Ask HN: What is it like to run a VPN as a business?

The problem is that just like you're able to quickly run up a VPN on a cloud provider, I can do the same. There are plenty of drop in containers for this now and the barrier for entry is low. I think you're just opening yourself up for a world of legal pain and costs given what most people will use VPN services for.

You're going into a heavily saturated market. Not to mention anyone technically savvy can set up their own VPN in 10 minutes on a cheap DO host or other provider.

Try it and report back, I'm curious

I've also toyed with the idea of doing something like this, and would like to know more about this as well. Like you said, the technical side seems easy. I imagine handling legal issues is going to be the bulk of the work. How are you going to handle abuse reports? How are you going to handle requests from authorities asking to turn over user data? And most importantly: how much information about your users are you going to collect to make handling the legal issues easier?

You get consistent revenue from the NSA.

The fact that it is easy to set up a VPN does make this more competitive but that doesn’t mean you can’t build a business. Think about who your customers will be. Is there an underserved niche that you can reach? It might take a HN reader 10 minutes to set up a VPN but my mom wouldn’t be able to figure it out if you gave her 10 months.

My battle plan for assessing whether or not I would pursued this would be the following:

1. Who is my target market?

2. How big is that market?

3. How will you reach that market?

4. How can you test whether or not you can reach that market before getting fully invested?

5. Test out several ways to reach your market. Try changing the niche and marketing plan until you can find some positive signals.

6. Analyze the data and make an educated guess whether this is worth your time or if you would enjoy doing something else more.

As far as legal issues, I don’t have any good advice but talk to a lawyer. Look at some terms of use of existing VPNs. Find out where you are liable and try to mitigate your risks the best you can.

If you ever want to brainstorm some ideas hit me up at my email on my profile.

From a technical perspective, you're probably not breaking new ground here. The main things you'll need are ease-of-use and good marketing. There are existing companies that do this and make it fairly easy to get up and running, so you'll need to do the same. Perhaps start with a niche (e.g. easy setup on Ubuntu) and build from there. Still, your biggest hurdle is going to be that no one has heard of you, so make sure that you have a well designed landing page and think about who you'll market the product to.

Anecdote: You can do this really cheap on the billing side and use WHMCS for billing/member management. Better than rolling your own, and it's pretty extensible.

I'd be most worried about the legal liability, what happens if someone starts using your service to download or sell pirated movies or child porn? Whats your legal exposure?

most of the job will be technical support and finding the right server providers. marketing will be the limiting factor. it's pretty quiet legally, usually it doesn't go further than DMCA cease & desists, but you need to mind countries and what logs each requires you to store. see packetimpact.net maybe i can help you

Surely from an ideological perspective, running a Tor relay node or two would provide about the same amount of fuzzies at much less risk?

The successful companies appear to be run at least partially anonymously and based in tax havens. I figure that is because there is legal responsibility that they are trying to dodge.

People use vpn for illegal stuff, and the least worst is Netflix then p2p. P2p if you are a facilitator could land you in jail.

By and large, people are interested in VPNs because they're vulnerable, in some way or another. By becoming a VPN provider, you become a "pinch point" for the connections of a number of vulnerable people.

That way, a hypothetical bad actor only needs to compromise one entity (you) in order to gain access those people who rely on you.

Aggregating vulnerability makes you a target, and puts your customers at risk - Especially when you're relying on third-party virtualisation providers for your infrastructure.

VPN has a vast potential market in China, which has blocked most providers. I've used ExpressVPN for two years, and its connection is not always stable. I've also used the Lantern proxy with a premium account for a year. Somehow it didn't work most of the time. Maybe you can use more advanced technology and networking infrastructure to provide better service to such areas.

Your best bet, from an ideological perspective, is NOT a cloud hosting provider or a dedicated host, but buy rack space, and put your own servers in.

Control access to the machine/s.

This is more expensive, and not foolproof. But other hosting providers have so much access to track or log things, even if you don't want them to.

One of my "favorite" evil business models is Hola VPN (https://hola.org), a free browser VPN extension. Hola VPN users unknowingly become exit nodes for residential IP address proxies for sale at https://luminati.io.

One possible option is to sell VPN service to friends/family/acquaintances, for a price that is (clearly to them) cheaper than comparable commercial VPNs, in exchange for a promise to not do anything that would get you in legal trouble. You can trust the promise more than you could trust standard terms-of-service because you know them, and hopefully the lower price means they see it as you offering them something as a convenience from your side project instead of a "real" business and the problems of doing business with friends don't apply as much.

The most difficult part about VPN as a business is dealing with the people that use the VPN for illegal activity.

The authorities will come after you first. Most large providers are located in some small country like Panama so they can't be sued or jailed.

Be focused on a specific audience, because talking to consumers about security is very hard. First, I'd start with your friends.

The first questions they're going to ask is how can I trust you're not spying what I do. If you can convince your friends, then you can convince anybody.

Next is how do I use it / how does it work, that brings to make it as simple as possible. Minimal setup, no configuration, it just works.

Finally it's why should I use it. This can be "easy" because you can just look around the competition, see their messaging, find out which one you like better and copy it. Focus on benefits vs technical features and details. When consumers see something they don't understand, they leave.

I've never built a vpn, but I made a password manager (question 3 is relatively easy/understood), and now I'm making a security key (all these questions are proving to be pretty hard). Shameless plug, we're live on Kickstarter: https://solokeys.com/kickstarter

A great niche to get into would be Internet censorship avoidance in countries where Internet freedom isn't a thing. As an expat living in China, I can tell you that there are only a few companies that do this successfully (among them Astrill and ExpressVPN).

Operating this kind of VPN comes with its own set of unique technical challenges, such as avoiding DNS poisoning and offering the best protocols to use. Spinning up a homebrew solution on DO just doesn't cut it as an end user, so we rely on companies like these to provide targeted solutions.

A VPN provider that can focus on avoiding common blocking techniques would be very valuable to a lot of people.

We offer VPN as a side thing to help our customers who are testing their websites from around the world. At the behest of some friends I added VPN as its own plan.

A choice you need to make really early on when you're offering a VPN is how much data you want to log. Eventually someone will do something on your service that pisses someone else off. That could be torrenting, spam, defrauding the elderly, etc. Ideally you, but more than likely your provider will receive an angry letter. Whether or not you've logged will choose what you can do next. If you're not logging, and unable to stop complaints from coming in your provider might turn you off completely, so you'll want to pick a provider known to pass letters on without caring.

I blogged about our choice (we log) here: https://wonderproxy.com/blog/our-vpn-what-we-log-and-why/

how.. make fast money?

I've had a similar idea. I am thinking of creating a service that would install OpenVPN for you on your own server, and send you an email with all the configuration details. Would that be useful, worthwhile doing?

I ran a venture backed VPN company for many years (Spotflux). These days there are tons of huge players in the market, some of which have hundreds of millions of dollars in funding. Your challenges will be as many have stated the following:

1) Convincing providers to let you have VPN traffic on their networks. 2) Dealing with tons of DMCA complaints 3) Dealing with GDPR compliance in the EU 4) Maintaining compatibility for dozens of different user configurations and having apps in the mobile app stores 5) Dealing with credit card and payment fraud. 6) Dealing with law enforcement once you reach a certain scale (no, incorporating in whatever random island will not help you) 7) Maintaining constant uptime of your servers. When a user faces even a minute of downtime, their internet connection is now effectively broken and you are to blame. 8) Dealing with lots and lots of customer support issues and an endless mix of customer configurations which will have you ripping out your hair trying to resolve. 9) Constantly make sure your systems are secured from the latest exploits so you can guarantee privacy and safety of your users. 10) Maintaining a brand and a niche with mature marketing channels that keeps new users coming and paying for your service.

At the end of the day, its a very difficult company to run and its even harder to maintain profitability with so much competition.

Apart from above suggestions, try provide wireguard support, if possible a shadowsock proxy as well.