I have a home server with deployed OpenStack and few cool services that I use, everything is inside my home network. I wanted to use this service outside the home network. I started with hamachi and that works really well but hamachi is not open source and has few limitation. So I decided to use something that is open source and can provide the same functionality as hamachi.

I am thinking about openVPN, but because I didn't have public IP I need something that can provide me connection between devices behind the NAT.

Now my question: Is possible to use TOR or other infrastructure to create VPN inside and connect devices that are behind NAT (i.e. home server)?


You can use OpenVPN on a home network without a static IP if you use a "Dynamic DNS" provider.

These services work by giving you a DNS (typically giving you a choice between a few domains), and requiring you to run an update client somewhere on your home network. When your IP changes, the update client will tell the DNS provider your new IP automatically.

DynDNS used to provide this for free, No-IP may still do that. A search will reveal other providers.

An important component of a VPN versus a proxy like Tor is authentication. OpenVPN requires you set up a server certificate, and optionally certificates for each connecting client. In this way clients and servers can be verified. Also a VPN will encrypt traffic between hosts before that traffic leaves the hosts.

Tor does not do authentication and does not do encryption in the sense that most people need it for - it's a transport technology that makes the path from you to the destination random, and wrapping traffic in encryption so the intermediate hops cannot look at the conversation - BUT the end hop or exit node can read all traffic - unless encrypted separately!.

You still need certificates if you want to be sure of who you are talking to on the other end of Tor, if you care - and an additional layer of encryption if you don't want that exit node to have access.

Also because Tor is designed to obfuscate traffic flows and depends on volunteer systems to do that, performance will be slower than without it and not consistent.

Nonetheless, you can setup a Tor hidden service, and it will work great for allowing hosts outside your network to access with two exceptions: A) Due to the way Tor works you will not know the incoming IP of users, the incoming IP will be that of an exit node, and B) Tor clients switch circuits every so often (10 minutes IIRC) meaning that every 10 minutes a user's IP may change. So if you have services that cannot handle that, they will break. HTTPS-based services that use cookies to track sessions should be OK but large files may be a problem.

Easiest thing to do will be to set up 1 hidden service for each server listening on a port, and ideally if you have multiple HTTPS-based services you should try to reverse proxy them so they all work on a single port.

Notice I said HTTPS - because if you aren't using HTTPS but plain unencrypted HTTP that exit node can gather information about everything you are doing, like any proxy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.