Hacker News Reader

Comment by phil-martin | Hacker News Reader

This is the part that sold me:

“Multi-WAN network toolkit — connect up to 5 uplinks. Configure dynamic routing, failover, load balancing, and firewall rules. Use it simultaneously as a Wi‑Fi hotspot and client. Tunnel traffic through a VPN and multiple gateways. ”

I haven’t been able to find an off the shelf device that provides this. I travel a fair bit and when sitting in an airport mobile hotspotting is often unusably slow. If I can use this to securely connect to public unencrypted wifi, it will make travelling that little bit easier

View on HN

I've used a GL.iNet Slate 7 to bring my home network with me when I travel. It can connect to the internet through WiFi, ethernet, or tethered to a cell phone. The Mudi 7 does the same kind of thing, except it comes with a battery and a cell radio, too.

Thank you so so much! I don’t know why my Google-fu kept failing me but I was just unable to find these products.

You just solved a big worry for me, thank you!

Me too. I use the data plan on phone and connect my Laptop only through my Mudi. It's a little inconvenience for a lot of security.

another +1, been happy with everything I've bought from them

I’ve got an older Slate model and I wouldn’t dream of traveling without it:

* Dumb hotel policy wants you to pay a fee for every WiFi device you connect? Fine. I’m only connecting one.

* VPN back to my house for every device, including a Switch or ereader.

* Last weekend we were in a hotel with no LTE coverage and crummy WiFi. The Slate connected to the hotel WiFi much better than my phone or laptop could. It has better antennas and probably more power because it’s not optimized for battery life. My phone on WiFi: 2800ms pings (!!!). My phone connected to the Slate connected to the WiFi? 15ms.

It’s high on my packing list. I’ll never travel without one again.

I've had a question for a long time: I've been involved with infra most of my life but not strictly networking. Given the vulnerabilities, AI adversaries, etc; understanding I'm a tiny fish in a massive pool; it's still been 15 years since I've felt comfortable allowing external access through VPN into my home network (which has my NAS etc).

I have a friend who does, exposing his Synology NAS and Windows server through Ubiquiti UDR7 on Bell Gigahub, but honestly, I feel he's doing that more out of different risk assessment / "Little knowledge is a dangerous thing" rather than sheer expertise and assurance.

For those who allow VPN access from outside into your home network - how do you have confidence that your configuration is correct, you understand all the config options and their interplay on your modem/router/firewall/OS stack, you're up to date with vulnerabilities and permissions, trust the apps and containers, etc? Are you network admin during daytime, or have fully nerded out about it for years, or have a risk threshold that's met, or something else? :)

My first tech job was working alongside the network admin at a regional ISP. I feel like a n00b on the subject, but objectively, I'm pretty good at it. So basically, I've nerded out about it for years. I do allow VPN access to my LAN, but even that is tightly firewalled with a default-deny policy. Connecting to the VPN just lets you make connections into the LAN's address space, but only for certain IPs and ports. I can connect into Plex running on the LAN, and specific ports on the NAS. I can SSH into a Linux box that doesn't have credentials to connect to anything else. That's about it, really.

I didn't set out to make a hypersecure setup, but approached it with "least access" in mind. I started with the default-deny firewall, and when I needed an exception, I added that one single exception. Honestly, if you follow that principle — don't allow it if you don't require it — you've done 95% of the work a dedicated expert would do.

Thanks for the response :)

That's the approach I took when I had VPN to my LAN ~20 -> ~10 years ago; now I worry about the massive "unknown unknowns" - sure, that Linux box doesn't have access to anything else... officially. But what vulnerability is there on that Linux box, or on the plex server, or anything else on your network, that might enable massive expansion of access?

Oh, I get it, trust me! Professional paranoia is a skill that's served me very well over the years! Especially with AI-driven attacks now: we might be little fish, but it's cheaper and easier to catch little fish than it ever has been.

But there's still a calculated risk. To get into this, someone would have to compromise the VPN, then compromise the firewall, then compromise the reasonably-hardened servers running behind it. Sure, those things might be possible. Even with AI, though, is it likely? I don't think it is.

"A ship in port is safe. But that’s not what ships were built for." - Grace Hopper

I thought about it, but then setting my phones and laptop up to use WireGuard automatically turned out to be easy and reliable enough to not need that.

An I missing something here?

Setting up WiFi once and being done with it is pretty nice. Especially with a large traveling party. Also, some devices are difficult to reconfigure, especially those without screens.

I also have WireGuard on personal devices.

Fair, traveling as a family it makes sense. One thing you have to consider, though, is theft. Once it's stolen you have to invalidate your VPN keys/certs ASAP. Evil maid also becomes totally plausible.

I use the UniFi travel router and it’s… ok? It is inexpensive and small and on paper a simple teleport to your home network. In practice it’s super unreliable. Turns out wifi is complicated.

wouldn't a VPN (on your phone or laptop) solve this?

Yeah I'm confused

People don't always have full control of their devices - I can't install arbitrary software on my work machine, for example, so a VPN back to my house isn't possible without a tool like this. This applies for appliances (eg, media streamer) where you can't install a VPN but want to access content from your home network.

There's other reasons too, such as not having to configure arbitrary wifi connections on your devices, as well as making sure there's zero traffic outside the VPN (eg, during the initial few seconds before an on-device VPN connects).

What I do with my work laptop when I travel is just booting Linux from a usb stick. Then I can do whatever I want and they don't even know about it.

The same orgs I mentioned usually have their BIOS locked down with no booting from removable media. I know mine is like that.

Ah I see, we don't. I think they trust on bitlocker for that (and we have bitlocker with preboot PIN and TPM). Our BIOS doesn't even have a password.

Also we do need that option to reimage, we have a custom image that we install on each laptop. We don't use windows autopilot for reasons :P

I suppose if you've got a number of devices (phone, laptop, tablet), it's easier to enter Wi-Fi details and agree to any captive portal stuff once rather than three times.

It would, but installing random vpn software on IT controlled hardware is a very much against policy

I also have to remember to turn the VPN on before I connect to the wifi, but only some wifis

Sure they are minor inconveniences, but configuring a device once and being confident I haven’t skipped a step or made a mistake and my network connection is secure - that’s a big deal for me.

And not just "against policy but unenforced and whatever" - for most large orgs I've been with, it's a serious, "conditions of employment" issue. There ARE innocent usages of personal VPN on work computer, but the risk and impact of the nefarious ones massively outweighs them.

Reply on news.ycombinator.com