Hello comrades! In light of the fucked up state of the UK govt I'm looking at some VPN options to further harden my homelab.
Right now, I have zero VPN coverage for my seedbox/jellyfin server which of course means a major security hole, even if my ISP hasn't shit over me for it yet.
I had a few questions about selfhosting a VPN versus a third party service.
-
How does a self hosted VPN actually do anything? I was under the impression that VPNs had to be off-site to give the benefits of, say, location spoofing.
-
Do I need to pay any subscriptions to other services for a self hosted VPN? At least in order to access features such as location spoofing.
-
We use Cloudflare WARP at work to access internal services. Will a LAN-VPN Fuck this up even if I explicitly avoid spoofing my location to ensure my IT guy doesnt shit a brick?
thanks cumrades!
https://github.com/Nyr/wireguard-install
Cheap vps: https://vps.today/
Melbicom is pretty good. There are cheaper options too for Europe, since it's an internet transit hub.
I like router level VPN for client instead of setting it on each device . Pfsense, routeros all good options.
I have a homelab that I could host the VPN on and route traffic through there? Unless the principle is different to how, say, PiHole works?
Does a VPS have its own issues since it would be tied to my banking info should I use it to bypass a government censor? Or are we suggesting:
LAN -> VPS -> VPN -> WAN
Yes ideally I want all network users on that VPN. How would a cheap VPS handle data streaming? I have 500mbps down so I imagine a VPS could be a massive bottleneck unless I pay £££
EDIT: ah looks like there are generally affordable VPS (£8/mo) that offer a good speed.
Melbicom has gigabit servers I think. If it's close enough you could get full speed.
Europe in general you can find cheap gigabit vps. It's Asia where transit is v expensive.
VPS can see ip addresses and encrypted data. Banking sites log your IP so yes they can tag your IP to your identity. Not a problem with shared airvpn and all.
With pihole you can have a different server connected to your router ie your home lab
But for whole network routing through VPN, the router itself must be doing it. Not the home lab.
Gotcha. I'll make some notes on my options. Thank you!
For now it looks like the goal is:
Client (LAN) -> VPN (Router) -> VPS -> VPN -> WAN
Client(s) - > Your Router (hosting Wireguard VPN client -> Encrypted Wireguard Tunnel Over Internet - >VPS (Wireguard Server) -> Internet.
With pihole you mentioned before
Your DNS Queries (only DNS on udp port 53) -> Pihole on homelab (blocks/caches and forwards to encrypted dns, either port 443 or 853) -> Router -> DNS Sever listening on same 443/853 (Eg 1.1.1.1) whichever you set in settings of pihole