Create Private Network based on TOR

You can use OpenVPN on a home network without a static IP if you use a "Dynamic DNS" provider.

These services work by giving you a DNS (typically giving you a choice between a few domains), and requiring you to run an update client somewhere on your home network. When your IP changes, the update client will tell the DNS provider your new IP automatically.

DynDNS used to provide this for free, No-IP may still do that. A search will reveal other providers.

An important component of a VPN versus a proxy like Tor is authentication. OpenVPN requires you set up a server certificate, and optionally certificates for each connecting client. In this way clients and servers can be verified. Also a VPN will encrypt traffic between hosts before that traffic leaves the hosts.

Tor does not do authentication and does not do encryption in the sense that most people need it for - it's a transport technology that makes the path from you to the destination random, and wrapping traffic in encryption so the intermediate hops cannot look at the conversation - BUT the end hop or exit node can read all traffic - unless encrypted separately!.

You still need certificates if you want to be sure of who you are talking to on the other end of Tor, if you care - and an additional layer of encryption if you don't want that exit node to have access.

Also because Tor is designed to obfuscate traffic flows and depends on volunteer systems to do that, performance will be slower than without it and not consistent.

Nonetheless, you can setup a Tor hidden service, and it will work great for allowing hosts outside your network to access with two exceptions: A) Due to the way Tor works you will not know the incoming IP of users, the incoming IP will be that of an exit node, and B) Tor clients switch circuits every so often (10 minutes IIRC) meaning that every 10 minutes a user's IP may change. So if you have services that cannot handle that, they will break. HTTPS-based services that use cookies to track sessions should be OK but large files may be a problem.

Easiest thing to do will be to set up 1 hidden service for each server listening on a port, and ideally if you have multiple HTTPS-based services you should try to reverse proxy them so they all work on a single port.

Notice I said HTTPS - because if you aren't using HTTPS but plain unencrypted HTTP that exit node can gather information about everything you are doing, like any proxy.

Recent Questions...