Hacker News new | past | comments | ask | show | jobs | submit login
Show HN: Use Ansible to Run a “friends and Family” OpenVPN Server on Digital Ocean (github.com/robbintt)
206 points by robbintt on Jan 8, 2017 | hide | past | favorite | 51 comments



I'd like to hear how this is different from Streisand? [0] (and also Sovereign, which I see someone else posted below).

I set up Streisand on a $5/mo Digital Ocean droplet a while back and the whole family uses it on all our devices with great results. It is pretty much a 'fire and forget' solution that I haven't had to touch in over a year.

[0] - https://github.com/jlund/streisand


I've been using streisand for a while (from China) and it's great; the main reason I can see that you might want to use the linked project instead is that it has a lot less surface area so it could be more secure (it's a lot easier to harden/audit openvpn alone than all the services streisand includes).

That said, if I was going to pick one protocol out of the selection offered by streisand, it would be l2tp/ipsec instead of openvpn (assuming you're hosting on digital ocean. The networks on AWS and GCE are more restrictive and you can't serve l2tp/ipsec from there). I found this to be easier to set up (the client-side software is already included in most operating systems) and to have the best performance.


From another subthread, https://github.com/trailofbits/algo is an ipsec-only alternative to streisand that looks good (although it requires an app to be installed on android). They also get ipsec working on aws/gce, so apparently whatever obstacle streisand faces with this configuration is solvable.


Caveat: That unconditionally blocks traffic between your friends and family (see issue #166).


This project aims to "do one thing and do it well".

I posted this elsewhere but it bears repeating. This project is designed to be simple, auditable, and disposable, and have the minimum attack surface and maintenance costs.

Other tools are great, but the cost of swapping certificates and IP addresses and zone files can weigh you down.

Streisand would do well to have numerous playbooks that remix roles for smaller services (if they don't already).


Does this work for offshore usage of USA Netflix or do they detect Digital Ocean?


I have to disable this in the US to use netflix.

I wish they would allow VPN users through based on an address based authentication.



It should. Netflix only blocks known IP-blocks of VPN services.


Netflix is blocked from DO. Just tried. If anybody can buy and use an IP, Netflix has pretty much blacklisted that IP space, as far as I have tried.


Came here to say the same thing. How is this better than Streisand?

Both even use Ansible.


They have different objectives. Streisand's goal is to circumvent censorship, so it provisions a set of different VPN protocols (OpenVPN, LT2P/IPSEC, Shadowsocks, etc...) and instructions on how to use them, where as sovereign sets up e-mail, caldav, and other cloud related tools (which Streisand does not do).


Yeah, my question was comparing the linked project to Streisand, not Sovereign to Streisand.


I misread your question, my apologies. At a quick glance (and a very quick one at that), Streisand's OpenVPN setup is configured to work on both TCP and UDP ports, where as the references project is being templated from [https://github.com/Stouts/Stouts.openvpn/tree/9c83736608e4cc...]. Looking at the linked project's setup, it seems it's using outdated configurations for OpenVPN (BF-CBC instead of AES-CBC, 1024 bit keys instead of 2048) [https://github.com/Stouts/Stouts.openvpn/blob/9c83736608e4cc...]. It's also configured to log info where as Streisand tries its best not to.


I may have to fork the Stouts.openvpn role.

I also am not pleased that their easy-rsa tarball is not easily auditable rather than pulling it as a subrepository directly from OpenVPN.

edit: I have audited the easy-rsa tarball. It's still not a totally appropriate way to manage things.


easy-rsa 3 has saner defaults, especially how it configures OpenSSL, so if you fork that would be a good place to start.


This project is designed to be auditable and disposable. It does only one thing and (hopefully) does it well.

Also this project is intended to be broadly accessible to people who feel they can do the basics of managing a server.


I prefer Sovereign for this. Sets up OpenVPN as well as a bunch of other goodies. https://github.com/sovereign/sovereign


Wew, goodies is about right. That's pretty cool.

I have a VPS and I use it for webhosting for myself and some friends. I've thought about (in some cases tried) and then decided against setting up my own mail server, my own irc bouncer, my own xmpp server and my own cloud storage. Each time, the killer was basically "I could do this, but it would take too long to figure out and it would probably not be super secure at the end.

At the very least, a project like Sovereign (written using something as declarative and idempotent as Ansible) would be great to look through and see how it manages certain things.

And that doesn't detract from your project, OP - I like that your focus is tight and your setup instructions detailed. I'm far more likely to actually try installing a small project like yours than a behemoth that will change who knows what throughout my system.


I'm not sure I trust myself to run that many services securely.

I'd be interested in something like this with a strong focus on security.


Algo[1] may be a good fit for you.

Just be aware the authors deliberately target only very recent clients. [2]

I recently spun up a new Algo instance on an Ubuntu host and discovered I could no longer SSH from an old Snow Leopard Mac because it locked sshd down to only 'modern ciphers'[3].

(No affiliation, just a fan)

[1] https://github.com/trailofbits/algo

[2] https://github.com/trailofbits/algo/issues/168

[3] https://github.com/trailofbits/algo/blob/master/roles/securi...


> Do not check use IPv6

last time I set up an openvpn server on digitalocean without `tun-ipv6`, it leaked my ISP's ipv6 address to the internet while my ipv4 address was correct (a digitalocean address). disabling ipv6 on a vpn by default doesn't make a lot of sense to me if the intention is a layer of privacy around your ISP.


Hi, thanks for your feedback. Can you submit a github issue? I need to establish a traffic testing method for assessing whether any traffic is leaking. This would be a valuable general tool for all vpn toolchains.


testing is a good idea, and I've seen it done in other "road warrior" type scripts in an unsafe way via `curl -s6 https://canhazip.com`. I may not have the time to contribute for a while, but what I would contribute is mostly laid out in the openvpn docs for enabling ipv6[0].

most of what you need to do with ipv6 is analagous to what you'd do with ipv4 like remembering to uncomment net.ipv6.conf.all.forwarding=1 in /etc/sysctl.conf ( just as you would with net.ipv4.ip_forward). use tun-ipv6 instead of tun, and server-ipv6 in addition to server. ip6tables rules in addition to iptables rules. etc etc. although that may be it -- can't think of anything else of the top of my head. I'll look more at your code and see if there's anything I can help with as time allows- ping me if I forget :)

0. https://community.openvpn.net/openvpn/wiki/IPv6


Would love to see those additions made to this script: https://github.com/Nyr/openvpn-install


wow, I admire the dedication to supporting multiple operating systems, but that script is a mess IMHO. why is there a hardcoded version of easyrsa? I haven't worked with easyrsa in a while but does it still do 1024 bit dh parameters by default? because that would also be a mistake. it looks like there is sufficient interest, so maybe I'll cobble together a bash script.


How did it leak it?


I'm guessing the author was resolving AAAA records on the client side which caused his network stack to prefer IPv6 routing.

Which means anything he was connecting to that was IPv6 capable was not using the VPN.


I think this is correct, which was default behavior


I'd like to see some hardening of the box if it's going to be used as a VPN server. My boxes in the DO IP range routinely get targeted by malicious traffic from China and Russia.


Please add an issue with any reference and ideas for doing this. I would love PRs too.


Is there a checklist/guide you could point to? I've come across a few but not being experienced I have a hard time judging how good/complete they are.


I'm not a security expert by any means, but I like these three guides in the DO tutorials for a typical box.

https://www.digitalocean.com/community/tutorials/an-introduc...

https://www.digitalocean.com/community/tutorials/how-to-set-...

https://www.digitalocean.com/community/tutorials/how-to-secu...

There are a dozen or so tools mentioned in the above.


I'm surprised no one's mentioned pritunl. Open source and one click deployment on DO https://pritunl.com


Given that most families probably want to use this to torrent, would this not violate Digital Ocean's terms of service?


This tool is to protect you from verizon supercookies and comcast deep packet inspection. These companies sell access to this data to local law enforcement without requiring a warrant. LEO make choices based on the narrative about you they can build. We need to protect ourselves from people who would do us harm in clever and careful ways.


You can also use Oh-My-VPN to install OpenVPN with a one-liner. https://github.com/alaa/oh-my-vpn


Any one have a similar project but based on CentOS that they use and recommend?


This is really great! I didn't even know this was possible thanks!


Why not just use:

    ssh -D {port} {server}

?


A VPN on the cloud. Totally private. Great idea.


Depending on your threat model it's perfectly fine. It won't work against a nation-state-level adversary, but I don't get the feeling it's meant to. Against opportunistic passive sniffing or active MitM in cafés and such it's adequate.


Yeah exactly -- it's a condom rather than an enigma machine.


Condoms are good security for sex. An enigma machine wouldn't be very helpful on the other hand.


It's oftentimes worse than nothing against passive surveillance: If you surf from home, your local spooks are with some likelihood forbidden from arbitrarily looking into your communications. Once you pipe it to abroad and terminate the "VPN" on that end, you can be pretty sure your browsing/torrenting habits enjoy no protection from any country's spooks, including your own. And traffic analysis lets eavesdroppers trivially correlate the VPN endpoints with the traffic leaving the VPN.


/s


Name checks out! (As they like to say on a certain other message board where snarky comments are de rigueur. )


You can simply run a sh script that sets it up... https://github.com/Nyr/openvpn-install


I use this script for my servers as well and it seems much quicker and easier. What benefits does OP's method provide?


Ansible provides idempotency and some measure of auditabity. Ansible is one way to manage things.


I use this as well. Takes all of 2 mind to set up, or add a new user




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: