For the dynamic DNS issue, I use Duck DNS, which is free and lets you update your IP with a simple curl call which you can execute in a cron task. This way, you'll always have your IP up to date.
I'm sure someone like Jeff owns his own domain. If he hosts the primary NS himself, it's easy as pie. If it's hosted by Google Domains, also easy as pie.
@@sophiophile well, not easy as pie exactly, self-hosted, you would need to set up some way to actually update that, which would probably mean setting up stuff like TSIG keys and whatever, and then using those keys on the machine updating the records, and such...but yeah, it's not that hard either, and most dns hosting services do indeed have pretty easy APIs
@@sophiophile he said in the video that he uses a vps to send the IP to it, and then manually change it in the DNS records of his domain. Also, I don’t know why are you telling this to me. I just shared an option that I think it’s quite good, like many others shared their own options.
@@lidbergtech neither cloudflare nor zerotier can be self-hosted, lol but sure, it's easy to use one of the many ways to get the job done, if you don't care about that and do note we were talking about "If he hosts the primary NS himself", not "how can it possibly be done"
For people with CGNAT, what you can do is setup a VPS as the middle man. Setup wireguard onto the vps and on a device on your home network, and you can setup wireguard on the vps to forward requests or ports to your home network. This is basically what services such as tailscale do. I use this setup to host a mail server on my local network. No need to open ports on my network
This. Relatively easy to setup, you can host servers literally anywhere* as long as there is internet and it's super flexible. Just remember to have the clients keep their connection alive so the VPS is allowed to talk back to them.
What if I have a corporate network with public static IP and I want to establish a VPN between that and the LAN network of a 4G broadband router behind CGNAT. I need to access an IP camera in that 4G router's LAN
If you need a privately hosted VPN and must be behind a CG-NAT, your best bet is to set up set up a one-to-many IPSec tunnel with NAT traversal. It'll require a bunch more setup & understanding of networks, so for most people Tailscale & Zerotier are better, but it can be done. Also minor thing, no RaspberryPi has cryptographic extensions, which is why it's so slow. If you need more speed it's *possible* you've got a router with AES-NI instructions, otherwise your home PC, old laptop, or an SBC that's a little beefier than a Pi would do the trick.
Tailscale have been working wonders for me, is technically an overlay network but is using wireguard under the hood, they have clients for Truenas (using the truecharts repo), OpenWRT, PFsense and even there are some experimental clients for RouterOS (mikrotik). I'm limited by my 10mbps upload speed but the overhead is not so much so I can stream 1080p content without transcoding.
One thing to add (especially for macbook/iphone/ipad, not tried it on windows/android): If you still want to use your private vpn for security reasons (like public wifi) you can enable "On Demand Activation" in the client. Then activate whatever you need and set your home wifi SSID as an exception. This way if you have enabled the vpn profile it will automatically connect to your vpn whenever you're not at home (depends on your configuration). Really helpful if you have public wifis that are set to automatically connect and you are in range without knowing it. You have to disable split tunnel (or change the allowed IPs correct) but I'm not 100% sure how to do that at the moment. I suggest you create a second profile for it but importing the same profile a second time works when you name it something else.
I already had Pi-Hole installed. I followed this video after pausing, replaying at a slow speed to see what I was missing. I was able to get the VPN running perfectly on my Pi 4 Model B with my Samsung 22 Ultra. It worked so effortlessly on the first try. Now I can use public wifi and not be worried about people monitoring what I an doing. Thanks for posting this video.
1:36 traceroute can also show more than one hop if you are using a separate router from your ISP's modem. In that case, you'd likely see two hops, one of which is the router in front of the modem.
Indeed, but if you know enough to put a 3rd party router in, you likely already know enough to figure that out...or setup the VPN on your router and eliminate the need for a separate VPN server. Of course, router VPN servers tend to be a bit slower due to low end SoCs, but if you are already on a woefully asymmetrical ISP (I really hate DOCSIS for this), this won't likely matter much and will be similar to your upload speeds, anyway. Still a great video for the average not-as-techie power user! 😎
Tailscale's great, but as Jeff's clearly wanting to do this without any third-party cloud help -- other than his ISP, his DNS provider, his VPS provider, etc. -- it's fine. After all, Tailscale is built on Wireguard, and is really a cloud service to make configuration and discovery easier. I have both. I use Tailscale most of the time, but Wireguard is also there just-in-case.
And just like that something I'd been meaning to set up for years was done thanks to this video. I was hoping to waste a whole afternoon setting this up but annoyingly I was done in about 10 minutes. Thanks Jeff!
I've been using this for a year or more now. It's great that with Android at least it adds the wireguard tunnel into a quick access button next to my wifi and torch. Don't even have to open the app to turn it on, it's been great.
Thanks for sharing this video and your thoughts & experience. I am retired network engineer, Cisco routers, cybersecurity consultant and more beginning with FORTRAN 1 when was sophomore @ Lane Tech H.S in summer workshop @ Illinois Institute of Technology. Over years I learned enough programming languages to make my head spin. Within the next month I’m hoping to upgrading to Fiber Optic local service provider. You motivated me to dust my Raspberry Pi off & explore PiVPN.
I am behind NAT and use Windscribe to deal with this issue. They offer port forwarding and can be a great alternative to dealing with NAT. I run Windscribe in a Docker container and Wireguard in another container. When I need to connect to my home network, I connect through the Windscribe IP to get into the Windscribe container which is then setup to forward the connection to the Wireguard container. It does of cause provide a bit more overhead because you are basically nesting VPN connections, but I have not had any issues with my use cases.
Good video. It would have nice to also cover local dns resolution. Especially from mobile clients that's handy. And a comparison to other options like zerotier would have been nice, too. That should be enough content for a 2nd video :)
Hey fellow Jeff, Consider using IPv6 either within your VPN, or for your VPN ytansport and you might, emphasis on might, be able to sidestep some of those limitations, especially with CGNAT.
IPv6 support globally still sucks. Yeah if it works it's great, but it's better to just always assume you're not going to have IPv6, especially when traveling abroad. Been waiting 20 years for IPv6 to go mainstream, reckon I'll be waiting another 20 lol You could implement both an IPv4 and an IPv6 VPN, but I always just target the lowest common denominator to accomplish what I need.
IPv6 works fine for me to deal with CGNAT. Some WiFis don’t provide IPv6 but at least over 4G it always works, so it’s fine for smaller tasks like checking HomeAssistant while travelling
@@BrianCroweAcolyte Yes. My home VPN will use IPv6 for the tunnel if it's supported and will pass both IPv4 and IPv6 through the tunnel, but it seems to be extremely rare that IPv6 is supported in public places that I connect from. A lot of people regard IPv6 as an extra complication causing extra attack surface with no real benefit, and while I have some sympathy with that view, I do like to have IPv6 on my own networks when possible.
@@davidberschauer1330 Here in the UK, I've literally never ever come across a 4G connection with IPv6. Though, I have seen some things that hint that maybe one of our networks is slowly working towards allowing IPv6.
YMMV, but I've found, in the states, that IPv6 is available and works in most places that i am, with the exception of retail wifi (most specifically a local chain of coffee shops that i frequent). My mobile provider (T-Mobile) def has working IPv6...in fact, their network is v6 *only* with an adaptation layer on top of it to make v4 work. I use v6-only for my personal setups almost completely because it ends up being *easier* to work with.
Will you be making a more in-depth video about tailscale? Also with the inclusion of self hosted orchestration using headscale. I see you gave it a shout out at the end. I've been trying it lately and it's handy. I'd like to see your thoughts on it as well as your ideal use cases. It works great with pikvm too.
Thanks. Actually super helpful. I've been meaning to set up a vpn for a while now since my old openvpn died years ago. wireguard works so well. it's scary how fast it was to set up
Thanks for making this video, Jeff! Just wanted to add that for anyone who's short on time, setting up a self-hosted VPN with Wireguard or Tailscale can be done in less time. But I appreciate the effort you put into explaining this process.
Me: so jeff geerling made a video about self-hosted vpns and how to set it up. if i comment "well, fun fact, setting up a self hosted vpn with either wireguard(with some scripts ofc) or tailscale takes less than duration of this video.", will this go across as a mean comment to him? (like this video is too long dont watch it etc although i dont mean to) ChatGPT: It's possible that your comment could come across as mean-spirited, especially if Jeff Geerling put a lot of effort into creating the video and you're suggesting that it's not worth watching. However, if you phrase your comment in a respectful way and acknowledge the effort he put in, it should be fine. For example, you could say something like, "Thanks for making this video, Jeff! Just wanted to add that for anyone who's short on time, setting up a self-hosted VPN with Wireguard or Tailscale can be done in less time. But I appreciate the effort you put into explaining this process." This way, you're sharing your knowledge while still acknowledging the value of Jeff's video.
@@pcislocked tbh, tailscale is not really self-hosted, and stuff like headscale, which is a self-hosted version of tailscale, can be a bit annoying to set up, and not easy... instead, I'd use something like Yggdrasil Network, myself (or even stuff like tor or i2p, using them for legitimate purposes helps out everyone, and you can also set things up that only specific routers are even allowed to connect to your server)
@@jan_harald yeah tailscale is not technically fully self hosted in terms of management etc, but if your exit node is exposed to the internet, the connection is direct to the server. stuff like i2p is a bit too much for a normie like me xd
@@pcislocked I've been using Tailscale for a few years now, and it is fantastic, but I've had recurring problems with it failing to work without intervention after updates to either itself or Windows. Sometimes it seems to stop working for no reason at all. I've resorted to installing a secondary remote access program for the times when I need to remotely make Tailscale work again.
@@zoopercoolguy I've used Tailscale for several months but have never experienced the problem that you have. I'll tuck that away in case I do though and know that the issue is not unique. Thanks JB.
'tracert' is probably a bygone era of Windows that does not have long filename support as 'traceroute.exe' would be longer than the 8.3 format for filenames
I'm behind CGNAT and have been using tailscale for a couple years now. I've been so impressed by their service and how they keep expanding features. They are also very transparent in how they build their service. So although it's not zerotrust, its good enough for me.
I have the exact same Router as Jeff Geerling, - ASUS RT-AX86U, where you can run a VPN server on that device, thats both faster, and easier to setup than PiVPN, supports wireguard and DDNS. Also the router is already an always on device. Though before I have used PiVPN on a pi for many years to solve this exact problem, and it just works!
Wireguard is built into my ASUS RT-AXE7800 router. It works great. I have a 1gig/1gig fiber line from Frontier, I connect to it from work. Jeff, I saw that you have some variant of an Asus router, you should be able to run Wireguard right on the router from the VPN tab, I'd like to see a video on that
With zerotier you can also create a tunnel with your network, and with some configuration, you can even use your internet, and it doesn't matter if you are with CGNAT
Great Video. For my VPN to home use i am using Tailscale with exit-node and subnet advertising. I found out that for some reason PiVPN / Wire guard slows down speed more than Tailscale does. Weird. Anyways. Been using Tailscale for over a year now with not one single day being a problem.
Jeff mentions that behing CG-NAT you can't use a dedicate IP address. I get around this by using CloudFlare and their tunneling application cloudflared. It creates a DNS entry automatically (if you have your DNS hosting with them, otherwise you have to manually register with your registrar) and then you can use that name to connect. My ISP is Xfinity/Comcast, which definitely uses CG-NAT on multiple layers, I can access RDP, TrueNAS, PVE & Hosts, File shares, etc. The only thing I've had issues with is actually setting up the VPN portion so that my phone uses that instead of its routing. This I think is partly due to cloudflared does not current support UDP connections
What's the latency and speed of this kind of solution compare to ExpressVPN (provided I buy a good VPS from cloud service), I feel ExpressVPN is not fast enough for my need, wondering should I build a VPN myself, but if it's not going to be faster and lower latency compare to ExpressVPN, I won't bother to try. Any advise would be highly appreciated, thanks!
I manage my own cloud-based ad-blocking VPN: . I pay $5/month to have a cloud-based Linux VM available with a static IP. . Installed Pi-Hole and OpenVPN on my remote VM. . Use the free OpenVPN client on all my computers and phone. That's it. It's not fast but gets the job done and allows me to show up as connecting from the US whenever needed. It also provides ad-blocking capabilities to any WiFi network I'm connected to, very useful on the road and also when connecting via mobile internet.
I do basically the same, but I use OpenVPN on port TCP-443 for sidestepping the restrictions on corporate firewalls. I tried to do the same with Wireguard but Wireguard is UDP only and UDP protocol is locked in some corporate networks. Amazingly, I can even play games with Moonlight or Steam Link with only 10ms added latency from my work or other people houses (in the same city. I haven't tested that from other cities). My internet provider is FTTH with 800mb/s Symmetric without CG-NAT so bandwidth is not an issue.
well there are a lot of solutions. I usually just have anydesk and teamviewer setup, but for software projects i have done, in case of ip changes, instead of manually changing the ip after getting a notification, you can change the domain or subdomain settings automatically, i am pretty sure namecheap has an API you can use, not sure about other providers/registrar, but it was fairly easy to create a small service/program to check and update the ip from local device. In case of mobile data, the device behind the network can connect to a cheap-ish $5 or so VPS, and the other computers can connect to that server to create a network. tailscale i wanted to test out but didn't have the time.
why not tailscale or zerotier? They're newer in how they work, no need to open ports on router, way easier... take a look! Oh, no need for a public ip, too, they work no problem if you're natted :)
I thought after he said "are all these terms too technical for you?" He was going to break them down in a simple eady to understand way or say that it's no big deal or something. Instead he basically said "go on and get out of here, boy" 😂😂
Honestly networking is full of voodoo magic and crazy things! It's too easy for someone to mess things up for me to officially recommend it. But breaking things is often the best way to learn.
My old Raspberry pi1 with 512 MB is running OpenWrt with Wireguard and OpenVPN for quite a while already. It's not fast, the oldie but it does the job for me. The advantage of OpenWrt is that is an out of the box router/firewall/etc software with nice management interface.
@@JeffGeerling Indeed, OpenVPN runs approximately 7-8 Mbps and with WireGuard it can roughly double that number. Good enough to stream live TV. I can only guess what a pi4 will do, but I estimate at least a double or triple of those figures.
How do you go about connecting? I have a netbook with OpenWrt that I use as a server (which is behind the ISP's router) and I can't get to the internet. I clarify that I have public IP. The strange thing is that with a Linux distro it does work.
@@francocastilloARRouting may be an issue here as the VPN introduces a new network your isp router does not know of. Either a static route or an extra Nat may do the trick.
@@feicodeboer Fixed by creating a new firewall zone for WireGuard and enabling masquerading in the LAN zone, as well as allowing forwarding between these two zones.
Massive thanks for posting this, and I haven’t even watched it yet! I’ve been trying to use pivpn to get access to my home network on and off for a while, never successfully. I’m sure you will give me the info needed to get it working.
Only 2 days ago did I set up Wireguard at home, it's so much easier than OpenVPN to set up. I use a mini PC as a router so it has plenty of power for my 1gbit symmetric connection.
I think that software defined vpns such as zerotier or tailscale are more convenient. They, for example, suport internal DNSs and by default only route the relevant traffic through this virtual network. Tailscale has a exit node thing to allow routing everything to that exit node machine just like a classical VPN.
According to my testing, Pi 4 is can handle up to 300mbit through Wireguard (Internet connection is 1000down/500up). OpenVPN is much worse (like 150), if you need more, you have to run the VPN server on something more powerful.
Couldn't have asked for better timing on this! This is a lot of what I want to do so I can administer my parents' HomeAssistant RPi that I'm going to set up
Does the connection persists/reconnect and do notifications from hassio still work after it loses the vpn connection? And does it automatically connect to the vpn when i leave my home? I’m still on the fence if i should use this or a reverse proxy.
I use Twingate on my network, I find it easier and better than a VPN as I don’t have to open ports and it’s a bit easier to set up access levels and users etc
Although you need the servers of Tailscale to get the devices to connect to each other I very much prefer Tailscale. It just works, no hassle with configs, no need to set anything up on your router/firewall, no Public IP hassle and it has been incredible reliable in my experience. Plus it is absolutely free for private usage. If you want to setup your own server for Tailscale you could even do that with headscale. And is is also based on Wireguard.
Cool Jeff! I just did a build video of a pfsense firewall, it's super cheap and runs tailscale for VPN access. Tailscale also builds upon wireguard and it simplfies it even further for the end user. No need for additonal dynamic dns. Am working on my next video on how to add cellular failover cheapily and built into the box (IoT sims and funky adapters), so even if the internet goes down or interface fails I can still access the VPN to safely shutdown any machines.
Thanks for this Jeff. I've been ssh-tunneling in for years (which works), but I promised myself I'd tidy it up a bit one day. PiVPN will probably work for me, as I have a couple of Pis already running Pihole & unbound, so this video will help me with that. But man, either I'm getting slower with age, or you're speeding up! It's OK, I'll just have to pause a bit more often so let the info sink in :-) I also plan to move to DuckDNS for DDNS, as NoIP (free option) grinds my gears each month by threatening to expire.
Amazingly timely video! I literally just started setting up self-hosted VPN last night. Got a personal domain + DDNS working, then set up OpenVPN thats baked into pfSense.....just having trouble with the exported profiles connecting back...
That was my trouble with OpenVPN - and which is why I decided to flip over to Wireguard. The app worked a little more seamlessly (didn't have any weird issues).
@@JeffGeerling Well my VPN logs show an error regarding a missing HMAC that suggests a problem with a key definition in the exported profile, so I'm hoping I just missed some detail in the profile definition. And I'm in EXACTLY the same boat you are with asymmetric cable Internet (I'm stuck with awful Cox), 1 Gbps down but 40 Mbps up 😡
If you use Linode or any number of other services, you could have a container that updates your IP address via API if it ever changes. That's now I handle dynamic DNS.
I have 1gig symmetric fiber. My PiVPN on a Pi4 using WireGuard is usually able to push 600-700 mbps to another computer in town with a decent gigabit connection. Sometimes I can get faster and it seems that messing with the CPU governor has some impact, as does overclocking. Back when I used OpenVPN it usually was around 200 to 250 MBPS. If you're upload speed limited on most cable ISPs, it'll probably be able to run at that max speed no problem.
I have been running Pi-VPN for a month now and it works better than the pfSense implementation. I was able to get a full tunnel connection almost right out of the box. I just had to add my Pi-VPN IP subnet to the outbound NAT and voila. I will add a domain redirect to it soon. Since I have cloudflare, I can use the cloudflare ddns updater to update my IP if/when it changes and it will automatically update my records for my domain(s).
Please tell me you didn't just fully expose the QR code for a real VPN account! For those who still want the comfort of running their own Raspberry Pi VPN externally, there are a couple ISPs around the world that will collocate a Pi very inexpensively. EndOffice in Boston, and Best Hosting in Czechia are two I've used for years.
I was thinking this exact same thing. Took the time to make sure and blur all of the important text, but exposed the entire connection profile with a QR code?
Great video! Solid, straight to the point! Could have been an easier alternative to what I setup up literally three days ago with headscale and tailscale! Though I do like the peer-to-peer architecture it has and the ability to add more exit nodes on-the-fly it granted me if I'd so need
Welcome to the Pi-VPN gang! I've been using wireguard installed on my virtual machine server for years now. It's a great project that simplified the whole installation process!
I'm living in an apartment, and their network setup is: they have a modem/router (that connect to the internet), and one router for each room. My tracert has two lines: 1 is the router in my room which I have full configuration, and 2 is the modem which has the public IP address. Now I want to set up a web server in my room, and I need to forward HTTP traffic to the server. I do have static IP address for the computer running the server (192.168.xx.xx). I will use no-ip for DNS. Since I cannot configure the main modem, what do I need to do to forward HTTP traffic to my server? I have thought of VPN service with port forwarding, but after watching this video I think there is another way without using such service. Is that correct?
Can't help but notice you have an Asus router. The newer firmware on the AX models have Wireguard built in. If you do have a Wireguard-capable Asus router (stock or Merlin), how does the admin and performance compare to PiVPN?
Hey Jeff, in my router settings the internal port is not an optional setting when forwarding… what do I do!?
3 місяці тому
I would like a way to print from home to my office printer and also to synchronise the home NAS with the office NAS, which are two WD MyCloud EX2 Ultra. Is a private VPN the way to go?
This video is sponsored by Jeff Geerling VPN!
@RAM_845 Hahah. I comment on people I like to support. Especially if I talk with them outside of UA-cam.
😆
🤭
@RAM_845 hahah nooo. Though I am also in Disbelief that I have known him for almost 5 years.
As a long time user of Jeff Geerling VPN, I can say, stop all the downloading
I'm extremely impressed with the terminal output being a QR code. What a delightfully clever system
“Ok so he’ll copy and open it on something else…oh never mind.” That caught me off guard that even works.
Has anyone already decoded it? 😅
@@stefanmisch5272 it's a Wireguard tunnel config file but the endpoint is spoofed of course and unusable
It basically comes with wireguard server out of the box
The qr code is not really a useful thing .. would make sense just getting the token
For the dynamic DNS issue, I use Duck DNS, which is free and lets you update your IP with a simple curl call which you can execute in a cron task. This way, you'll always have your IP up to date.
I'm sure someone like Jeff owns his own domain. If he hosts the primary NS himself, it's easy as pie. If it's hosted by Google Domains, also easy as pie.
@@sophiophile well, not easy as pie exactly, self-hosted, you would need to set up some way to actually update that, which would probably mean setting up stuff like TSIG keys and whatever, and then using those keys on the machine updating the records, and such...but yeah, it's not that hard either, and most dns hosting services do indeed have pretty easy APIs
@@sophiophile he said in the video that he uses a vps to send the IP to it, and then manually change it in the DNS records of his domain.
Also, I don’t know why are you telling this to me. I just shared an option that I think it’s quite good, like many others shared their own options.
@@lidbergtech neither cloudflare nor zerotier can be self-hosted, lol
but sure, it's easy to use one of the many ways to get the job done, if you don't care about that
and do note we were talking about "If he hosts the primary NS himself", not "how can it possibly be done"
I use Google Domain + DDNS on my Edgerouter, now same thing on my OPNSense box. Pretty much plug and play
For people with CGNAT, what you can do is setup a VPS as the middle man. Setup wireguard onto the vps and on a device on your home network, and you can setup wireguard on the vps to forward requests or ports to your home network. This is basically what services such as tailscale do.
I use this setup to host a mail server on my local network. No need to open ports on my network
This. Relatively easy to setup, you can host servers literally anywhere* as long as there is internet and it's super flexible. Just remember to have the clients keep their connection alive so the VPS is allowed to talk back to them.
What if I have a corporate network with public static IP and I want to establish a VPN between that and the LAN network of a 4G broadband router behind CGNAT. I need to access an IP camera in that 4G router's LAN
Or just use IPv6
If you need a privately hosted VPN and must be behind a CG-NAT, your best bet is to set up set up a one-to-many IPSec tunnel with NAT traversal. It'll require a bunch more setup & understanding of networks, so for most people Tailscale & Zerotier are better, but it can be done.
Also minor thing, no RaspberryPi has cryptographic extensions, which is why it's so slow. If you need more speed it's *possible* you've got a router with AES-NI instructions, otherwise your home PC, old laptop, or an SBC that's a little beefier than a Pi would do the trick.
Tailscale have been working wonders for me, is technically an overlay network but is using wireguard under the hood, they have clients for Truenas (using the truecharts repo), OpenWRT, PFsense and even there are some experimental clients for RouterOS (mikrotik). I'm limited by my 10mbps upload speed but the overhead is not so much so I can stream 1080p content without transcoding.
WireGuard does not take advantage of AES-NI.
Wireguard does not uses AES, but ChaCha, a cipher that works faster on this machine. It uses ARX instructions.
One thing to add (especially for macbook/iphone/ipad, not tried it on windows/android):
If you still want to use your private vpn for security reasons (like public wifi) you can enable "On Demand Activation" in the client. Then activate whatever you need and set your home wifi SSID as an exception. This way if you have enabled the vpn profile it will automatically connect to your vpn whenever you're not at home (depends on your configuration).
Really helpful if you have public wifis that are set to automatically connect and you are in range without knowing it.
You have to disable split tunnel (or change the allowed IPs correct) but I'm not 100% sure how to do that at the moment.
I suggest you create a second profile for it but importing the same profile a second time works when you name it something else.
I already had Pi-Hole installed. I followed this video after pausing, replaying at a slow speed to see what I was missing. I was able to get the VPN running perfectly on my Pi 4 Model B with my Samsung 22 Ultra. It worked so effortlessly on the first try. Now I can use public wifi and not be worried about people monitoring what I an doing. Thanks for posting this video.
1:36 traceroute can also show more than one hop if you are using a separate router from your ISP's modem. In that case, you'd likely see two hops, one of which is the router in front of the modem.
Ah true. So not a bulletproof method!
Indeed, but if you know enough to put a 3rd party router in, you likely already know enough to figure that out...or setup the VPN on your router and eliminate the need for a separate VPN server. Of course, router VPN servers tend to be a bit slower due to low end SoCs, but if you are already on a woefully asymmetrical ISP (I really hate DOCSIS for this), this won't likely matter much and will be similar to your upload speeds, anyway.
Still a great video for the average not-as-techie power user! 😎
@@thewebmachine How difficult is this to set up? Does it depend on the router I'm using?
Personally, I prefer tailscale because I have a much better performance and the use is simpler I find... Thank you for your video.
@@Batwam0 yes indeed, if you have a fixed IP address you will not need to modify whatever the parameter in your router!
Tailscale's great, but as Jeff's clearly wanting to do this without any third-party cloud help -- other than his ISP, his DNS provider, his VPS provider, etc. -- it's fine. After all, Tailscale is built on Wireguard, and is really a cloud service to make configuration and discovery easier.
I have both. I use Tailscale most of the time, but Wireguard is also there just-in-case.
@@tomgidden absolutely ! Thank you for this precision ☺️
@@Batwam0 That's correct. No port forwarding with Tailscale.
You seriously said "I'm a simple man" on a video about making your own VPN lol. Love it
And just like that something I'd been meaning to set up for years was done thanks to this video. I was hoping to waste a whole afternoon setting this up but annoyingly I was done in about 10 minutes. Thanks Jeff!
I've been using this for a year or more now. It's great that with Android at least it adds the wireguard tunnel into a quick access button next to my wifi and torch. Don't even have to open the app to turn it on, it's been great.
for Wireguard, also a notable mention for wg-easy - a dockerized Wireguard server with a GUI.
THATS AMAZING! everything working well, dns, vpn, pihole, like a charm
Thanks for sharing this video and your thoughts & experience. I am retired network engineer, Cisco routers, cybersecurity consultant and more beginning with FORTRAN 1 when was sophomore @ Lane Tech H.S in summer workshop @ Illinois Institute of Technology. Over years I learned enough programming languages to make my head spin. Within the next month I’m hoping to upgrading to Fiber Optic local service provider. You motivated me to dust my Raspberry Pi off & explore PiVPN.
I love that the QR-Code you generated has your "totally real" public IP 😂
I wish you had hidden more easter eggs in that
I almost did but didn't have time today :(
I am behind NAT and use Windscribe to deal with this issue. They offer port forwarding and can be a great alternative to dealing with NAT. I run Windscribe in a Docker container and Wireguard in another container. When I need to connect to my home network, I connect through the Windscribe IP to get into the Windscribe container which is then setup to forward the connection to the Wireguard container. It does of cause provide a bit more overhead because you are basically nesting VPN connections, but I have not had any issues with my use cases.
5:04 How do I grab my ip again? When I do a curl request on that site, it said that I have to pay to request it.
Good video. It would have nice to also cover local dns resolution. Especially from mobile clients that's handy. And a comparison to other options like zerotier would have been nice, too. That should be enough content for a 2nd video :)
Hey fellow Jeff,
Consider using IPv6 either within your VPN, or for your VPN ytansport and you might, emphasis on might, be able to sidestep some of those limitations, especially with CGNAT.
IPv6 support globally still sucks. Yeah if it works it's great, but it's better to just always assume you're not going to have IPv6, especially when traveling abroad. Been waiting 20 years for IPv6 to go mainstream, reckon I'll be waiting another 20 lol
You could implement both an IPv4 and an IPv6 VPN, but I always just target the lowest common denominator to accomplish what I need.
IPv6 works fine for me to deal with CGNAT. Some WiFis don’t provide IPv6 but at least over 4G it always works, so it’s fine for smaller tasks like checking HomeAssistant while travelling
@@BrianCroweAcolyte Yes. My home VPN will use IPv6 for the tunnel if it's supported and will pass both IPv4 and IPv6 through the tunnel, but it seems to be extremely rare that IPv6 is supported in public places that I connect from. A lot of people regard IPv6 as an extra complication causing extra attack surface with no real benefit, and while I have some sympathy with that view, I do like to have IPv6 on my own networks when possible.
@@davidberschauer1330 Here in the UK, I've literally never ever come across a 4G connection with IPv6. Though, I have seen some things that hint that maybe one of our networks is slowly working towards allowing IPv6.
YMMV, but I've found, in the states, that IPv6 is available and works in most places that i am, with the exception of retail wifi (most specifically a local chain of coffee shops that i frequent). My mobile provider (T-Mobile) def has working IPv6...in fact, their network is v6 *only* with an adaptation layer on top of it to make v4 work.
I use v6-only for my personal setups almost completely because it ends up being *easier* to work with.
Will you be making a more in-depth video about tailscale? Also with the inclusion of self hosted orchestration using headscale. I see you gave it a shout out at the end. I've been trying it lately and it's handy. I'd like to see your thoughts on it as well as your ideal use cases. It works great with pikvm too.
Possibly. Since I only used it once and don't run it right now I'd need to do a bit more work for that. Might do either that or Cloudflare Tunnel.
Thanks. Actually super helpful. I've been meaning to set up a vpn for a while now since my old openvpn died years ago. wireguard works so well. it's scary how fast it was to set up
I love hearing everyone say how easy it was and I spent hours trying to get it to work... turns out I have cg-nat...
Thanks for making this video, Jeff! Just wanted to add that for anyone who's short on time, setting up a self-hosted VPN with Wireguard or Tailscale can be done in less time. But I appreciate the effort you put into explaining this process.
Me: so jeff geerling made a video about self-hosted vpns and how to set it up. if i comment "well, fun fact, setting up a self hosted vpn with either wireguard(with some scripts ofc) or tailscale takes less than duration of this video.", will this go across as a mean comment to him? (like this video is too long dont watch it etc although i dont mean to)
ChatGPT: It's possible that your comment could come across as mean-spirited, especially if Jeff Geerling put a lot of effort into creating the video and you're suggesting that it's not worth watching. However, if you phrase your comment in a respectful way and acknowledge the effort he put in, it should be fine. For example, you could say something like, "Thanks for making this video, Jeff! Just wanted to add that for anyone who's short on time, setting up a self-hosted VPN with Wireguard or Tailscale can be done in less time. But I appreciate the effort you put into explaining this process." This way, you're sharing your knowledge while still acknowledging the value of Jeff's video.
@@pcislocked tbh, tailscale is not really self-hosted, and stuff like headscale, which is a self-hosted version of tailscale, can be a bit annoying to set up, and not easy...
instead, I'd use something like Yggdrasil Network, myself (or even stuff like tor or i2p, using them for legitimate purposes helps out everyone, and you can also set things up that only specific routers are even allowed to connect to your server)
@@jan_harald yeah tailscale is not technically fully self hosted in terms of management etc, but if your exit node is exposed to the internet, the connection is direct to the server. stuff like i2p is a bit too much for a normie like me xd
@@pcislocked I've been using Tailscale for a few years now, and it is fantastic, but I've had recurring problems with it failing to work without intervention after updates to either itself or Windows. Sometimes it seems to stop working for no reason at all. I've resorted to installing a secondary remote access program for the times when I need to remotely make Tailscale work again.
@@zoopercoolguy I've used Tailscale for several months but have never experienced the problem that you have. I'll tuck that away in case I do though and know that the issue is not unique. Thanks JB.
'tracert' is probably a bygone era of Windows that does not have long filename support as 'traceroute.exe' would be longer than the 8.3 format for filenames
I'm behind CGNAT and have been using tailscale for a couple years now. I've been so impressed by their service and how they keep expanding features. They are also very transparent in how they build their service. So although it's not zerotrust, its good enough for me.
Yeah I think they do a great job at the whole user experience too.
@@JeffGeerling why didn't u use tailscale?
I have the exact same Router as Jeff Geerling, - ASUS RT-AX86U, where you can run a VPN server on that device, thats both faster, and easier to setup than PiVPN, supports wireguard and DDNS. Also the router is already an always on device.
Though before I have used PiVPN on a pi for many years to solve this exact problem, and it just works!
Both are great ways to do it-I've been working on dropping that AX86U in favor of a box running OPNsense though... we'll see.
Wireguard is built into my ASUS RT-AXE7800 router. It works great. I have a 1gig/1gig fiber line from Frontier, I connect to it from work.
Jeff, I saw that you have some variant of an Asus router, you should be able to run Wireguard right on the router from the VPN tab, I'd like to see a video on that
Nice! I have Wireguard in my Asus RT-AX56U Router as well but not sure how to set it up, can you point me to a guide thanks!
Tailscale is the best for most cases. Especially for those with spectrum/cable internet… you only overlay subnet routes you need!
With zerotier you can also create a tunnel with your network, and with some configuration, you can even use your internet, and it doesn't matter if you are with CGNAT
with Starlink you can use IPv6 for the incoming tunnel connection
If I'm remembering my history, the abbreviated "tracert.exe" probably had something to do with the 8.3 filename length.
0:34 hope you've showcased Wireguard, as this little in-kernel thingie absolutely kicks ass, even in such crippled implementations as on Mikrotiks.
Mikrotik RouterOS v7 has Wireguard and ZeroTier support built in.
Kind of surprised Jeff didn't make an Ansible Collection for this and used that. Then runs that Ansible Collection from a Podman SystemD job.
Great Video.
For my VPN to home use i am using Tailscale with exit-node and subnet advertising.
I found out that for some reason PiVPN / Wire guard slows down speed more than Tailscale does. Weird.
Anyways. Been using Tailscale for over a year now with not one single day being a problem.
Jeff Geerling: "I'm a simple guy."
Also Jeff Geerling: Tries to connect 47 M.2 SSD's, 86 3.5inch HDD, 28 RTX 4090's to a single Raspberry Pi.
Hahaha
Jeff mentions that behing CG-NAT you can't use a dedicate IP address. I get around this by using CloudFlare and their tunneling application cloudflared.
It creates a DNS entry automatically (if you have your DNS hosting with them, otherwise you have to manually register with your registrar) and then you can use that name to connect.
My ISP is Xfinity/Comcast, which definitely uses CG-NAT on multiple layers, I can access RDP, TrueNAS, PVE & Hosts, File shares, etc. The only thing I've had issues with is actually setting up the VPN portion so that my phone uses that instead of its routing. This I think is partly due to cloudflared does not current support UDP connections
What's the latency and speed of this kind of solution compare to ExpressVPN (provided I buy a good VPS from cloud service), I feel ExpressVPN is not fast enough for my need, wondering should I build a VPN myself, but if it's not going to be faster and lower latency compare to ExpressVPN, I won't bother to try. Any advise would be highly appreciated, thanks!
How much easier this would be to follow (and use) if it weren't a UA-cam video, but written instructions. Thanks, Jeff.
Boom! Thanks for posting the link, saved me the hassle while I'm flying home from UK
Very informative. Been looking for a new use for the Pi 4 that used to be hooked up to my tv.
I manage my own cloud-based ad-blocking VPN:
. I pay $5/month to have a cloud-based Linux VM available with a static IP.
. Installed Pi-Hole and OpenVPN on my remote VM.
. Use the free OpenVPN client on all my computers and phone.
That's it. It's not fast but gets the job done and allows me to show up as connecting from the US whenever needed. It also provides ad-blocking capabilities to any WiFi network I'm connected to, very useful on the road and also when connecting via mobile internet.
I do basically the same, but I use OpenVPN on port TCP-443 for sidestepping the restrictions on corporate firewalls. I tried to do the same with Wireguard but Wireguard is UDP only and UDP protocol is locked in some corporate networks. Amazingly, I can even play games with Moonlight or Steam Link with only 10ms added latency from my work or other people houses (in the same city. I haven't tested that from other cities). My internet provider is FTTH with 800mb/s Symmetric without CG-NAT so bandwidth is not an issue.
well there are a lot of solutions. I usually just have anydesk and teamviewer setup, but for software projects i have done,
in case of ip changes, instead of manually changing the ip after getting a notification, you can change the domain or subdomain settings automatically, i am pretty sure namecheap has an API you can use, not sure about other providers/registrar, but it was fairly easy to create a small service/program to check and update the ip from local device.
In case of mobile data, the device behind the network can connect to a cheap-ish $5 or so VPS, and the other computers can connect to that server to create a network.
tailscale i wanted to test out but didn't have the time.
why not tailscale or zerotier? They're newer in how they work, no need to open ports on router, way easier... take a look! Oh, no need for a public ip, too, they work no problem if you're natted :)
I thought after he said "are all these terms too technical for you?" He was going to break them down in a simple eady to understand way or say that it's no big deal or something. Instead he basically said "go on and get out of here, boy" 😂😂
Honestly networking is full of voodoo magic and crazy things! It's too easy for someone to mess things up for me to officially recommend it. But breaking things is often the best way to learn.
My old Raspberry pi1 with 512 MB is running OpenWrt with Wireguard and OpenVPN for quite a while already. It's not fast, the oldie but it does the job for me. The advantage of OpenWrt is that is an out of the box router/firewall/etc software with nice management interface.
It's a great solution if you don't need extra speed!
@@JeffGeerling Indeed, OpenVPN runs approximately 7-8 Mbps and with WireGuard it can roughly double that number. Good enough to stream live TV. I can only guess what a pi4 will do, but I estimate at least a double or triple of those figures.
How do you go about connecting? I have a netbook with OpenWrt that I use as a server (which is behind the ISP's router) and I can't get to the internet. I clarify that I have public IP. The strange thing is that with a Linux distro it does work.
@@francocastilloARRouting may be an issue here as the VPN introduces a new network your isp router does not know of. Either a static route or an extra Nat may do the trick.
@@feicodeboer Fixed by creating a new firewall zone for WireGuard and enabling masquerading in the LAN zone, as well as allowing forwarding between these two zones.
Pro tip if your isp is AT&T. Even on a consumer accounts they will give you a block of static IP’s for $15 a month!.
Massive thanks for posting this, and I haven’t even watched it yet! I’ve been trying to use pivpn to get access to my home network on and off for a while, never successfully. I’m sure you will give me the info needed to get it working.
Jeff, can you share your script (the one you run by cron job) to update your current dynamic IP to your personal VPS?
I am using Tailscale - which is super-easy to handle and set up.
Only 2 days ago did I set up Wireguard at home, it's so much easier than OpenVPN to set up. I use a mini PC as a router so it has plenty of power for my 1gbit symmetric connection.
Use ZeroTier if you have CG-Nat, works fine without any hassel. ZT works also fine without cg-nat.
Starlink now offers Public IP for 250 a month. But that has the 1TB restriction, the regular plan is back unlimited
@jeffgerling I think ur forgetting the second e, oh wait- ur a scammer :(
I think that software defined vpns such as zerotier or tailscale are more convenient. They, for example, suport internal DNSs and by default only route the relevant traffic through this virtual network. Tailscale has a exit node thing to allow routing everything to that exit node machine just like a classical VPN.
According to my testing, Pi 4 is can handle up to 300mbit through Wireguard (Internet connection is 1000down/500up). OpenVPN is much worse (like 150), if you need more, you have to run the VPN server on something more powerful.
Yeah, the most I got internally through lan was around 270 Mbps, so that checks out!
Couldn't have asked for better timing on this! This is a lot of what I want to do so I can administer my parents' HomeAssistant RPi that I'm going to set up
Does the connection persists/reconnect and do notifications from hassio still work after it loses the vpn connection?
And does it automatically connect to the vpn when i leave my home?
I’m still on the fence if i should use this or a reverse proxy.
I use Twingate on my network, I find it easier and better than a VPN as I don’t have to open ports and it’s a bit easier to set up access levels and users etc
It's tracert because of DOS's character limitation of 8 for the name and 3 for the extension.
Another ThinkCentre tiny dude here. These little guys are absolute treasures if you want cheap and reliable PCs for your home lab.
Although you need the servers of Tailscale to get the devices to connect to each other I very much prefer Tailscale. It just works, no hassle with configs, no need to set anything up on your router/firewall, no Public IP hassle and it has been incredible reliable in my experience. Plus it is absolutely free for private usage. If you want to setup your own server for Tailscale you could even do that with headscale. And is is also based on Wireguard.
wg-easy is also a pretty nice option for rolling wireguard with a simple web management UI.
CGNAT Starlink workaround: Starlink Router in Bypass mode, use a third party router with IPv6 support enabled in the settings.
One option to deal with IP address changing is to setup a TOR hidden service which can serve as a backup if your IP changes.
You can self host your own Tailscale cloud with Headscale
Jeff: 30mbps upload is slow
Me: has only 12mbps upload.
Cool Jeff! I just did a build video of a pfsense firewall, it's super cheap and runs tailscale for VPN access. Tailscale also builds upon wireguard and it simplfies it even further for the end user. No need for additonal dynamic dns. Am working on my next video on how to add cellular failover cheapily and built into the box (IoT sims and funky adapters), so even if the internet goes down or interface fails I can still access the VPN to safely shutdown any machines.
Thanks for this Jeff. I've been ssh-tunneling in for years (which works), but I promised myself I'd tidy it up a bit one day. PiVPN will probably work for me, as I have a couple of Pis already running Pihole & unbound, so this video will help me with that. But man, either I'm getting slower with age, or you're speeding up! It's OK, I'll just have to pause a bit more often so let the info sink in :-) I also plan to move to DuckDNS for DDNS, as NoIP (free option) grinds my gears each month by threatening to expire.
Amazingly timely video! I literally just started setting up self-hosted VPN last night. Got a personal domain + DDNS working, then set up OpenVPN thats baked into pfSense.....just having trouble with the exported profiles connecting back...
That was my trouble with OpenVPN - and which is why I decided to flip over to Wireguard. The app worked a little more seamlessly (didn't have any weird issues).
@@JeffGeerling Well my VPN logs show an error regarding a missing HMAC that suggests a problem with a key definition in the exported profile, so I'm hoping I just missed some detail in the profile definition. And I'm in EXACTLY the same boat you are with asymmetric cable Internet (I'm stuck with awful Cox), 1 Gbps down but 40 Mbps up 😡
If you use Linode or any number of other services, you could have a container that updates your IP address via API if it ever changes. That's now I handle dynamic DNS.
Also, ZeroTier as an alt to Tailscale, client and server are FOSS if you want to run your own
Now that PiVPN is no longer being maintained, it would be really cool to see you do a video on how to replace it.
idk why i get this suggested after i struggled for 5 days, i made it but now i find this guy
As a CG-NAT victim myself, I recommend Tailscale a lot! One of my favorite pieces of software
If you have a Fritz!Box Router, you can just enable Wire Guard and you got your vpn in a few seconds.
Thank you, very helpful and just what I was looking for!
Great Video... I wish you a warm welcome to the UK Enjoy your Trip.
Hey @Jeff Geerling, I don't know if you know, but your Asus Router... actually provide hosting OpenVPN server in it's firmware
Also MikroTik ROS v7 supports Wireguard :)
So you don't even need separate device
I run my home VPN on my router. It's a Ubiquiti EdgeRouter X. You can do lots of interesting and/or useful stuff with it, but it's not simple to use.
your ISP collects your traffic :(
I have 1gig symmetric fiber. My PiVPN on a Pi4 using WireGuard is usually able to push 600-700 mbps to another computer in town with a decent gigabit connection. Sometimes I can get faster and it seems that messing with the CPU governor has some impact, as does overclocking. Back when I used OpenVPN it usually was around 200 to 250 MBPS. If you're upload speed limited on most cable ISPs, it'll probably be able to run at that max speed no problem.
PiVPN has now been discontinued, sadly - what could some alternatives be, ideally also able to run on a VM?
Fantastic tutorial and safe travels! ❤
11:02 actually you do always have a public IP . That being an ipv6 address. Almost all carriers have v6 so using that should be no problem.
I have been running Pi-VPN for a month now and it works better than the pfSense implementation. I was able to get a full tunnel connection almost right out of the box. I just had to add my Pi-VPN IP subnet to the outbound NAT and voila. I will add a domain redirect to it soon. Since I have cloudflare, I can use the cloudflare ddns updater to update my IP if/when it changes and it will automatically update my records for my domain(s).
Please tell me you didn't just fully expose the QR code for a real VPN account!
For those who still want the comfort of running their own Raspberry Pi VPN externally, there are a couple ISPs around the world that will collocate a Pi very inexpensively. EndOffice in Boston, and Best Hosting in Czechia are two I've used for years.
I was thinking this exact same thing. Took the time to make sure and blur all of the important text, but exposed the entire connection profile with a QR code?
Welcome to the UK Jeff!
Ha, as I'm typing this, I'm actually on the plane departing the UK! Just didn't have time to finish up the video until last night :)
Great video! Solid, straight to the point! Could have been an easier alternative to what I setup up literally three days ago with headscale and tailscale! Though I do like the peer-to-peer architecture it has and the ability to add more exit nodes on-the-fly it granted me if I'd so need
First and only person that I've seen that is telling realistic use cases and no lofty claims about VPNs
i use what LTT and Lawrence recommended tailscale
Welcome to the Pi-VPN gang! I've been using wireguard installed on my virtual machine server for years now. It's a great project that simplified the whole installation process!
Hi i need wireguard vpn
I need .conf file
Oh, I've been using Wireguard to tunnel traffic from my proxy with public IP to local home server, works reasonably well
I'm living in an apartment, and their network setup is: they have a modem/router (that connect to the internet), and one router for each room. My tracert has two lines: 1 is the router in my room which I have full configuration, and 2 is the modem which has the public IP address.
Now I want to set up a web server in my room, and I need to forward HTTP traffic to the server. I do have static IP address for the computer running the server (192.168.xx.xx). I will use no-ip for DNS.
Since I cannot configure the main modem, what do I need to do to forward HTTP traffic to my server?
I have thought of VPN service with port forwarding, but after watching this video I think there is another way without using such service. Is that correct?
Very helpful video thank you!
There are much better ways to access to your home network like cloudflare tunnels without worrying about ddos and other security concerns
Can't help but notice you have an Asus router. The newer firmware on the AX models have Wireguard built in. If you do have a Wireguard-capable Asus router (stock or Merlin), how does the admin and performance compare to PiVPN?
Hey Jeff, in my router settings the internal port is not an optional setting when forwarding… what do I do!?
I would like a way to print from home to my office printer and also to synchronise the home NAS with the office NAS, which are two WD MyCloud EX2 Ultra.
Is a private VPN the way to go?
I literally figured out how to do this yesterday and then this video comes out...
Dangit, one day too late!
I have this setup successfully setup on my Pi4 with wireguard. But why can't I see my NAS server on my VPN?
It's all fun and games until you have a 4 layer cg nat 😢