Private VPN gateway for 25 devices

The gateway, installed in a home router in Valencia, serves twenty-five phones and laptops. 2.3 terabytes of traffic have already passed through it. People in Russia call relatives, work and use the internet the way they are used to. Meanwhile the machine is almost idle and could handle twice as many people without a hardware change.

With a commercial subscription, the address is shared by thousands of subscribers, and banks and payment systems recognize and reject such an address. Also, all traffic goes through someone else's company, which decides for itself what to do with it. A personal gateway sits at the homeowner's place, and they give access only to their own people.

The gateway runs five independent channels on two different engines. Each one imitates its own kind of ordinary traffic: one looks like a visit to the NVIDIA website, another like a server requesting Debian repositories, a third like a download from python.org. If one method stops working, four remain, and the user just switches a line in the app.

Blocking methods change every few months, and what worked in spring may fail by autumn. That is why Xray and sing-box run on the gateway in parallel and independently of each other. If filtering systems learn to detect one engine, the other keeps working and people on the other side stay connected.

The VLESS channel with Reality spoofs the handshake of a real site and returns its genuine certificate. From the outside, such a connection is indistinguishable from an ordinary visit to that site. In the gateway it is one of five independent channels, each imitating its own kind of ordinary traffic, so that blocking one method does not cut the connection.

Hysteria2 provides a fast channel over UDP and holds video calls well on a poor line. ShadowTLS and AnyTLS hide the connection's fingerprint in two different ways. AnyTLS deliberately breaks the rhythm of packet sizes, which can give a tunnel away regardless of the protocol inside. Together they widen the set of fallback routes for staying in touch with family.

The first version ran on a single-board computer the size of a pack of cigarettes with 512 megabytes of memory. The network port worked through an adapter that cut the home gigabit down to one hundred megabits. When the load grew, the gateway moved to a compact office computer with sixteen gigabytes of memory and a full gigabit port.

The gateway was moved from one machine to another with no service interruption, with 0 days of downtime. Keys and settings were transferred as they were, so nothing changed for the connected people. None of the twenty-five users had to update their configuration, and none of them noticed the whole hardware swap.

The owner opens the web control panel in a browser, with no command line. It lists the people, each with their own profile, their own traffic, and their own subscription link. A new device is added in two clicks, access is revoked in one move, and other users are not affected. The gateway load is also visible in the panel.

All it needs is a phone app and one subscription link. The app pulls the list of channels itself and switches between them. When two new protocols were added to the gateway, nobody had to resend anything: the subscription updated itself. If one channel stops getting through, it is enough to switch the line in the app.

The hardware costs 55 € at cost price, turnkey assembly and setup cost 190 €, 245 € in total as a one-off payment. Technical maintenance is optional at 15 € per month. There is no monthly server fee, and the running cost is just electricity. Once the estimate is approved, the price will not go up.

Twenty-five devices on a commercial service at five euros a month cost fifteen hundred euros a year, every year. A personal gateway costs 245 euros once, and after that you only pay for electricity. The hardware stays with the owner and can serve twice as many people.

Home internet almost always gives a changing address. A background service watches for the change and rewrites the domain record in Cloudflare, which is used as DNS. People connect via a permanent name and do not know the numbers behind it change. Synchronization runs on a schedule, around the clock, with no involvement from the owner.

Remote management is locked down: access is by key only, on a non-standard port, and logging in as superuser is not possible. The panel is hidden behind an address that can't be guessed. The machine runs Debian with no graphical shell, so a device facing the internet has as little extra software as possible. The settings are kept in a backup in case the storage fails.