[HN Gopher] FreeBSD Home NAS, part 3: WireGuard VPN, routing, an...
       ___________________________________________________________________
        
       FreeBSD Home NAS, part 3: WireGuard VPN, routing, and Linux peers
        
       Author : todsacerdoti
       Score  : 131 points
       Date   : 2026-01-04 11:55 UTC (11 hours ago)
        
 (HTM) web link (rtfm.co.ua)
 (TXT) w3m dump (rtfm.co.ua)
        
       | age123456gpg wrote:
       | You can get yourself a vanity key using
       | https://github.com/AlexanderYastrebov/wireguard-vanity-key tool:
       | % wireguard-vanity-key -prefix=NAS/        private
       | public                                       attempts   duration
       | attempts/s        EiBsDB8zt/G4+VWGvxW2ZznNXYmcslcIyJimNR2PpF4=
       | NAS/aex8+IFzLePBYVNGMsSo/1/XeUZcam+Hn8wbNB4= 22619537   0s
       | 112587360
        
       | rpcope1 wrote:
       | Wireguard is cool, but there's some reasons it's worth
       | considering OpenVPN (why I still use OpenVPN anyways). First,
       | OpenVPN has kernel mode now (called DCO, which I think Netgate
       | maybe has upstreamed to FreeBSD); I've found it's performance on
       | hardware with AES-NI on Linux is actually often better than
       | wireguard. Second, there's a lot of quality of life things that
       | just work on OpenVPN that you've got to use a ton of duct tape to
       | make work with Wireguard, a major one being handling DNS record
       | change (think especially dynamic DNS, which is likely if this is
       | IPv4 and a residential connection). This is a huge pain with
       | Wireguard, but just works on OpenVPN. Similarly if you have
       | multiple WAN links, like I do, for OpenVPN it's just two
       | connection stanzas and it largely just works. Again for Wireguard
       | you're adding lots of duct tape to make it work right. I know
       | Wireguard is the new hot thing, but it leaves a lot to be desired
       | in the resiliency and features department.
        
         | ZeWaren wrote:
         | I use wireguard as my main VPN to connect to my homelab from my
         | phone and my laptops.
         | 
         | I also have an OpenVPN as a backup option, running behind sslh.
         | My same port on my router (443) serves both a webserver hosting
         | photos, and that OpenVPN instance. This allows me to VPN into
         | my home in most firewalled office networks.
        
           | bayindirh wrote:
           | Why not using tailscale/headscale, which removes the
           | requirement to expose home network to internet at all?
        
       ___________________________________________________________________
       (page generated 2026-01-04 23:00 UTC)