How to setup personal VPN server in less then 5 minutes
This post is mainly for non-technical people who want to setup OpenVPN for their use, simple words no complex stuff.
So you feel convinced that your privacy matters, you do not want anyone to peek your traffic to get to know that you are looking for fancy pink pants for yourself. Whatever reason you have, it is always good idea to protect your traffic using VPN. It is utmost important if you are using mobile internet and public WiFi hotspots - that are newer safe (jut remember that, safe is only things that you do yourself). You go to that coffee shop every day and know people who work there and drink coffee with you, and you think, that using their WiFi is OK, because you know them, what can possibly go wrong?
When you join WiFi all traffic from your phone/laptop is routed via unknown device somewhere on the back of that coffee shop. Someone who runs router can literally do anything with your traffic, that - not only includes malicious actions like stealing credit cards, login information, or directly attacking your device but also can passively record all your activity and then sell your data to 3rd party - and you even cannot imagine how easy it is to setup by any fool (and that’s probably most scariest of all).
To avoid all that risks, there is easy solution: VPN (here precisely OpenVPN). Putting simply: VPN wraps all your traffic info highly secure, encrypted tunnel that terminates on server where your VPN is. Say, you have VPN server in Frankfurt, Germany - wherever you go on the world - your traffic will be always virtually “wired” and encrypted to that Frankfurt datacenter where you host VPN server. I am skipping all the problems related to cryptography and if OpenVPN is 100% secure or not as this is mainly academic talk. For god sake, OpenVPN if maintained with latest releases is safe case closed.
When deciding to use VPN you can select 3rd party services - and there is really plenty of them, cheap prices and so one. If you are careful reader you spot immediately one problem: again you give all your traffic and data to 3rd party - that again can collect and mangle your traffic (example1, example2 and there is more...). That’s sucks.
There is solution to that: host your own, truly private OpenVPN server. But to do that you need a lot of knowledge, right? Well no more! :) I have made some effort to make life easier and start server in couple of minutes.
Of course you still need basic knowledge, like you need to know how to issue simple linux/unix commands, and ability to read with understanding.
have account on one of supported cloud providers (read more in README) with running OpenBSD 6.2 server. This basically determinate where your exit traffic go. I recommend selecting provider that is nice for your data, and actually care for users privacy like Swiss Exoscale. Typically setting account on Exoscale or Vultr takes few minutes.
have ansible installed on your local computer. Ansible process playbook that automatically configure remote machines (servers). In our case - it configure whole OpenVPN server, DNS and Certificate Authority - that issue certificates for you.
SSH key to access servers in the cloud from above step (of course...)
have some OpenVPN client installed. Ansible playbook generate configuration profiles automatically for Viscosity VPN and iOS OpenVPN Connect app - and this is something that I recommend, but you can use any opensource software you want.
Once you have it all, start server of your choice, note it's IP address and clone repository to your local host:
git clone https://github.com/kolargol/openvpn.git
next, go to openvpn dir and edit private_vpn_inventory file by replacing IP_OF_YOUR_SERVER by the real IP address of the server you have just stared. Now, run ansible playbook by issuing following command:
ansible-playbook -i private_vpn_inventory openvpn.yml
when this script complete, your VPN server is ready to use. For detailed descryption, please see README on github.
Now, you need encryption keys to connect to the server and configuration profiles. This are generated by ansible script, and to copy them to your local host, do:
scp root@SERVER_IP:/etc/openvpn/export/archives/* .
this will copy two archives, one: Desktop and second Mobile as names states - one is for desktop, second for iOS. You can issue as many certificates as you need, see README how to do it. Untar the archives by
On Desktop open Viscosity and go to:
Preferences-->Import Connection-->From file
and select .visc profile, save, connect. Hurray. That's all.
On iOS - connect iPhone to iTunes using cable, go to application data and search for OpenVPN app and add all files that are in Mobile archive. Sync with iTunes and disconnect cable. Next, on your iPhone - go to OpenVPN app settings in General tab, set options as follows:
Seamless tunnel -> ON Connect via -> Any network Reconnect on wakeup -> ON Protocol -> UDP Compression -> No Connection timeout -> None Network state detection -> Full IPv6 -> Enabled Minimum TLS version -> TLS1.2 Google DNS fallback -> OFF Layer 2 reachability -> ON
pfiu. Open OpenVPN app, you should see request to add new profile, accept. Once it is set you can use troggle in General settings to connect to VPN.
refer to README if you see for detailed information
playbook setups IPv6 and IPv4 dual stack, if you do not know what is that, no worry, say to your frieds - you will be cool
DNS resolver enables DNSSEC, that makes you even more secure
if you live in China see master branch with scramblesuit :)
if you decide on Exoscale please use my reference code gLrEOdv5hVgv or register from this link, you will get 50 CHF credit after second payment - that's amount will let you use VPN server for free for next 5 months