Exploring open source remote access VPNs reddit / selfhosted ---------------------------------------------------------------------- summonerlf · 2023-11-02 16:11 I've been on the hunt for open-source VPN solutions for remote site access, and I've encountered a few tools with their respective pros and cons. Here's what I've found: 1. [**Netmaker**](https://github.com/gravitl/netmaker/): They recently transitioned to open source and honestly, I haven’t had much experience with it but I've heard good things about its speed. I'd love to know your experiences with it. 2. [**Softether**](https://github.com/SoftEtherVPN/SoftEtherVPN): It's a good tool, but I've had some trouble setting up certificate- based authentication. The lack of a graphical client for the EtherIP protocol on various platforms makes it a bit challenging. 3. [**OpenVPN**](https://github.com/OpenVPN) **Community Version**: This is a solid tool, but it requires some workarounds to ensure proper DNS resolution for multiple VPNs on macOS. The absence of a GUI in the community version can make certificate management less user- friendly. 4. [**Pritunl**](https://github.com/Pritunl/): The open-source version doesn't provide DNS resolution, which is a downside. Any other alternatives/ideas are welcome. ---------------------------------------------------------------------- ElevenNotes · 2023-11-02 16:17 Wireguard. ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-11-02 16:47 Wireguard. WG-Easy for easy client config generation. ---------------------------------------------------------------------- afterdark101010 · 2023-11-02 18:21 Wireguard fire zone can't recommend it enough ---------------------------------------------------------------------- Nestramutat- · 2023-11-02 18:58 Wireguard. Headscale for an open source Tailscale ---------------------------------------------------------------------- Ci7rix · 2023-11-02 19:05 Netbird ---------------------------------------------------------------------- Solkre · 2023-11-02 19:05 It hasn't been mentioned yet, but Wireguard is really good! Hella fast. ---------------------------------------------------------------------- petr205 · 2023-11-02 19:15 Honestly can't recommend netmaker anymore, they had a rugpull recently by locking certain features behind a paywall. 2FA, user management, and relays are no longer avail in the self-hosted community version. I run netbird and I love it, though to be fair I run 3 servers in different locations so I needed something to work well and can't open any ports. As many people have recommended, you can just run [fire.zone](https://fire.zone) or wg-easy by opening a port on your router. If you don't want to open a port then checkout a vpn that will port forward for you or buy a cheap vps and run netbird. netbird, netmaker, and tailscale are built on wireguard so they're pretty fast choices but I would recommend netbird if you don't mind doing a lot yourself. Also, OpenVPN is hot garbage, comparatively much slower. ---------------------------------------------------------------------- NotTryingToConYou · 2023-11-02 19:48 This is my setup for digital nomading and it runs great. I do need to add some hardware redundancy though ---------------------------------------------------------------------- PM__ME__YOUR · 2023-11-02 20:10 I also recommend wireguard. It is very simple to set up and has performed great in my experience. ---------------------------------------------------------------------- anna_lynn_fection · 2023-11-02 21:01 I know, right. I can't believe nobody mentioned it yet! ---------------------------------------------------------------------- 12_nick_12 · 2023-11-02 22:02 I've been wanting to play with this ---------------------------------------------------------------------- _3xc41ibur · 2023-11-02 22:22 This. I switched from OpenVPN to wireguard and I'm never looking back. Took me an hour to setup all my peers and interconnectivity to my LAN from abroad. It's so good. ---------------------------------------------------------------------- lestrenched · 2023-11-02 22:23 Wireguard bro ---------------------------------------------------------------------- Affectionate-Fig-805 · 2023-11-02 22:24 Wow Softether is still around. I remember setting an l2 bridge site- to-site VPN using softether many years ago. Good times. ---------------------------------------------------------------------- Mccobsta · 2023-11-02 22:57 Pivpn makes it way to simple ---------------------------------------------------------------------- Affectionate-Fig-805 · 2023-11-02 22:59 It seems you have a requirment to use ssl certs? what's your auth requirement? TLS+auth? TLS only? Also, what do you mean workarounds in dns for OpenVPN? You can specify a different DNS server per tunnel and even per client using client overrides. imho, OpenVPN will fit your requirement fine. I suggest setting up a test OpnSense or PFsense firewall just to get the hang of OpenVPN server configuration in almost all it's configuration options in a GUI format. ---------------------------------------------------------------------- Nikto_90 · 2023-11-02 23:00 Tailscale + Headscale ---------------------------------------------------------------------- sauladal · 2023-11-02 23:07 What's the big change you've noticed over OpenVPN? ---------------------------------------------------------------------- bubblegumpuma · 2023-11-02 23:11 Tailscale client + the open source server implementation headscale is a good self-hostable solution comparable to netmaker in features, at least from what I've seen. It negotiates peer-to-peer connections and uses wireguard as the underlying VPN software just like Netmaker does, so the speed *should* be comparable. ---------------------------------------------------------------------- alstair · 2023-11-02 23:25 Throughput was greatly improved moving from openvpn to wireguard for me. ---------------------------------------------------------------------- _3xc41ibur · 2023-11-02 23:30 Technical-wise, moving away from the client-server model of OpenVPN. Wireguard is almost peer to peer. I quite like the site-to-site design option it allows. It's also fully open source. Many people have written different software that wraps around Wireguard or makes it butter smooth to manage and configure a Wireguard network. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-02 23:31 Linuxserver.io WireGuard Docker image Extremely powerful and easy to set up and now I can access my network remotely ---------------------------------------------------------------------- BelugaBilliam · 2023-11-02 23:46 The only answer. ---------------------------------------------------------------------- Signal_Inside3436 · 2023-11-03 00:13 I use it in a split tunnel config whenever I leave my house and for accessing my services it’s like I never left my WiFi, it’s that good. ---------------------------------------------------------------------- ShakeForeign · 2023-11-03 00:37 Is this for securely accessing internal computers and services? I'll recommend ZeroTier: [https://docs.zerotier.com/selfhost/](https:/ /docs.zerotier.com/selfhost/) Been using it for years. ---------------------------------------------------------------------- poultryinmotion1 · 2023-11-03 00:51 So I've created my own Wireguard server, but I recently found out about TwinGate and it's fantastic. Much better speeds and it's split tunnel. ---------------------------------------------------------------------- Garrapalw · 2023-11-03 02:27 Wireguard is the way to go! ---------------------------------------------------------------------- _3xc41ibur · 2023-11-03 03:20 This too! I was having occasional dropped connections throughout my OpenVPN network. Disappeared when I started using Wireguard ---------------------------------------------------------------------- _3xc41ibur · 2023-11-03 03:22 I use this as well! Very simple CLI usage, but super quick to deploy peers ---------------------------------------------------------------------- candrist · 2023-11-03 04:09 Mikrotik CHR. You can then configure WireGuard and IPSEC. ---------------------------------------------------------------------- ElevenNotes · 2023-11-03 05:56 That’s a very good usecase for Wireguard. All our devices, me, wife and kids, use Wireguard on iOS to automatically connect as soon as you leave the home Wi-Fi. Everything just works and people always ask how I can see the cameras from home or how I can see the temperature in Home Assistant. Technology could be so simple … ---------------------------------------------------------------------- ElevenNotes · 2023-11-03 06:01 I prefer to install Wireguard on the router, to have proper ACL and access to the entire network if need be. ---------------------------------------------------------------------- tedstr1ker · 2023-11-03 06:03 Can this be selfhosted completely without using any cloud services? ---------------------------------------------------------------------- thehoffau · 2023-11-03 06:05 Headacale (self hosted tailscale) or just use tailscale... ---------------------------------------------------------------------- solar_cell · 2023-11-03 06:07 Self hosted ZeroTier. Amazing ---------------------------------------------------------------------- ElevenNotes · 2023-11-03 06:10 And unlike OpenVPN which is a single threaded binary, Wireguard runs almost native fast on any end device without a sweat. Even an old USG 3P can run Wireguard at near line speed while OpenVPN chocked on 80Mbps. ---------------------------------------------------------------------- _3xc41ibur · 2023-11-03 07:51 Absolutely. Wireguard runs kernel-level, or at least has that ability. For example, on rooted Android, it's able to achieve that same speedy performance. It utilizes the userspace VPN on my unrooted phone, but it's still pretty fast and well-performing. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-11-03 09:30 If you like TwinGate and its zero trust approach, you will probably also like OpenZiti - [https://github.com/openziti](https://github.com/openziti). Its fully free and open source which means it can be self hosted. It also covers more use cases, e.g., ZT in LAN (i.e., 'east-west'). If you don't want to self-host, use CloudZiti which has a completely free tier up to 10 endpoints. I work on the project. ---------------------------------------------------------------------- znpy · 2023-11-03 10:03 hi, i'm honestly interested in wireguard, but so far there are some things i don't like. essentially, wireguard only does encrypted link setup, everything else is left to be done. in openvpn i can push configurations to clients (eg: push dns server) so that if i need to change something i can change the configurations on the server and restart it, and clients will get the new configuration on startup. is there a way to achieve something like this with wireguard? ---------------------------------------------------------------------- ElevenNotes · 2023-11-03 10:05 What configuration should change on a client? ---------------------------------------------------------------------- znpy · 2023-11-03 10:06 stuff like routes or dns servers. ---------------------------------------------------------------------- NowanIlfideme · 2023-11-03 10:24 Do you need custom firmware for this? ---------------------------------------------------------------------- ElevenNotes · 2023-11-03 10:27 Not really needed since you can define the routes and DNS in the client config. If you need dynamic site-to-site routing you should use OSPF anyway. You can also simply update the client config via curl or push it via SSH or any other protocol that’s available. ---------------------------------------------------------------------- ElevenNotes · 2023-11-03 10:30 That depends on your router. If you have CGNAT Tailscale would be the easier option if you don’t mind the 3rd party involvement. ---------------------------------------------------------------------- Gl_drink_0117 · 2023-11-03 12:01 Are these wrappers GUI based and open source? Can you name a few here so can help newbies? Thanks ---------------------------------------------------------------------- dovholuknf · 2023-11-03 12:04 Offered in a comment already but I'm replying to you in case you don't see the comments... A project I'm one of the maintainers on is OpenZiti. You can find it, and a TON of all the other alternatives over on this github: https://github.com/anderspitman/awesome- tunneling/ (or you can just check it out directly, it's an easy thing to find if you type OpenZiti into your search engine) I am biased obviously, but it's all entirely open source and entirely self hostable. Wireguard is always a safe and great choice too (or any of the wireguard-based solutions, netmaker, tailscale, headscale, etc etc) ---------------------------------------------------------------------- Gl_drink_0117 · 2023-11-03 12:12 That’s very impressive. Maybe an article of how you went about setting everything up would be great. Accessing cameras from outside for me has been a pain where they have to be shared openly, which I don’t want as of now. By IOS you mean phone or tablets or desktop Mac? ---------------------------------------------------------------------- NotEvenNothing · 2023-11-03 12:17 WireGuard is just tunnels. Really low-level. If you are just connecting two sites or have a strict star topology, it is easy. A mesh topology makes a lot of work (because you need a tunnel between every combination of peers). But WireGuard is probably fine for most here. WireGuard is missing a lot of conveniences. As an example, on Windows. To change anything with WireGuard, you need to be admin. So for regular users, it either runs on startup or not. Compared to OpenVPN, where a user can bring the VPN up and down, with a password required, WireGuard...gives me pause. For more features and less onerous mesh topology support, I've been looking at Nebula. No opinions yet but it looks like it fits the bill. ---------------------------------------------------------------------- ElevenNotes · 2023-11-03 13:39 It’s not believe me. The iOS app has a simple option that it will auto connect your Wireguard if you are not connected to Wi-Fi {N} or cellular {X}, pretty simple to setup. It's on iOS so for phones and tablets, but Wireguard exists for any platform. ---------------------------------------------------------------------- _3xc41ibur · 2023-11-03 15:36 There's Tailscale which has been commended by many to be one of the best Wireguard-based VPN services [https://tailscale.com/](https://tailscale.com/) There's wg-easy as well, which another commenter has mentioned https://github.com/wg-easy/wg-easy ---------------------------------------------------------------------- Solkre · 2023-11-03 19:45 It probably still has connection drops, but wireguard handles it like an adult. ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-11-03 19:46 Which the point the other poster was making.. if DNS servers need changing, or some other part of the configuration needs changing, it's difficult to manage a large estate of devices. ---------------------------------------------------------------------- znpy · 2023-11-03 20:11 thanks, it's nice to see somebody actually getting the point on reddit, from time to time. i know it counts very little, but my upvote is yours ---------------------------------------------------------------------- ElevenNotes · 2023-11-03 22:39 Not really, I manage a few hundred wireguard clients with no issue. You are just inventing problems that don't really exist. ---------------------------------------------------------------------- ElevenNotes · 2023-11-03 22:40 No its not. I manage a few hundred clients with zero issues. ---------------------------------------------------------------------- murdaBot · 2023-11-05 01:20 > Wireguard. This isn't what OP is asking about, they listed full VPN packages, which Wireguard really isn't. ---------------------------------------------------------------------- lockstock27 · 2023-11-07 10:31 Wireguard. Job done ---------------------------------------------------------------------- Northhole · 2023-11-11 13:27 I'm still using it. Have been very stable from the first time I set up a solution for testlab-purpose at work. L2-bridge was one of my requirements (because of IGMP). ---------------------------------------------------------------------- Affectionate-Fig-805 · 2023-11-11 15:24 It's really stable even on it's early days. a little bit slower in throughput compare to openvpn in our tests, but that's about it, a solid vpn solution before and i'm glad it's still around and used today. ---------------------------------------------------------------------- Yogesh_osm · 2023-11-24 09:30 Do you have any guide to self host Netbird? The default guide is not very helpful Note: I wanted to setup the netbird on a machine behind PfSense Firewall One more question "Is domain mandatory?" ​ Thanks in Advance, Yogesh ---------------------------------------------------------------------- petr205 · 2023-11-24 16:41 Yeah the netbird coordination node *needs* open ports so it can facilitate connections, I have seen people run without a domain but you would have to spin it yourself as the quick setup script requires a domain. **Just some extra info if you do decide to run it yourself without a domain:** The netbird recommended stack is CockroachDB, Zitadel, netbird signal server, caddy, netbird dashboard, and coturn. These are all fairly easy to deploy and you're going to have to follow the "advanced guide" ([start here](https://docs.netbird.io/selfhosted/selfhosted-guide), when you get to "configure IDP" select [Zitadel](https://docs.netbird.io/selfhosted/identity- providers#zitadel), or [another one you're already hosting](https://docs.netbird.io/selfhosted/selfhosted- guide#step-3-configure-identity-provider-idp)). After that it was pretty easy for me to get up and running, as long as you have a decent understanding of docker and the identity provider you are using. ---------------------------------------------------------------------- Ordinary_Employer_39 · 2023-12-01 02:14 This might be what you're looking for https://github.com/NOXCIS/Wiregate