certain other message board where snarky comments are de rigueur. )

[necessity]

You can simply run a sh script that sets it up... https://github.com/Nyr/openvpn-install

[dstryr]

I use this script for my servers as well and it seems much quicker and easier. What benefits does OP's method provide?

[JonoBB]

I use this as well. Takes all of 2 mind to set up, or add a new user