VPN for personal use

T

tOsYZYny

I have been using wireguard for awhile and am pretty happy with it. I don't want to leave my firewall 'open' to everyone, so I wrote a client which essentially does a handshake and then the firewall opens for that specific IP address. I'd like to reduce that extra step and the app and corresponding backend service since I have to maintain it.

I'm looking to be able to use my VPN on any network (public cafes, restaurants, etc. as well as corporate networks which are fairly restrictive). In the past, I used stunnel to TCP 443 and that worked. I am looking for a solution that will work on Android as well as FreeBSD and Linux.

I had looked at wstunnel, but haven't had any luck with that and am now looking at tailscale since that was on daemonless and requires little setup. I tried that on my corporate network, but it appears to be blocked. I was reading that I could setup my own DERP server which would possibly eliminate my android client going to tailscale's controlplane to determine where to connect.

It would be nice to access my media collection from anywhere since I don't use Google Photos. The secondary benefit is that it also does ad filtering for me when I surf through my VPN.

What do you guys use and recommend?
 
"I have been using wireguard for awhile and am pretty happy with it. I don't want to leave my firewall 'open' to everyone..."

The port # you choose for the wireguard server to listen on, looks closed to all probes *except* a probe from a wireguard client that uses the precise key(s) that the server is expecting. So there is no downside to leaving that port # open all the time in your firewall.
 
Assuming your main goal is file system access, one option is simply using SSH instead (already built-in), enforcing certificate based authentication.

Depending on your desktop environment, you could then feasibly access it remotely using your file manager and browse your files via sftp://yourhost. Dolphin (KDE) for example, supports this.

It may also be possible to set this up as a SOCKS proxy for web browsing (ie, like a VPN), but I have no experience with using it that way.
 
In the past, I used stunnel and that went straight through my corporate firewall then. I suspect it might nowadays because I ran that on port 443, it used TCP, and I think I used an SSL certificate (so it looked legitimate).

My main goal is to put my client device on the same subnet as my home network so it has access to whatever services I have running, in this case, mainly immich TCP/2283, and it gets to the Internet without ads (largely without ads). I had thought about desktop access, but if I go that route, I am looking at kasm: https://kasm.com/

That is another topic and a different usage pattern, but if I am at a local public library where they have computers I can use (and I don't have my laptop), then it would be nice to access my 'desktop' as it were with all of my stuff, passwords, etc. I think that would be the way I'd do it. I think that would have inherently better performance and feel less laggy than SSH with Xorg / wayland.

But, I see that as another local service I would secure behind my VPN , not expose directly on the Internet ...

In summary, my main goals are to have a cross-platform (Android, FreeBSD, Linux) means to access my home network securely on public networks or guest networks in a corporate environment to primarily access immich and surf the Internet without ads.
 
Ok, I suppose I am asking, do you use anything on top of that to get through firewalls such as wstunnel? With the additional service in front of wireguard, it makes Android setup more difficult and that is the challenge I'm facing.
 
I am still poking around, I tried tailscale on my corporate guest network and as expected, it didn't get through. I would imagine that that boils down to 2 things:

tailscale DNS / IPs being blocked
other network ports tailscale uses

I contemplated about hosting my own DERP via headscale, but that would require other ports be open which most certainly wouldn't be accessible on my corporate guest network.

While my main goal is not to bypass my corporate guest network, I want or prefer a solution that works across many different scenarios and simplifies matters. That being said, I am leaning toward sticking with my current setup which is vanilla wireguard with a special app to allow particular traffic through my firewall. The special app is a pubsub client which announces its intent to connect, then a corresponding pubsub client processes those messages and updates the firewall accordingly.
 
You must log in or register to reply here.
Back
Top