Looking for Best Practices on Setting Up a Secure, Multi-Device VPN Solution

25 Haz 15:54

对多设备 VPN 的稳定性、安全性和易用性要求比较高，我个人组合过 WireGuard + AdGuard Home + Unbound 做自托管方案，分享下核心经验： 首先选协议就直接干掉 OpenVPN，手机端的链接建立时间太长、后台唤醒时直接 GG；如果网络只有桌面级设备那倒还能忍。我用的路由器 + 手机 + 笔电三者全家桶现在都跑 WireGuard，线上 50 MB 下行能稳定到 45 MB+，UDP 直接穿 NAT 所以隧道恢复也比 TCP 快不少。DNS 那块我把系统 DNS 改成 AdGuard Home，然后 Unbound 给 AGH 递归解析，既能防 DNS leak 又能本地缓存加速，手机端加个配置档一键导入即可。Split tunneling 我是按需开：需要全局科学上网的设备（比如 Kindle）就走隧道，其他本地局域网设备直接直连，既不影响内网打印机投屏，自己家里访问 NAS 也不费劲。服务器位置我选日本 AWS Lightsail（东京），延迟够低（国内玩家跑到 HK 或者 SG 也差不多），且 GCP 的 Seoul 套餐偶尔会出现“韩国用不了 YouTube”的奇葩情况，建议先用 Ping 或者 mtr 自己测一下线路再决定。 最后一点踩过的坑：一定手动检查每台设备的「VPN 睡眠锁」设置，iOS 17 后后台默认会断连，得在设置→VPN→自动连接里把「始终保持连接」打开；Android 则在设备管理器里把 VPN 标记为“不可优化”，这样才不会被系统杀进程。路由器端记得把端口转发规则加到防火墙白名单，否则每次路由重启或者脚本刷新后连接又得重新 set up 一遍。

25 Haz 16:19

I’ve run into this exact problem myself when setting up a VPN for my home lab, my day-to-day laptop, the wife’s phone, and my travel router. My first attempt was OpenVPN on a VPS in Frankfurt. It worked, sure, but every phone call or video stream was 3-4 seconds behind—buffering city. Switched to WireGuard after reading some benchmarks and the difference was night and day: upload tests jumped from 30 Mbps to 80-ish, latency stayed under 20 ms. I kept hitting DNS leaks when I forgot to set systemd-resolved to ignore the VPN’s DNS push. Fixed it by pushing the router’s own Quad9 DNS over DHCP, so everything—even the smart TV—routes through the tunnel. Split tunneling was a hard no after an HR login page flagged my presence in a country I wasn’t actually in—tunneling everything back home solved that mess. For server placement, I tested a few regions: Frankfurt and Tokyo are great for speed, but Singapore’s jurisdiction scared me, so I landed on Amsterdam where the provider is outside the 14 Eyes but close enough. Latency to SE Asia dropped by 30 %, and I still get privacy when I need it.