Hacker News Reader

I recently wrote about my home VPN setup in a previous HN thread [1]. But to answer your question, the additional use-cases I have are:

1. I connect to my home file server from all of my devices. This allows me to access my singular master file system from everywhere, which includes all of my documents and data. For example, I can reach my Keepass database from all devices without any need for clumsy synchronization or a third-party "cloud" provider.

2. I view my security camera streams by reaching my on-premises NVR from anywhere.

3. I can print to home from anywhere.

4. My entire media library is available from anywhere.

5. I can reach my family's home intranet web-app from all of my devices (e.g., my phone), natively.

It's true that all of this could be done in a remote desktop window, but it would be less smooth and less convenient. E.g., using Keepass in a remote desktop window wouldn't be as convenient as running it locally (with the kdbx loaded from the file server).

[1] https://news.ycombinator.com/item?id=15586997

What's your upstream speed at home?

I have pretty much the same functionality, including the printing, plus I have a home IoT setup.

Through the MQTT app on my phone I can view and control the home heating, see the output from various sensors (like house temp and outside temp) and control some of the lights - all without having to send my data to a commercial product's cloud service to manage things.

The IoT hub is an Atom-based Mini ITX machine running Ubuntu server, Mosquitto (MQTT message broker), Node-Red (MQTT message handler) and Home Assistant to manage some of the sensors and automation (although Node-Red does most of the work). I'll probably move the whole lot to a Raspberry Pi at some time.

This setup is more of a base to exercise my electronics hobby skills than a serious attempt to automate everything - for example, the home heating IoT stuff overlays (rather than replaces) the traditional electronic timer and temperature sensors on the heating/hot water system, so if the IoT cleverness goes offline, watchdog relays will return control to the old timer/sensors.

VPN access is through a Draytek xDSL Router (2860) - they have good inbuilt VPN support.

What protocol do you use to access your Keepass database from your mobile device?

Are you always connected to your VPN on your mobile device? How much network traffic overhead does it add?

Plus, what's the performance impact on your smartphone? Battery life, available resources.

I've been using syncthing for my keepass file and media sync. Love it.

For everyone else, I recommend https://pritunl.com or https://www.zerotier.com to get VPN access easily. Pritunl is more traditional client/server while ZeroTier creates 1 giant LAN between as many machines as you want.

Thank you for mentioning them!!! Was just looking for a solution for connecting my VPSs across DO, Vultr and Lightsale ZeroTier looks like a perfect solution

ZeroTier is the perfect solution, it's the most genious VPN solution i've seen.

http://packetpushers.net/podcast/podcasts/pq-134-meet-zeroti... <- Here's a Pod with the creator of ZT, once you've listened to it you'll realize how it fits everyone =)

1. My country bans a lot of websites, so I'm often using netherlands VPN to circumvent this ban. Also internet provider at my work sends angry emails when I'm downloading torrents, so I'm downloading them over VPN as well. I don't really see any alternative to VPN.

2. My home server contains some interesting services for me (file storage, movies, music, passwords), but I don't want to expose them to the internet, so I exposed it to VPN and protected with very minimal authorization (nginx checking value of specific cookie acting as a password). So I'm using VPN as a main protection for weakly protected services.

3. I didn't implement it yet, but I want to receive my mail on my home server. Currently mail server operates on VPN server, so I can't really be sure that nobody reads my mail. But operating e-mail requires static IP and reverse-ptr record which isn't available from my home internet provider. So I want to use some kind of port mapping with VPN to transfer everything to my home server. Though ssh would work well here, but I would need to think about reconnecting if network is down, I expect VPN to be more stable.

Many companies (including startups) have internal tools that are web applications. While the more adventurous firms put these on public IPs behind an employee login/SSO system, the more conservative will always have them behind VPN. VNC is a drastically worse UX than a local browser unless your endpoints are really bad.

Honestly, I think you can get a similar security posture with a reverse proxy enforcing client certificates and 2FA (this is what my employer does), but people feel more comfortable trusting VPN appliances from big-name vendors than their nginx configs. Harder to fail open, certainly.

> It also supports things like printing (to a pdf that comes thru the browser as a download)

Wow, didn't know that. Impressive!

I VPN back to my home network when I’m abroad so I can watch US Netflix shows.

Curious but why?

Because he likes watching US Netflix shows.

Shows available on Netflix depend on location.

Being local in a country with a limited Flix library, I have a hard time still paying for the (most excellent!) service.

And since Flix has succesfully banned all commercial VPN's, I am more and more contemplating seting up a "share your own local IP for Flix affectionados" with a couple of people.

How do others solve / done / consider this?

Problem is they not only banned most commercial VPNs but i believe they pretty much banned entire ASN's from watching their stuff. So it's not like you can just go ahead and and set a VPS up somewhere, because it'll be blocked too :(

Ssh to access various servers/git repos/my desktop. Ssh in a local window is always snappy. Terminal access in a RDP/VNC window is not. Not to mention modifier key issues etc...

Guacamole also supports SSH/telnet, and is very snappy thru html5. I autogenerate a guac config file for all the switches on each site at work, and even on high-latency low-bandwith sites on wireless it still works great. Definitely better than a console session via RDP or VNC. This has the extra benefit that you can lock your switches down to only be managed thru certain IPs and enforce session recording.