One of the problems I've run into with using a vpn service is that many services block IPs from common vpn services. While this may be due to abuse originating from those IPs this still seems like a lazy approach to abuse prevention.

One approach that could work around this in many cases is to run a VPS with a private VPN server on a cloud provider. This is beyond the technical ability of the average user though and costs more than most VPN services.

I run a private VPN server on Digital Ocean and still get blocked by some sites. Zillow.com comes to mind as one I was unable to access recently.

If you can't access Zillow, nothing of value was lost.

Same -- Netflix, craigslist as well

FYI NordVPN works on Netflix. At least it does at the current time. Though I've been blocked on Amazon even just while shopping.

Why would Amazon care? I think I've went to Amazon over Tor and had no problem. I never tried to log in, but they let me browse just fine.

In practice this isn't much of a problem, and I get it with Netflix. I turn off my VPN if I am watching Netflix on my computer and I don't think my privacy suffers too much for it. It feels bad not to have 100% coverage but I honestly don't care who knows what I watch / how often I watch Netflix.

It is more of a problem if you want to run the VPN on your router upstream of your devices, which simplifies management and ensures all devices are protected from ISP snooping, including devices where I don't control the software like a Chromecast.

I had to disable router-level vpn for exactly this reason, which is frustrating.

Amusingly enough, when I did have it on, my Chromecast showed weather data for the vpn endpoint so it's using IP-based geolocation for weather. It could be smarter.

> my Chromecast showed weather data for the vpn endpoint

That is pretty awesome. I feel your pain and that is why I haven't gone and flashed my router even though I finally bought one that will let me.

Are VPN Routers a good option, or do you recommend VPN on each device?

Depends on the traffic from devices. If you don't have crazy high traffic, flash your router with openwrt and install wireguard. If the flash is too small, you can compile your own image with wireguard selected which doesn't need as much flash space.

Next you can choose a cloud provider, which is metered (GCE, AWS, etc), or non-metered like OVH, or Digital Ocean(they don't charge you if you go over the 1TB for now).

Or you can choose a VPN service provider like Mullvad who have wireguard option (PIA should be getting it soon), if you trust them.

Be careful in choosing your provider since you might be annoyed with the latency over time, or just get used to it.

There are tutorials for all this.

You can mitigate the speed issue by adding your own DNS local caches and then start blocking ads, trackers and malware sites and whomever you want (FB is added to the spyware list) using publicly available lists. All of this speeds browsing considerably.

A personalized router is very powerful.

Openwrt by default caches using dnsmasq, but the blocklist is a good idea. The problem is, even the blocklist is sometimes too big for the tiny flashes of some routers.

As another poster said, go with a mini-pc like Qotom. Uses little power, configure however you want (memory, SSD). Most web pages load instantly, and it handles a massive blocklist (Bind9). I'm slowly adding a list of always on packages like sync tools. Also, you can use an AP instead of router attached wifi. Move the Power-over Ethernet AP where you want. Ubiquiti Unifi is far better coverage than my previous consumer grade wifi. Do it all in your favorite Linux flavor.

The average user doesn't want to buy more hardware, and flashing an existing router can be done in an evening.

Also, why Bind9? I don't see what's wrong with dnsmasq, and changing hosts file for blocklist. Also, I often advise against network wide blocklists unless you're the only one using the network, since subtle things break.

Here's what I do: https://news.ycombinator.com/item?id=14780738

The only thing different is that I use wireguard and dnsmasq now.

I find having one piece of low-power hardware that is always on a handy tool. A homeserver+router, basically. I can decloud a lot of things. Having a beefier piece of hardware makes it a non-issue. I try to run things in Docker for modularity. Total hardware cost is competitive with a high-end router, but I think I get more.

Bind9 seems to be better for blocking. RPZ is made for it. I don't think dnsmasq supports RPZ though projects like Pi-Hole use dnsmasq. I'm not positive, but I think RPZ is more flexible. Bind9 seems to do anything you like. I may want to resolve DNS myself and not just forward.

I'm starting to look into configuring Bind9 to have different blocking per user using "views." Some want Facebook, some don't, so I can block accordingly. I'm not sure you can do that in dnsmasq. I did discover subtle things break, like you can't block Facebook and still access Instagram, thus the "views" approach. I don't want to change hosts file on every device, especially mobiles, and can even provide some protection for guests this way. I might do a captive page for a blocked domain and let people bypass in their view if they like, then I can have a "block-first" approach.

I do like network-wide blocking for the malware lists - if anyone acquires malware, it can't phone home (if it's on the list) and I can detect via logs. DNS as firewall seems to be a trend. I'm looking into blocking IPs via iptables as well using public lists. Maybe I'll even setup Snort or Bro. The possibilities are endless.

I use a Qotom mini pc as a router. I configure it with NixOS. It's amazing.

> your own DNS local caches

Doesn't that mean your ISP will now see what domains you are looking up?

Not if you use DNS-over-HTTPS with cloudflare or google.

https://github.com/aarond10/https_dns_proxy

Just clarifying your comment for others: Your ISP would still see the IPs of the sites your packets visit unless you are using an encrypted VPN connection. The DNS-over-HTTPS is a great addition to a VPN.

(the VPN comment was several levels up so some might miss it)

Righto!

Netflix and other video sites will be blocked from a lot of VPS providers. You may be better off going with a professional service that can keep their ips clean

True, but it can be mitigated by setting the routing table for Netflix IPs to avoid the tunnel. There's no standard way this can be done, but it's not impossible.

I did this for a while, and it was a decent headache to maintain. I had pfSense running at the Comcast edge and configured it to route all but specifically whitelisted traffic through a VPN I controlled. Speed was slower than max but acceptable due to choosing a VPS provider close to me, but the maintenance on the whitelist was cumbersome.

I'm interested in the implementation of this, but do not have the technical background to begin. Would you have any go to resources for a beginner?

careful because I already see this coming:

"In order to server our customers better and provide the best possible experience, VPN services will be blocked and will require a Business Tier service. We feel that unless you have a legitimate business reason to anonymize your network traffic we will provide this service in order to protect our subscribers and network integrity. Click Here to Speak to our Sales Representative"