VPN endpoints running on VPS -- How many do you maintain yourself? (via wireguard, etc.)

SocksAreComfortable · April 5

Question is pretty much what the title says. I'm specifically asking about the number of endpoints that you keep available from running wireguard or whatnot on a VPS, not from a paid commercial VPN service of any sort.

Personally I have two right now, one from @crunchbits in WA and one from @Hostaris in Frankfurt, so I can cover two continents broadly, but I feel like I might need an East coast US one, another EU location that's not too close to Germany, and perhaps one in Asia. Or maybe 5 is overkill? Or maybe you are all running like 25 endpoints worldwide. Just trying to get a general idea of what everyone has setup!

AuroraZero · April 5

Sorry man lost count, between bouncers, end points, gateways it is a couple

sh97 · April 5

I have 8 wg endpoints to access my ASN IP on BGP supported VPS's.
Around 4 on Microlxc VPS for the exotic locations IP.
Around 4 for general proxy

5 is definitely not overkill 😄

SocksAreComfortable · April 6

@sh97 said:
I have 8 wg endpoints to access my ASN IP on BGP supported VPS's.
Around 4 on Microlxc VPS for the exotic locations IP.
Around 4 for general proxy

5 is definitely not overkill 😄

Curious what some of the more useful locations are then in your opinion!

sh97 · April 6

Singapore has the closest proximity to me, so I have a couple of them there, GC (running projects) and WebHorizon NAT (solely for wg)

BGP wg points in UK/DE/NL, for accessing EU specific content. UK and NL together not required as the latency is almost similar, so maybe one in west EU, one in east.

Again, BGP points in quite a few parts of US, but I mainly use my Crunchbits (US West) one for unblocking OTT apps.

If you have idlers, I'd suggest US West+East, Central if you really want it.
EU West + East (Central not required as its geographically smaller and better connected)

Something in Asia with minimal latency to you.

Unnecessary, but if you want connectivuty across the globe, South America and Africa, you can either take Microlxc for casual browsing, or I think WebHorizon has nat in both the continents.

Ympker · April 6

Got one in Germany and one in Finland. Both with ZAP Hosting Lifetime vps. Maybe I'll get one in the US at some point.

Neoon · April 6

I stopped counting after using wg-mesh.
Up to 50-90 links per VPS, I think 60 machines right now.

My gaming machine just had one link to my RPi.
The RPI has like 15-20 wg links, does all the routing too.

Imagine I would do the routing on a windows machine, gah.

havoc · April 6

What are you guys using this for?

I usually just do a WG back into my home network when travelling

Ympker · April 6

@havoc said:
What are you guys using this for?

I usually just do a WG back into my home network when travelling

The Germany and Finland one basically just for secure browsing or accessing services that are whitelisted by ip. I also have a wg server running on my router to access home network. US location would be used for streaming, but since I can't imagine ZAP Hosting giving me more than 100 Mbit/s throughput on their 500 Mboit/s shared VPS line, and my ISP only supports 250 mbit/s anyway, I figured that for just streaming any of my lifetime VPNs (Windscribe, Ivacy, VPN Unlimited..) should do.

foxone · April 6

I used to run a decentralized vpn using nebula ( https://github.com/slackhq/nebula) which worked fine until I started working a lot abroad over various kinds of 4G networks (mostly tourist sim cards) where nebula broke a lot.

Nowadays I have 2500/1000 in most of my networks so I just don't bother and have my lab router as a gateway for everything (and for ipv6-pd as well, so I always get ipv6 everywhere)

sh97 · April 6

@Neoon said:
I stopped counting after using wg-mesh.
Up to 50-90 links per VPS, I think 60 machines right now.

My gaming machine just had one link to my RPi.
The RPI has like 15-20 wg links, does all the routing too.

Imagine I would do the routing on a windows machine, gah.

Damn, wanna do something like this. Sounds lit.

skorous · April 6

@foxone said:
I used to run a decentralized vpn using nebula ( https://github.com/slackhq/nebula) which worked fine until I started working a lot abroad over various kinds of 4G networks (mostly tourist sim cards) where nebula broke a lot.

Curious how it broke? My backup link at the house is 4G and I haven't seen it but then again I'm never on it more than 24h or so

terrorgen · April 8

@sh97 said:
Singapore has the closest proximity to me, so I have a couple of them there, GC (running projects) and WebHorizon NAT (solely for wg)

BGP wg points in UK/DE/NL, for accessing EU specific content. UK and NL together not required as the latency is almost similar, so maybe one in west EU, one in east.

Again, BGP points in quite a few parts of US, but I mainly use my Crunchbits (US West) one for unblocking OTT apps.

If you have idlers, I'd suggest US West+East, Central if you really want it.
EU West + East (Central not required as its geographically smaller and better connected)

Something in Asia with minimal latency to you.

Unnecessary, but if you want connectivuty across the globe, South America and Africa, you can either take Microlxc for casual browsing, or I think WebHorizon has nat in both the continents.

Do you have specific routing rules to route traffic to certain endpoints?

terrorgen · April 8

@SocksAreComfortable said:
Question is pretty much what the title says. I'm specifically asking about the number of endpoints that you keep available from running wireguard or whatnot on a VPS, not from a paid commercial VPN service of any sort.

Personally I have two right now, one from @crunchbits in WA and one from @Hostaris in Frankfurt, so I can cover two continents broadly, but I feel like I might need an East coast US one, another EU location that's not too close to Germany, and perhaps one in Asia. Or maybe 5 is overkill? Or maybe you are all running like 25 endpoints worldwide. Just trying to get a general idea of what everyone has setup!

I have 3 in the US, 4 across Europe, and 1 in Japan.

Overkill? Probably...

sh97 · April 8

@terrorgen said:

@sh97 said:
Singapore has the closest proximity to me, so I have a couple of them there, GC (running projects) and WebHorizon NAT (solely for wg)

BGP wg points in UK/DE/NL, for accessing EU specific content. UK and NL together not required as the latency is almost similar, so maybe one in west EU, one in east.

Again, BGP points in quite a few parts of US, but I mainly use my Crunchbits (US West) one for unblocking OTT apps.

If you have idlers, I'd suggest US West+East, Central if you really want it.
EU West + East (Central not required as its geographically smaller and better connected)

Something in Asia with minimal latency to you.

Unnecessary, but if you want connectivuty across the globe, South America and Africa, you can either take Microlxc for casual browsing, or I think WebHorizon has nat in both the continents.

Do you have specific routing rules to route traffic to certain endpoints?

Not yet, still to explore that.

rcy026 · April 8

@Neoon said:
I stopped counting after using wg-mesh.
Up to 50-90 links per VPS, I think 60 machines right now.

My gaming machine just had one link to my RPi.
The RPI has like 15-20 wg links, does all the routing too.

Imagine I would do the routing on a windows machine, gah.

Sounds a lot like my setup. I have somewhere around 30-40 vps's all meshed with wg. My workstation then connects to any one of these vps's and gains access to the mesh.
I've been thinking about simplifying a bit and run bgp to sort out the routing, but as of now I have a onboarding process that automatically adds a new vps to the mesh with a single command so it's just not worth it.

Neoon · April 8

@rcy026 said:

@Neoon said:
I stopped counting after using wg-mesh.
Up to 50-90 links per VPS, I think 60 machines right now.

My gaming machine just had one link to my RPi.
The RPI has like 15-20 wg links, does all the routing too.

Imagine I would do the routing on a windows machine, gah.

Sounds a lot like my setup. I have somewhere around 30-40 vps's all meshed with wg. My workstation then connects to any one of these vps's and gains access to the mesh.
I've been thinking about simplifying a bit and run bgp to sort out the routing, but as of now I have a onboarding process that automatically adds a new vps to the mesh with a single command so it's just not worth it.

I did simplify wg-mesh that much too, despite using routing and OSPF.

curl -so- https://raw.githubusercontent.com/Ne00n/wg-mesh/experimental/install.sh | bash -s -- init 4
wgmesh connect http://<node2IP>:8080 <token>

And you done.
Its an awesome feature to add and remove servers in a few seconds.

rcy026 · April 9

@Neoon said:

@rcy026 said:

@Neoon said:
I stopped counting after using wg-mesh.
Up to 50-90 links per VPS, I think 60 machines right now.

My gaming machine just had one link to my RPi.
The RPI has like 15-20 wg links, does all the routing too.

Imagine I would do the routing on a windows machine, gah.

Sounds a lot like my setup. I have somewhere around 30-40 vps's all meshed with wg. My workstation then connects to any one of these vps's and gains access to the mesh.
I've been thinking about simplifying a bit and run bgp to sort out the routing, but as of now I have a onboarding process that automatically adds a new vps to the mesh with a single command so it's just not worth it.

I did simplify wg-mesh that much too, despite using routing and OSPF.
curl -so- https://raw.githubusercontent.com/Ne00n/wg-mesh/experimental/install.sh | bash -s -- init 4
wgmesh connect http://<node2IP>:8080 <token>
And you done.
Its an awesome feature to add and remove servers in a few seconds.

I have a wg-setup.sh, it creates the keys and adds the node to my icinga via api. All the other nodes run the same script via cron and will get information about the new node via the same api so within 10 minutes the mesh is updated and the new node added.

Neoon · April 9

@rcy026 said:
@Neoon said:

@rcy026 said:

@Neoon said:
I stopped counting after using wg-mesh.
Up to 50-90 links per VPS, I think 60 machines right now.

My gaming machine just had one link to my RPi.
The RPI has like 15-20 wg links, does all the routing too.

Imagine I would do the routing on a windows machine, gah.

Sounds a lot like my setup. I have somewhere around 30-40 vps's all meshed with wg. My workstation then connects to any one of these vps's and gains access to the mesh.
I've been thinking about simplifying a bit and run bgp to sort out the routing, but as of now I have a onboarding process that automatically adds a new vps to the mesh with a single command so it's just not worth it.

I did simplify wg-mesh that much too, despite using routing and OSPF.
curl -so- https://raw.githubusercontent.com/Ne00n/wg-mesh/experimental/install.sh | bash -s -- init 4
wgmesh connect http://<node2IP>:8080 <token>
And you done.
Its an awesome feature to add and remove servers in a few seconds.
I have a wg-setup.sh, it creates the keys and adds the node to my icinga via api. All the other nodes run the same script via cron and will get information about the new node via the same api so within 10 minutes the mesh is updated and the new node added.

Yea, I mainly use the routing table for that.
A new node does setup the initial links after connecting via wgmesh connect, then pulls all the other nodes internal IP's via the routing table and connects to them if a connection doesn't exist.

The API also provides external IPv4/IPv6, so its possible to setup wireguard connections depending on supported IP protocols.
Takes about 30s to pull all routing information and then starting setting up wireguard links.

There is a change detection, so as soon a new wireguard link has been setup, the remote will reconfigure bird to add the link and use it.

Ympker · April 9

@Ympker said:

@havoc said:
What are you guys using this for?

I usually just do a WG back into my home network when travelling

The Germany and Finland one basically just for secure browsing or accessing services that are whitelisted by ip. I also have a wg server running on my router to access home network. US location would be used for streaming, but since I can't imagine ZAP Hosting giving me more than 100 Mbit/s throughput on their 500 Mboit/s shared VPS line, and my ISP only supports 250 mbit/s anyway, I figured that for just streaming any of my lifetime VPNs (Windscribe, Ivacy, VPN Unlimited..) should do.

I forgot I had an mostly idling lifetime dedi from Cloudcone in the US. Problem solved

I really need to make a list of services I have, or I'll forget eventually

havoc · April 9

@Ympker said:

@Ympker said:

@havoc said:
What are you guys using this for?

I usually just do a WG back into my home network when travelling

The Germany and Finland one basically just for secure browsing or accessing services that are whitelisted by ip. I also have a wg server running on my router to access home network. US location would be used for streaming, but since I can't imagine ZAP Hosting giving me more than 100 Mbit/s throughput on their 500 Mboit/s shared VPS line, and my ISP only supports 250 mbit/s anyway, I figured that for just streaming any of my lifetime VPNs (Windscribe, Ivacy, VPN Unlimited..) should do.

I forgot I had an mostly idling lifetime dedi from Cloudcone in the US. Problem solved

I really need to make a list of services I have, or I'll forget eventually

"lifetime dedi"?!? What sorcery is that?

Ympker · April 10

@havoc said:

@Ympker said:

@Ympker said:

@havoc said:
What are you guys using this for?

I usually just do a WG back into my home network when travelling

The Germany and Finland one basically just for secure browsing or accessing services that are whitelisted by ip. I also have a wg server running on my router to access home network. US location would be used for streaming, but since I can't imagine ZAP Hosting giving me more than 100 Mbit/s throughput on their 500 Mboit/s shared VPS line, and my ISP only supports 250 mbit/s anyway, I figured that for just streaming any of my lifetime VPNs (Windscribe, Ivacy, VPN Unlimited..) should do.

I forgot I had an mostly idling lifetime dedi from Cloudcone in the US. Problem solved

I really need to make a list of services I have, or I'll forget eventually

"lifetime dedi"?!? What sorcery is that?

It was a giveaway during their 4th or 5th birthday iirc Have been happy with them ever since.

That said, ZAP Hosting, where I have my lifetime vps, also offer lifetime dedi. There's a thread for it where someone from LES got one. Support even said they'd replace it if hw fails, so you get an adequate replacement.

See:

https://lowendspirit.com/discussion/5751/zap-hosting-lifetime-servers-discussion-updates/p5

@ialexpw said:
Faulty/dead hardware gets replaced. Including the server itself - I checked this with them before ordering.

@rubenmdh said:

@Ympker said:

@rubenmdh said:
My two dedicated servers are also rock solid and performance has been excellent:
13:33:33 up 151 days, 14:22, 5 users, load average: 2.37, 2.32, 2.09
13:43:48 up 116 days, 3:15, 7 users, load average: 1,45, 1,50, 1,62

My only complaint is the limited bandwidth allocation (which for one of my servers is not correctly calculated) and their trigger-happy DDoS protection.

Ah, right. You were the guy who ordered the lifetime dedis. I couldn't believe that they would even replace them if the hw fails, but iirc you asked them about this and they said you would get replacement (?!).

Yes, seems I like gambling or something. I refrained from ordering additional IPs as I don't really want to pour any more money into them so I am using a different provider to get extra IPs (but these are charged monthly) - AntiDDoS kicks in and it is not ideal in this case, so I have to limit bandwidth for these "external" IPs to ~300Mbps

Sounds good! What have you been running on these? Specs?

Both are running Proxmox running a handful of containers and VMs and one of them is an AV1 encoding server. I used to run a long full encode for a month (24/7 100% CPU usage) without any issues or hiccups. This is why I preferred dedicated hardware.

Specs are as follows:
E5-2640v2 - 64GB RAM - 500GB SSD
E5-2680v2 - 128GB RAM - 2x500GB SSD

I asked them if any server customization was possible (ie. more storage) and they unfortunately said that it is not possible. So I have to work with the somewhat limited storage configuration.

skorupion · April 14

Exactly 1 to my Colocated Server. Its purpose is access to the internal 10.0.0.0/8 network. Rest is just Keepsolid VPN that I got from stacksocial. Suits my needs pretty well.

Neoon · April 17

Got BGP Peering for wg-mesh working.
Goes via Hong Kong to Europe, since Peering is in Europe and back to Hong Kong.

Have to setup another BGP session in HK.

 1?: [LOCALHOST]                      pmtu 1412
 1:  10.0.34.1                                           151.611ms 
 1:  10.0.34.1                                           151.604ms 
 2:  10.0.1.1                                            151.923ms 
 3:  10.1.10.1                                           153.054ms 
 4:  10.1.30.1                                           308.171ms reached
     Resume: pmtu 1412 hops 4 back 4

host_c · April 18

@Neoon said: Got BGP Peering for wg-mesh working.

did I just saw you started using BGP instead/alongside of OSPF??? if that is the case, I am happy as a dog

Neoon · April 19

@host_c said:

@Neoon said: Got BGP Peering for wg-mesh working.

did I just saw you started using BGP instead/alongside of OSPF??? if that is the case, I am happy as a dog

Alongside, Got a Peering session up in Frankfurt and Hong Kong, in-between 2 OSPF Networks.
However, OSPF doesn't behave right now the way I expected it to behave, still have to fix that though.

I still get shitrouted via Frankfurt despite having a peering session up in Hong Kong.

VPN endpoints running on VPS -- How many do you maintain yourself? (via wireguard, etc.)

Comments