HN Explorer

Ask HN: What do you use for your cloud VPN?

11 points by camjohnson26 ↗ HN
I have a couple of servers running in digital ocean with some docker web applications on them. I want to block access to these web services from the public internet but allow them from the VPC network. The only out of the box solutions I see for digitalocean are proprietary apps like OpenVPN. WireGuard is a good alternative but requires a surprisingly high amount of configuration, and all the third party UIs are barely maintained.

I can’t believe this isn’t a solved problem so very curious what people are using to access VPCs. Preferably open source.

21 comments

[ 2.9 ms ] story [ 58.9 ms ] thread
cpach
Tailscale might be an alternative https://tailscale.com/
oliverjudge
Thanks for the heads up on this, just switched over from a manual Wireguard install.
camjohnson26
Looks cool, and $10 a user a month is a lot better than OpenVPN access server which I believe is around $50 a month for more than 2 clients.
dcminter
I thought OpenVPN was free, and cursory searching suggests that the "Community Edition" version is indeed GPL.

Are there features you need from the non-CE version?

camjohnson26
All the docker images I’ve found are for openvpn-as, just want to keep configuration as simple as possible for security
camjohnson26
Also thought it was free but the digital ocean app and the docker image both request a $700 a year license for more than 2 clients.
lmarcos
> I can’t believe this isn’t a solved problem so very curious what people are using to access VPCs.

I'm actually facing the same scenario, but I thought that a bastion ssh server between the VPC and the internet was enough. I'm totally new to these things, so could someone tell me the differences between a VPN and a VPC+bastion server?

camjohnson26
Pretty sure a bastion server will work for ssh but not for web services
lmarcos
What about an LB sitting between the VPC and the internet?
camjohnson26
Could work but I’d rather have it behind a firewall, stuff like Vault and Grafana
AkshayPrabhu
Have you considered AlgoVPN [0], I've not used it personally but heard positive reviews from those who have. They claim to be "set of Ansible scripts that simplify the setup of a personal WireGuard".

[0] - https://github.com/trailofbits/algo

camjohnson26
Hmm didn’t know Algo used WireGuard under the hood. That’s cool but there’s no UI for adding clients, so I would still have to ssh into the server to download certificates and there’s a lot of commands to run, so at that point might as well just install wireguard manually. Wish they had a docker image and bundled something like WireGuard-access-server.
cutthegrass2
+1 for Algo.

I run this on an inexpensive AWS Lightsail instance. Trivial to move it between regions also.

atmosx
> I have a couple of servers running in digital ocean with some docker web applications on them. I want to block access to these web services from the public internet but allow them from the VPC network.

What you need is a private network[1]. A private VPC will allow instances to communicate with each other, but to access them from the outside a "bastion host" is required. If you install a VPN in the bastion house and add the appropriate routes and settings, you'll be able to connect to your instances internally. This is the "proper" way to create a "private" network.

You could achieve the same thing using Cloud Firewall[2]. The cloud firewall supports droplet as a "source" definition.

UPDATE: You can create a private network using a shared VPN but it is an overkill if instances are on the same data centre.

[1]: https://www.digitalocean.com/docs/networking/vpc/#features

[2]: https://www.digitalocean.com/docs/networking/firewalls/#feat...

camjohnson26
This is actually what I’m trying to do, just surprised that this step: “install a VPN in the bastion house and add the appropriate routes and settings” is taking a lot more manual configuration than I expected, was hoping for some out of the box solution in case I mess up a routing rule or network configuration. WireGuard is pretty good but still requires messing with iptables to forward the VPN traffic onto the VPC
atmosx
I did not get that, sorry.

I would opt for routing instead of NATing if possible.

quantumofalpha
> WireGuard is a good alternative but requires a surprisingly high amount of configuration

Not really. It has a bit of a learning curve, but once you get past it it's actually a total joy to use.

But if you want something even simpler, I could suggest https://github.com/jedisct1/dsvpn

kyawzazaw
OpenVPN + PiHole on DigitalOcean
8b16380d
Wire guard on mullvad. They have OpenVPN support as well.