1) The OpenVPN app doesn't block ads... By itself
2) The VPN endpoint can totally do that. Good luck stopping me.

@r000t
Speaking of VPNs, my NordVPN subscription that I had for 3 years is running out, any recommendations?

@WhiteTemplar I don't use consumer VPNs.

My site-to-site and remote access VPNs are all on OpenVPN

@r000t
OK, but the point of paying isn't for the tunnel, its to keep your name off the traffic.

Also, why not wireguard? I'm serious, you're a security expert, so I want to take the opportunity to pick your brain.
@WhiteTemplar

@mistermonster @WhiteTemplar I haven't looked at wireguard. From what I recall, it railroads you into a specific cipher, whereas OpenVPN will let you use any cipher that OpenSSL supports for the control channel, and any number of AES flavors for the data channel.

That means that if you can identify that wireguard is being used, you know exactly which cipher you're attacking.

Also, iirc, wireguard can only be used over UDP.

Wireguard is supposedly designed to have better performance out of the box (OpenVPN requires some tuning), and given that there's fewer things to change, supposedly would be easier to configure.

Wireguard's supposedly got a much smaller codebase, which would make it easier to audit. This is obviously a big plus if you're paranoid. On the flip side, it's way newer; OpenVPN has been hammered on for far longer.

I'd say it's basically the difference between iOS and Android.

@r000t @mistermonster @WhiteTemplar I switched to Wireguard between my home, dedicated server and VMs a few years back. I meant to do a full post on it but never really got around to it. Wireguard is amazingly fast though. I really like it.

I didn't think about how it's locked to one cypher. I'm not sure how the protocol upgrading/downgrading/handshake works. The setup is dead simple compared to OpenVPN though. You generate key pairs and copy the public keys between endpoints. Its as simple as SSH keys.

It is UDP only though. Also if you have multiple IPs, at least on Linux, you can't tell Wireguard to bind to specific IPs. The authors claim this isn't an issue because you can firewall the ports you want open, and Wireguard is very silent/never responds unless you send it a package with the correct signature. I still think this should be configurable.

The other think that's shitty about Wireguard is that it only does a DNS lookup once. If you have an endpoint on dynamic DNS, they literally provide a cron script to constantly check if the DNS has changed, and then re-setup the connection!

Despite those faults, it's faster and easier to configure/work with over OpenVPN. It's supported on Linux, OpenBSD and I think FreeBSD too. Your mileage may vary.

@djsumdog @mistermonster @WhiteTemplar How's the roaming/failover/mesh? These are basically nonexistent in OpenVPN