Open source remote access VPNs? reddit / selfhosted ---------------------------------------------------------------------- emposcamcw · 2023-10-04 19:53 I have tried many VPN solutions for remote to site access and so far have come across the following tools and the issues I faced: 1. Softether: good tool, however unable to figure out how to setup cert based authentication. Also, the etherIP protocol does not have a gui client for different platforms. Each time using the cli to connect is a pain. 2. Openvpn community version: Great tool, however needs hacks to properly resolve dns for multiple VPNs in macOS . Lacks gui in community version hence cert management is not easy. 3. Pritunl: Doesn’t give dns resolution in the open source version. Any other alternatives/ideas are welcome. ---------------------------------------------------------------------- LeftBus3319 · 2023-10-04 20:12 [WG-Easy](https://github.com/wg-easy/wg-easy) well, makes setting up Wireguard super easy. I've been running it for a long time with no issues. ---------------------------------------------------------------------- borouhin · 2023-10-04 20:30 Softether is a multi-protocol VPN, so that most of the clients can even use built-in OS capabilities to connect (SSTP, L2TP/IPSec), or 3rd-party GUI clients (OpenVPN). It's VPN Server manager GUI is a total mess, indeed. Also a lot of options require a lot of time to properly understand all the concepts. Maybe you can also consider Headscale server with Tailscale clients. ---------------------------------------------------------------------- c0ina · 2023-10-04 20:30 Have you found that transfer speeds drop dramatically with WG, though? People routinely suggest WG which has had me kicking its tyres a few times now in consideration of switching from Openvpn. But every time I give it a try, it significantly chokes transfer speeds of large files relative to what I get with Openvpn. Is this a thing with WG or do I just have it mis (under?)configured somehow? ---------------------------------------------------------------------- voxadam · 2023-10-04 20:32 [Wireguard](https://www.wireguard.com/) ---------------------------------------------------------------------- [deleted] · 2023-10-04 20:33 [removed] ---------------------------------------------------------------------- LeftBus3319 · 2023-10-04 20:36 I haven't noticed any drops in download speed, although upload (from a remote client) does drop by 15-20%. ---------------------------------------------------------------------- isThisRight-- · 2023-10-04 20:40 \+1 for Slack Nebula - I love it and think it's great. ---------------------------------------------------------------------- LaancX · 2023-10-04 20:46 netmaker? ---------------------------------------------------------------------- borouhin · 2023-10-04 20:50 I use WG extensively between my routers and servers in different locations, it's speed is amazing, even with relatively high latency between peers (ca. 50 ms). Definitely better than OpenVPN (in UDP mode, TCP even slower) between the same peers. However, I use OpenVPN for the clients for better administration options (LDAP auth, 2FA etc.) ---------------------------------------------------------------------- buttstuff2023 · 2023-10-04 21:07 Wireguard is significantly faster than OpenVPN for me. ---------------------------------------------------------------------- InsertNounHere88 · 2023-10-04 21:11 I found that wireguard was significantly faster, though I hear the userland implementations are slower than the kernel implementation ---------------------------------------------------------------------- mehkanizm · 2023-10-04 21:11 I'm glad someone mentioned it! ---------------------------------------------------------------------- Arktronic · 2023-10-04 21:24 Consider an SD-WAN solution like /r/ZeroTier or /r/Tailscale. ---------------------------------------------------------------------- nitsky416 · 2023-10-04 21:38 Every single time Wireguard gets posted nearly this identical comment gets made. ---------------------------------------------------------------------- nomofica · 2023-10-04 21:55 I have a client that uses SoftEther in a business setting. It's an unmitigated and unintuitive disaster. ---------------------------------------------------------------------- MalcolmY · 2023-10-04 22:02 Is there an android client I can use with this? ---------------------------------------------------------------------- borouhin · 2023-10-04 22:03 Completely agree with you. Unfortunately, sometimes a choice of options for VPN is very narrow due to special circumstances... which, hopefully, don't apply to anyone else in this discussion... I was happy with WireGuard + OpenVPN until recently, too, but now I have to choose between SoftEther and exotic new protocols lacking stability and client software like Xray, XTLS or Cloak... ---------------------------------------------------------------------- machstem · 2023-10-04 22:06 OpenVpn or Wireguard You can leverage them on OpnSense with nearly no experience ---------------------------------------------------------------------- opensrcdev · 2023-10-04 22:08 ZeroTier ---------------------------------------------------------------------- Feath3rblade · 2023-10-04 22:08 Yeah there's a Wireguard app on both Android and iOS. Never used WG- Easy, so I don't know if it has an easier process for this, but for base Wireguard you just create a keypair for each device you want to connect and then you can use that in your config file along with the peer IP, allowed IPs, and any other settings you wish to change. ---------------------------------------------------------------------- rahilarious · 2023-10-04 22:13 The project itself is [dead](https://github.com/wg-easy/wg- easy/discussions/553) but there are some active forks I use [this](https://github.com/peterlewis/wg-easy) ---------------------------------------------------------------------- LeftBus3319 · 2023-10-04 22:19 Yes. You just use [Wireguard](https://play.google.com/store/apps/detai ls?id=com.wireguard.android&hl=en_US&gl=US) and scan the QR code from WG-Easy, or download the `.conf` and open it inside the app. ---------------------------------------------------------------------- nomofica · 2023-10-04 22:20 You have to use SoftEther? You poor soul. I honestly can't see any circumstances where that would or should be chosen over more common solutions and protocols. In a personal or casual environment you can dictate which to use, and in a business or professional setting there should be something with actual support and standards and compliance policies to point to should anyone complain. ---------------------------------------------------------------------- borouhin · 2023-10-04 22:27 ...and if your users are in a country with strict Internet censorship, you choose those protocols that are not (yet) actively blocked there. SSTP is one of them, and it has the best client software support of all (I've mentioned other alternatives most probably nobody here has ever heard about). And SoftEther is almost the only way to set up SSTP server on Linux. ---------------------------------------------------------------------- nomofica · 2023-10-04 22:33 Ah, I hadn't considered that. That's unfortunate. ---------------------------------------------------------------------- c0ina · 2023-10-04 23:03 Not sure why I'm being downvoted for asking the question but do appreciate the responses✌️ Will give it another go. ---------------------------------------------------------------------- Trague_Atreides · 2023-10-04 23:15 SD-WAN? What does that mean? ---------------------------------------------------------------------- sudoRooten · 2023-10-04 23:39 Software defined ---------------------------------------------------------------------- Arktronic · 2023-10-04 23:43 Software Defined Wide Area Network. It's virtual network infrastructure, so it can do more than VPN (but doesn't have to). That's kinda misleading on a technical level, but meh, you can research it in depth if you like. ---------------------------------------------------------------------- Dizzybro · 2023-10-04 23:44 Pfsense ---------------------------------------------------------------------- zfa · 2023-10-04 23:53 Symptom of bad MTU. See /r/wireguard. ---------------------------------------------------------------------- c0ina · 2023-10-05 00:15 🙏 ---------------------------------------------------------------------- Ok_Accident1034 · 2023-10-05 00:41 Try OpenVPN access server . It is a very good bon solution and very easy to setup. It has advanced features with a user interface admin console. I was looking for a solution as well and found this to be helpful. It can be installed on a virtual machine with as little as 1gb ram. I use this with no issues and 2 user connections as a time sometimes for streaming and accessing other stuff in my home while I am away. Some videos I stumbled on YouTube helped me with the installation here: Install and Configure OpenVPN Access server - Part 1 - Installation https://youtu.be/oEyOPmOx_rI ---------------------------------------------------------------------- BoofingBabies · 2023-10-05 02:20 If you use docker, would really recommend linuxserver/wireguard. ---------------------------------------------------------------------- NotEvenNothing · 2023-10-05 02:45 Or Nebula. It's open source and looks capable. I haven't used it but an evaluation For a small number of remote endpoints, WireGuard works fine, especially if all tunnels are between a site and remote endpoints, rather than also between endpoints. I've been doing this with my home and work networks, and prefer it to OpenVPN. It's been more reliable. ---------------------------------------------------------------------- HoustonBOFH · 2023-10-05 04:20 OpenConnect is a Cisco anyconnect clone and they have a server version, ocserv. But no GUI. And there are a few Wireguard recipes and dockers now, and some have GUIs. ---------------------------------------------------------------------- Wf1996 · 2023-10-05 04:45 Tailscale ---------------------------------------------------------------------- johngizzard · 2023-10-05 04:47 Tailscale would be my bet. The only part that isn't self-hosted is you are using their infra as a relay to initiate the connection, after that everything is on the wg protocol directly. [Headscale](https://github.com/juanfont/headscale) is a selfhosted option but you wouldn't have access to a relay node, your initiation request would have to traverse the internet to a port listening on your server. You could use a VPS to make it more robust but tbh there's very little reason to not trust tailscale and just use them anyway. ---------------------------------------------------------------------- shmikis · 2023-10-05 04:48 Wireguard. [rant] why the hell people keep suggesting tailscails (and its various knockoffs) in SELFhosted? What these services offers is exactly oposite idea of selfhosted. It adds some cloud and third party funtionallity to something (wireguard) what you may perfectly run without any additional help. If you do not have valid reasons (like sitting behind NAT's outside of your control) primary solution should be selfhosted. ---------------------------------------------------------------------- piocaidsn · 2023-10-05 05:19 WireGuard has great performance but it apparently isn’t easy to manage for business environments, I prefer [Netmaker](https://www.netmaker.io/) or [Tailscale](https://github.com/Tailscale/). Openvpn is relatively proven. You don’t need the community edition although it does make user management very easy. There are already plenty of open source user management tools available. Performance is literally 1/20th of wireguard. IPSEC. Industry standard but usually a pain in the ass to manage. Speeds can be as good as wireguard. All that said, if you don’t have a nice uplink to the internet, speeds don’t matter too much. You can get 50mb/s from openvpn out of pretty much any x86 hardware made within the last few years. ---------------------------------------------------------------------- Educational-Door-822 · 2023-10-05 05:35 This! ---------------------------------------------------------------------- colmwhelan · 2023-10-05 06:40 OpenZiti ---------------------------------------------------------------------- Turbulent_Literature · 2023-10-05 07:23 What about https://www.firezone.dev/ ---------------------------------------------------------------------- Stetsed · 2023-10-05 07:40 Tailscale is selfhostable as you can use the Headscale control server to define your own control server and it works great. And this doesn't petrude the fact that for alot of people the functionality tailscale offers might be worth the downsides. As it's still \*mostly P2P in connections and offers some pretty powerful advantages(basically plug and play). I use WireGuard myself for my VPN's but I have considerd using Tailscale with a selfhosted Headscale instance or even with the Tailscale infra simply to reduce the load of that for me. Everybodys want is diffrent. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-10-05 08:05 \+1, particularly if you are concerned with security! ---------------------------------------------------------------------- surreal3561 · 2023-10-05 08:11 Tailscale is great: - It can be self hosted, not sure why you think it can’t? - The free service is available without self hosting which is great if you want to try it out real quick to see if it’s suitable for you, and then you can think whether you want to self host it or not. ---------------------------------------------------------------------- oscarfinn_pinguin3 · 2023-10-05 08:17 What about using the Remote Access Functionality (IPSec) of Windows Server? /s ---------------------------------------------------------------------- shmikis · 2023-10-05 08:32 Everything could be self hosted. You can self host "AWS/Azure On Premises hybrid something.." if you want. But everytime when on this sub, intended to discuss "alternatives to our favourite web services", comes the question about vpn - every second comment is "use our favourite web service Tailscale". Even if this could be self hosted or has it's use cases, recommend as first choice here seems wrong. ---------------------------------------------------------------------- nadmaximus · 2023-10-05 08:53 I use wireguard. ---------------------------------------------------------------------- oOflyeyesOo · 2023-10-05 11:53 Cosmos would be one to keep a eye on. ---------------------------------------------------------------------- kgri65 · 2023-10-05 13:23 I found implementing Wireguard to be very straightforward and more effortless than OpenVPN. I have been running for the last few years a combination of PiHole + PiVPN with Wireguard on an RPi 3+ and it's been rock solid stable. ---------------------------------------------------------------------- sukkamucka · 2023-10-05 14:33 Netmaker seems great but for me since I already use a reverse proxy and it has Traefik built into it is seemed more of a hassle than it was worth ---------------------------------------------------------------------- captnmr · 2023-10-05 15:12 You mention open source but not 100% self-hosted so in that case I'd go with Tailscale, which implements wireguard. ---------------------------------------------------------------------- OMID_PKR · 2023-10-05 16:27 X-ui ---------------------------------------------------------------------- enormousaardvark · 2023-10-05 16:39 Not dead, simply finished, wg-easy is only an easy to make Wireguard config files, Wireguard will always get updated with host OS ---------------------------------------------------------------------- Patient-Tech · 2023-10-05 16:43 There’s plenty of other options. The free tier is awesome and takes minutes to get up and running. I don’t know about you, but I have enough other self hosted projects to work on clicking a couple boxes on a free service is a great option. It’s also way more secure as you don’t have static ports open into your box, and typically being behind residential connections you also don’t have dynamic IP issues and it automagically handles NAT punching. ---------------------------------------------------------------------- Patient-Tech · 2023-10-05 16:46 I set it up when it was first released before ZeroTier and Tailscale were a thing. It worked well but took a bit of time to setup. ---------------------------------------------------------------------- GrandWizardZippy · 2023-10-05 17:55 Netmaker and Tailscale are both built on top of WireGuard. They are essentially WireGuard under the hood. ---------------------------------------------------------------------- merlin86uk · 2023-10-05 18:37 I don’t know about cert-based auth, but we use Softether as a VPN solution at work using Viscosity as the client application, although it’s not free. Under OpenVPN you mention managing DNS for multiple VPN connections. Are you intending to be connected to multiple VPNs at once? ---------------------------------------------------------------------- w00ddie · 2023-10-05 19:18 I use to do my own vpn as well but then switched to tailscale. 100% easier and stable. ---------------------------------------------------------------------- jeremyrem · 2023-10-05 19:21 For Mac with oven I recommend switching to Viscosity client. Much better and easy to setup split tunnel DNS ---------------------------------------------------------------------- mordac_the_preventer · 2023-10-05 19:50 I used to use OpenVPN - it worked well enough but some of the clients were not great. I wanted to switch to WireGuard but I was discouraged (literally for years) by its reputation of being hard to use. I finally followed a tutorial and set up WireGuard on my home server. It was not hard and the resulting VPN is great. I have reliable easy to use clients on Linux, MacOS and iOS. My home server uses Fedora Linux so I used a tutorial that included instructions for `systemd -networkd`. I can’t remember which one I used but it might have been something like https://wiki.archlinux.org/title/WireGuard ---------------------------------------------------------------------- voltswagner · 2023-10-05 20:19 IPsec is my preferred. It's natively supported in many operating systems and it's fast/robust. It can be used in split tunnel or full tunnel. Strongswan is well supported for server/client side configs. You can use certificate based authentication. What more could you want? Oh, I guess it would be nice if certain ISPs and WiFi providers (guest/public wifi) didn't block port 4500! ---------------------------------------------------------------------- netvip3r · 2023-10-05 20:31 I use Wireguard for pretty much everything now. From LAN gaming with remote family to using it as an additional security layer. My phone/laptop's always connected 24/7 to my home network and have access to my necessary work files. Only port I have forwarded is for my Wireguard connection ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-10-06 08:18 100% this. I'm using a mix of all 3 at the moment.. IPSec to link the networks at 2.properties, between a Unifi UDR and a PA. I also have an OpenWRT VM, running use OpenVPN, to provide.a.route through ProtonVPN... it also provides a router onto a Tailscale Network (basically Wireguard), connecting to several VPS in OCI. I did try replacing OpenVPN with raw Wireguard, on OpenWRT, it was fast, but I found it to unreliable and it kept dropping out.. at least in my use-case... so I switched back to OpenVPN. ---------------------------------------------------------------------- Starblazr · 2023-10-07 00:40 Wg easy is basically point click create scan QR code.