WireGuard as VPN Server on Kubernetes with AdBlocking

WireGuard as VPN Server on Kubernetes with AdBlocking(codingcoffee.dev)

113 points by coding_coffee 5 years ago | 37 comments

syoc 5 years ago |

This writeup uses AdGuard for ad blocking, specifically "AdGuard Home". The "How to setup?" link from their homepage pointing to their github repo says that you accept a EULA[0] on clicking the link. The EULA seems to directly contradict their repo GPLv3 license. [1]

[0] https://adguard.com/en/eula.html [1] https://github.com/AdguardTeam/AdGuardHome/blob/master/LICEN...

ehsankia 5 years ago | |

For people using network level ad blocking, do you ever run into annoyances where there's a site you want to access and just can't? Mostly links that route through an analytics network. First time you click on a twitter link for example, or some referrer store links. And once you're stuck, there's normally nothing you can do. At least on the browser I can temporary turn off an extension, but I've found that network level blockers get in the way sometimes.

shmoogy 5 years ago | | |

This is why I don't run pihole or NextDNS at the network level anymore, my wife had too many annoyances with slick deals and other things. Whitelists covered most but not everything.

i2shar 5 years ago | | |

There's an android app I use, called FlutterHole that gives you a one click way to temporarily disable the PiHole block. Under the covers it's using an API call.

heavyset_go 5 years ago | | |

AdGuard Home allows you to whitelist domains, and provides an interface to unblock blocked DNS queries directly from the logs.

closeparen 5 years ago | | |

If you run fancy enough network gear, you can run several SSIDs on different vlans and route them separately.

move-on-by 5 years ago | |

I think AdGuard and AdGuard Home are two different products? And so different licensing models.

balladeer 5 years ago | |

EULAs and T&Cs should have a layperson readable maximum characters limit.

opqpo 5 years ago |

I believe that Kubernetes is artificially injected in your setup. You can just run your DNS server on the server and advertise it on the VPN address. You can still address it from anywhere in the VPN.

zelly 5 years ago | |

But then it wouldn't have made the first page

pm90 5 years ago | | |

I did not downvote you but, serious question: is there a need for this kind of snark?

I understand the point that running a kubernetes cluster just for this would probably be hard to justify. But, if you deploy your services to kubernetes already, then this is a nice guide to do so, isn't it?

I find it hard to understand this attitude, especially in a forum dedicated to talk about technology.

opqpo 5 years ago | | |

Never thought of that. But OP maybe liked tinkering with k3s and kilo. But I believe kilo's best use is for cluster to cluster connection. This use case is a bit artificial in my opinion.

pm90 5 years ago | |

How do you run the server? Create a packer image? Init scripts (or something similar)? Keep track of whether it’s up or not?

For developers who have grown up with containers, kubernetes offers the simplest, most familiar way to deploy a service.

I recently had to setup a factorio server. The official guide mentions downloading the binary and using init scripts to get it running. I tried to debug obscure issues with the binary for a few hours before getting fed up and looking for a containerized image; once I found that, it was super easy to start one locally. GCP offers a “container on VM” feature which I then used to deploy the thing in minutes. The experience felt so easy.

Notice that I did not use kubernetes, just something that can run containers. But if I had more apps to run, most likely I would set up one.

panpanna 5 years ago | |

A wise soul once wrote:

"You have a problem. You use Kubernetes to solve your problem. Now you have 8 problems."

opqpo 5 years ago | | |

Kubernetes is a godsend and it solves way more problems than it creates. But I just believe that this simple use case is an overkill. OP just wanted a remote DNS server that is addressable within the VPN. You don't really need Kubernetes or Kilo for that.

RobLach 5 years ago | |

While it seems like overkill to set up a kubernetes cluster for this, and honestly, most things...

But if you already have one spooled you this is a valuable guide to throw it onto that infrastructure

zzyzxd 5 years ago | |

Sure you can write a lengthy article to describe how to configure all the apps and servers manually. But with Kubernetes, you only need to throw some YAMLs in there and call it a day.

I don't think "using Kubernetes for running VPN and adblocking servers" is overkill. With k3s, you can deploy a Kubernetes cluster on a raspberry pi in one command. Anything that can run on raspberry pi in one command just can't be overkill in my opinion.

coding_coffee 5 years ago | |

It's not artificially injected into my setup. I already host my blog, and a couple other services on my k3s setup, and I didn't want to bootup another server just to sever as a VPN and DNS

miked85 5 years ago |

Algo [1] is a great option for a personal VPN, and it supports WireGuard + ad blocking. I really don't understand why you would want to use k8s for something like this unless it is just a pet project.

[1] https://github.com/trailofbits/algo

syoc 5 years ago | |

I have a hard time understanding why people use these small script bundles on top of wireguard. The VPN use case is the best documented one with a large amount of guides and the configuration is very simple.

miked85 5 years ago | | |

Because it sets up everything in your VPS as well.

api 5 years ago | |

Getting to the front page? Just Wireguard often will, as will just Kubernetes, but combining the two is a guarantee.

darkteflon 5 years ago | |

I tried this setup for the first time recently (Algo and a Digital Ocean droplet) when traveling and can confirm it was excellent. In particular, you get a surprisingly polished UX for setting everything up in addition to all the usual benefits of WireGuard.

PaulWaldman 5 years ago | |

Can confirm Algo works great. Easy to setup the VPN while still having the benefits of leveraging Wireguard.

Not OP, but maybe it makes sense if you already deploy a set of applications or services on K8s.

maneesh 5 years ago | | |

great unless you want to use it as a vpn to watch Hulu from abroad haha. They require you to use a set of specific providers, which are all blocked by Hulu.

I ended up using openVPN on a home raspberry pi, but I want to figure out how to deploy IPSec or ZeroTier rather than OpenVPN

yegle 5 years ago |

Looks like the author is using Android. Why not just use AdGuard Home as a DNS-over-TLS server (which is supported on Android P and above)? What's the benefit of plaintext DNS over VPN compare to DNS-over-TLS?

poorman 5 years ago |

Cool, but you can avoid half this setup with Tailscale for free...

opqpo 5 years ago | |

Yes you can avoid that open source setup for a buggy and even slower userspace wireguard commercial implementation for only 10$/month per user