A heads up: theres a really nice project called Streisand[1] which provides a multi-protocol VPN with very little effort. You can launch one on a cheap cloud provider (like DO, if their policy allows).
I've used streisand on DO (while traveling in China) and it worked well. There's also a similar project called algo[1] which provides a single protocol with maximum security, in contrast to streisand's multi-protocol flexibility (and increased surface area).
I think a recurrent concern is OpenVPN's reliance on TLS, and its codebase complexity as a result of being built on OpenSSL--but with far less attention and resources and vuln hunting compared to say, actual browsers. Complexity + lack of auditing person-hours is never a good combo. (See https://twitter.com/tqbf/status/806646188158152705)
Matt Green's audit of OpenVPN, when completed, may lead to more light on the matter. Otherwise, we're just relying on informed intuitions.
As a "security people" I think me and tptacek could split a great number of hairs and get not too far on this one, but I am open to new info. I know a lot can hide in the complexity of OpenSSL. Maybe the whole thing with IPSEC was to sway us toward OpenVPN likes. Regardless, I still lean slightly towards OpenVPN
But honestly I am out to defeat ad networks. I only aspire to give nation states indigestion (at a mass scale). Individually if a well funded adversary wants any one of us I think they have us.
Would a 512mb RAM DO server be enough for this? I've been looking for an alternative to a VPN for a while, but it would only be cost effective with the $5 option.
Yes. Your bottleneck will most likely be network and CPU speed as that's used for encryption. Google around for specific numbers, but my intuition is that network will max out before CPU does even on the $5/mo instance.
Why not run a utility that visits random websites to drown the signal from the noise? Imagine this thing running 24/7 and visiting all sorts of sites, including all sorts of porn and fetish sites or whatever is taboo in your culture. Now its impossible to see what I'm actually visiting and you'd be foolish to not realize that these are generated url visits. A bit like how people used to copy and paste 'NSA keywords' into their emails and web postings.
Not sure why anyone isn't proposing this. Far better than dealing with the hassle and performance issues with a VPN. Want my browsing data? Fine, how's 1 million URLs a day grab you?
I've had a few problems getting it running on AWS but setup was a breeze on GCE. So far it's been cheaper (and safer) than most VPN providers I've seen. YMMV
You would be better of putting it on a Digital Ocean and then create / destroy a droplet when you need it. It is what I do and my cost is like $1.50 per month (as opposed to $5).
[1] https://github.com/jlund/streisand