frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

FreeBSD Home NAS, part 3: WireGuard VPN, routing, and Linux peers

https://rtfm.co.ua/en/freebsd-home-nas-part-3-wireguard-vpn-linux-peer-and-routing/
159•todsacerdoti•22h ago

Comments

age123456gpg•19h ago
You can get yourself a vanity key using https://github.com/AlexanderYastrebov/wireguard-vanity-key tool:

   % wireguard-vanity-key -prefix=NAS/
   private                                      public                                       attempts   duration   attempts/s
   EiBsDB8zt/G4+VWGvxW2ZznNXYmcslcIyJimNR2PpF4= NAS/aex8+IFzLePBYVNGMsSo/1/XeUZcam+Hn8wbNB4= 22619537   0s         112587360
rpcope1•14h ago
Wireguard is cool, but there's some reasons it's worth considering OpenVPN (why I still use OpenVPN anyways). First, OpenVPN has kernel mode now (called DCO, which I think Netgate maybe has upstreamed to FreeBSD); I've found it's performance on hardware with AES-NI on Linux is actually often better than wireguard. Second, there's a lot of quality of life things that just work on OpenVPN that you've got to use a ton of duct tape to make work with Wireguard, a major one being handling DNS record change (think especially dynamic DNS, which is likely if this is IPv4 and a residential connection). This is a huge pain with Wireguard, but just works on OpenVPN. Similarly if you have multiple WAN links, like I do, for OpenVPN it's just two connection stanzas and it largely just works. Again for Wireguard you're adding lots of duct tape to make it work right. I know Wireguard is the new hot thing, but it leaves a lot to be desired in the resiliency and features department.
ZeWaren•13h ago
I use wireguard as my main VPN to connect to my homelab from my phone and my laptops.

I also have an OpenVPN as a backup option, running behind sslh. My same port on my router (443) serves both a webserver hosting photos, and that OpenVPN instance. This allows me to VPN into my home in most firewalled office networks.

bayindirh•13h ago
Why not using tailscale/headscale, which removes the requirement to expose home network to internet at all?
lurking_swe•11h ago
i’m assuming because of the “web server hosting photos”. Probably Immich if i had to guess?

tailscale is fine if you’re somewhat tech savvy, but it’s annoying to show all your friends and family how to “correctly” access your web server. Too much friction. First download the tailscale app, sign in, blah blah. Then you also are unnecessarily bogging down everyone’s smartphone with a wire guard VPN profile which is…undesirable.

I like tailscale and use it for some stuff. But for web servers that i want my whole family (and some friends) to easily access, a traditional setup makes much more sense. The tradeoff is (obviously) a higher security burden. I protect the web apps in my homelab with SSO (OIDC), among other things.

bayindirh•10h ago
I prefer to gatekeep "entry points" with Tailscale. A server can have HTTP/S exposed to the world, but its SSH can stay behind Tailscale to enable defense in depth.

Keeping Tailscale as the only security layer will be foolish of course, but keeping the entry points hidden from general internet is a useful additional layer, if you ask me.

As a matter of principle, I like keep the number of open ports to a minimum. Let it be SSH or VPN, it doesn't matter. I have been burned enough times.

waynesonfire•9h ago
I've applied the same principal to my network. Though, I do have plans to re-open some additional ports beyond just SSH / VPN.

Thinking through how I would achieve this introduced me to the concept of a DMZ-zone. The DMZ places publicly accessible services in a highly locked down environment.

paranoidrobot•8h ago
One of the major advantages for Wireguard over OpenVPN (for me) is that it's quite difficult for random port scans to detect it.

With OpenVPN it's hanging out there responding to everyone that asks nicely that yes, it's OpenVPN.

So anyone with a new exploit for OpenVPN just has to pull up Shodan and now they've got a nice list of targets that likely have access to more private networks.

Wireguard doesn't respond at all unless you've got the right keys.

Also, fwiw - we're approaching 11 years since it was announced, and 5 years since it was accepted into the Linux/BSD kernels.

rsyring•4h ago
> With OpenVPN it's hanging out there responding to everyone that asks nicely that yes, it's OpenVPN.

I believe asing UDP mode and a ta.key go a long way towards making OpenVPN invisible to port scans. Double check docs for details.

Decorative Cryptography

https://www.dlp.rip/decorative-cryptography
60•todsacerdoti•2h ago•13 comments

Databases in 2025: A Year in Review

https://www.cs.cmu.edu/~pavlo/blog/2026/01/2025-databases-retrospective.html
88•viveknathani_•3h ago•13 comments

A spider web unlike any seen before

https://www.nytimes.com/2025/11/08/science/biggest-spiderweb-sulfur-cave.html
72•juanplusjuan•3h ago•23 comments

Revisiting the original Roomba and its simple architecture

https://robotsinplainenglish.com/e/2025-12-27-roomba.html
21•ripe•2d ago•5 comments

Lessons from 14 years at Google

https://addyosmani.com/blog/21-lessons/
1258•cdrnsf•19h ago•540 comments

During Helene, I just wanted a plain text website

https://sparkbox.com/foundry/helene_and_mobile_web_performance
210•CqtGLRGcukpy•7h ago•115 comments

The unbearable joy of sitting alone in a café

https://candost.blog/the-unbearable-joy-of-sitting-alone-in-a-cafe/
626•mooreds•19h ago•371 comments

Show HN: Terminal UI for AWS

https://github.com/huseyinbabal/taws
317•huseyinbabal•14h ago•156 comments

Logos Language Guide: Compile English to Rust

https://logicaffeine.com/guide
39•tristenharr•3d ago•21 comments

Why does a least squares fit appear to have a bias when applied to simple data?

https://stats.stackexchange.com/questions/674129/why-does-a-linear-least-squares-fit-appear-to-ha...
245•azeemba•14h ago•66 comments

Street Fighter II, the World Warrier (2021)

https://fabiensanglard.net/sf2_warrier/
384•birdculture•20h ago•68 comments

Why Microsoft Store Discontinued Support for Office Apps

https://www.bgr.com/2027774/why-microsoft-store-discontinued-office-support/
28•itronitron•3d ago•27 comments

I charged $18k for a Static HTML Page (2019)

https://idiallo.com/blog/18000-dollars-static-web-page
293•caminanteblanco•2d ago•72 comments

Building a Rust-style static analyzer for C++ with AI

http://mpaxos.com/blog/rusty-cpp.html
58•shuaimu•5h ago•26 comments

Baffling purple honey found only in North Carolina

https://www.bbc.com/travel/article/20250417-the-baffling-purple-honey-found-only-in-north-carolina
80•rmason•4d ago•20 comments

Web development is fun again

https://ma.ttias.be/web-development-is-fun-again/
395•Mojah•19h ago•487 comments

Monads in C# (Part 2): Result

https://alexyorke.github.io/2025/09/13/monads-in-c-sharp-part-2-result/
24•polygot•3d ago•19 comments

Eurostar AI vulnerability: When a chatbot goes off the rails

https://www.pentestpartners.com/security-blog/eurostar-ai-vulnerability-when-a-chatbot-goes-off-t...
151•speckx•13h ago•37 comments

Linear Address Spaces: Unsafe at any speed (2022)

https://queue.acm.org/detail.cfm?id=3534854
158•nithssh•5d ago•115 comments

Show HN: Circuit Artist –Circuit simulator with propagation animation and rewind

https://github.com/lets-all-be-stupid-forever/circuit-artist
4•rafinha•4d ago•0 comments

Show HN: An interactive guide to how browsers work

https://howbrowserswork.com/
233•krasun•19h ago•33 comments

How to translate a ROM: The mysteries of the game cartridge [video]

https://www.youtube.com/watch?v=XDg73E1n5-g
18•zdw•5d ago•0 comments

Claude Code On-the-Go

https://granda.org/en/2026/01/02/claude-code-on-the-go/
326•todsacerdoti•14h ago•208 comments

Six Harmless Bugs Lead to Remote Code Execution

https://mehmetince.net/the-story-of-a-perfect-exploit-chain-six-bugs-that-looked-harmless-until-t...
65•ozirus•3d ago•17 comments

NeXTSTEP on Pa-RISC

https://www.openpa.net/nextstep_pa-risc.html
34•andsoitis•9h ago•7 comments

Ripple, a puzzle game about 2nd and 3rd order effects

https://ripplegame.app/
124•mooreds•16h ago•32 comments

Moiré Explorer

https://play.ertdfgcvb.xyz/#/src/demos/moire_explorer
168•Luc•21h ago•19 comments

Agentic Patterns

https://github.com/nibzard/awesome-agentic-patterns
125•PretzelFisch•15h ago•22 comments

Anti-aging injection regrows knee cartilage and prevents arthritis

https://scitechdaily.com/anti-aging-injection-regrows-knee-cartilage-and-prevents-arthritis/
319•nis0s•19h ago•120 comments

Bison return to Illinois' Kane County after 200 years

https://phys.org/news/2025-12-bison-illinois-kane-county-years.html
152•bikenaga•5d ago•46 comments