this post was submitted on 03 Jul 2024
16 points (90.0% liked)

Selfhosted

39856 readers
555 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
16
[SOLVED] Selectively chaining a VPN to another while allowing split tunnelling on clients? (slrpnk.net)
submitted 3 months ago* (last edited 3 months ago) by Emotet@slrpnk.net to c/selfhosted@lemmy.world
11 comments fedilink hide all child comments
 

Currently, I have two VPN clients on most of my devices:

  • One for connecting to a LAN
  • One commercial VPN for privacy reasons

I usually stay connected to the commercial VPN on all my devices, unless I need to access something on that LAN.

This setup has a few drawbacks:

  • Most commercial VPN providers have a limit on the number of simulations connected clients
  • I either obfuscate my IP or am able to access resources on that LAN, including my Pi-Hole fur custom DNS-based blocking

One possible solution for this would be to route all internet traffic through a VPN client on the router in the LAN and figuring out how to still be able to at least have a port open for the VPN docker container allowing access to the LAN. But then the ability to split tunnel around that would be pretty hard to achieve.

I want to be able to connect to a VPN host container on the LAN, which in turn routes all internet traffic through another VPN client container while allowing LAN traffic, but still be able to split tunnel specific applications on my Android/Linux/iOS devices.

Basically this:

   +---------------------+ internet traffic   +--------------------+           
   |                     | remote LAN traffic |                    |           
   | Client              |------------------->|VPN Host Container  |           
   | (Android/iOS/Linux) |                    |in remote LAN       |           
   |                     |                    |                    |           
   +---------------------+                    +--------------------+           
                      |                         |     |                        
                      |       remote LAN traffic|     | internet traffic       
split tunneled traffic|                 |--------     |                        
                      |                 |             v                        
                      v                 |         +---------------------------+
  +---------------------+               v         |                           |
  | regular LAN or      |     +-----------+       | VPN Client Container      |
  | internet connection |     |remote LAN |       | connects to commercial VPN|
  +---------------------+     +-----------+       |                           |
                                                  |                           |
                                                  +---------------------------+

Any recommendations on how to achieve this, especially considering client apps for Android and iOS with the ability to split tunnel per application?

Update:

Got it by following this guide.

top 11 comments
sorted by: hot top controversial new old
[–] hungover_pilot@lemmy.world 5 points 3 months ago (1 children)

I do something similar with opnsense and policy based routing. opnsense is acting as both a VPN client and server. The client interface connects out to a commercial VPN, and the server interface listens for incoming connections. Based on what I I want to accomplish I setup firewall rules that use policy based routing to route incoming VPN traffic where it needs to go.

Regarding split tunnel on the client, the Android wireguard app has the option to specify what traffic uses the tunnel based on the application

[–] Emotet@slrpnk.net 3 points 3 months ago

Oh, neat! Never noticed that option in the Wireguard app before. That's very helpful already. Regarding your opnsense setup:

I've dabbled in some (simple) routing before, but I'm far from anything one could call competent in that regard and even if I'd read up properly before writing my own routes/rules, I'd probably still wouldn't trust that I hadn't forgotten something to e.g. prevent IP/DNS leaks.

I'm mainly relying on a Docker and was hoping for pointers on how to configure a Wireguard host container to route only internet traffic through another Wireguard Client container.

I found this example, which is pretty close to my ideal setup. I'll read up on that.

[–] tootnbuns@lemmy.dbzer0.com 3 points 3 months ago (1 children)

I just read that tailscale and mullvad offer a joint service where traffic outside your tailnet always exits through mullvad

[–] Lifebandit666@feddit.uk 1 points 3 months ago

My problem with this solution was that I have signed in to Tailscale via my Google account, and I have to buy Mullvad through Tailscale, linking my Google account to the Mullvad account.

What I wanted to do was have my own Mullvad account and route Tailscale through it, but that wasn't possible, I had to have Tailscale manage Mullvad, which just didn't sit right with me.

[–] brownmustardminion@lemmy.ml 2 points 3 months ago (1 children)

I’ve been toying with this idea but with a mesh network, in my case nebula, after experiencing a similar frustration with limitations on most client devices when trying to connect to multiple VPNs.

One question I’ve been trying to answer is if routing all of these devices to a single vpn endpoint has any negative effects on privacy. Would cycling the IP randomly help to prevent trackers from putting together a profile of activity?

[–] coffeejoe@lemmy.dbzer0.com 2 points 3 months ago (1 children)

Your browser gives them enough information to profile you by they don’t really need your ip address.

[–] brownmustardminion@lemmy.ml 2 points 3 months ago

I guess what I'm getting at is now instead of them tracing your activity to one browser or device, they can more easily group multiple devices since they're all using the same VPN IP.

[–] Decronym@lemmy.decronym.xyz 1 points 3 months ago* (last edited 3 months ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
IP Internet Protocol
VPN Virtual Private Network
VPS Virtual Private Server (opposed to shared hosting)

[Thread #848 for this sub, first seen 3rd Jul 2024, 19:15] [FAQ] [Full list] [Contact] [Source code]

[–] undefined@links.hackliberty.org 1 points 3 months ago

I use Tailscale to do this. I install the software on everything I can, but for resources on the LAN that don’t have Tailscale running I use its Subnet Router feature to masquerade the traffic and connect to those clients.

As for the commercial VPN, it’s a bit more involved. I have a few Exit Nodes (VPS) that take incoming Tailscale traffic destined to the Internet and re-route it via the commercial VPN’s WireGuard network interface.

This was a huge challenge for me (lots of iptables, ip6tables rules) but I have it down to a reproducible script I can provide if you’d like an example.

My next goal is to containerize the two VPS servers into one with Docker. Tailscale is a bit annoying that you can’t have multiple Nodes running on the same machine (hence my temporary two VPS solution).

Note: capitalized terms are Tailscale feature names

[–] jet@hackertalks.com 1 points 3 months ago (1 children)

Even after you get your ideal setup with all your traffic transversing your network to a single host, you have bottle necked the whole network to the speed of that single host.

Usually in networks devices are able to talk to each other directly across switch fabrics and not interdesr with other traffic.

Say you have four devices A B C D each pair trying to send 1GiB/S of traffic to each other over a GbE network connected to the same switch. A,B gets 1 GbE and C,D gets 1 GbE. For a total concurrent speed of 2GbE.

In your model since all traffic has to hit the central wireguard node W first you can only get 1GbE speed concurrently

[–] Emotet@slrpnk.net 2 points 3 months ago

Oh I'm fully aware. I personally don't care, but one could add a capable VPS and deploy the Wireguard Host Container + two Client Containers, one for the LAN and one for the commercial VPN (like so), if the internet connection of the LAN in question isn't sufficient.