Jul 13, 2017 12:23 PM
(This post was last modified: Jul 14, 2017 01:40 AM by Marxist.)
Setting Up your Own Personal VPN
And why it's important
And why it's important
With new laws coming into effect concerning digital privacy being behind a VPN is almost a must now, even in your own home. It is ALWAYS a must to use in public wifi, though. We've all seen tools like Cain & Abel, Kismet, the AirCrack suite, etc. You should all know your data is not secure.
Whether you're in a country that censors your internet, or you're in the US and Congres just passed a law allowing ISPs to Sell your browsing history and much more having a VPN is a must.
I want to compile this quick guide to show how easy it is to set up a cheap and efficient VPN, and how even you could do it too! To protect yourself and your families from security and privacy concerns!
This guide is going to cover Linux servers.
Now, why? Why host your own VPN? In all honesty, can you really trust VPN companies? Yes, there are some trustworthy ones. There are exspensive ones, ones that claim to not keep logs or spy on you, etc. But can you really be sure? Paid/free VPNs have their place, but ultimatly you do not control the data you are throwing into them. For sketchy activities using another VPN may be viable, as the increased amount of users adds to your entropy, but that is never a full-proof protection and shouldn't be relied on. This is more for protecting privacy, not hiding from law.
Whether you're in a country that censors your internet, or you're in the US and Congres just passed a law allowing ISPs to Sell your browsing history and much more having a VPN is a must.
I want to compile this quick guide to show how easy it is to set up a cheap and efficient VPN, and how even you could do it too! To protect yourself and your families from security and privacy concerns!
This guide is going to cover Linux servers.
Now, why? Why host your own VPN? In all honesty, can you really trust VPN companies? Yes, there are some trustworthy ones. There are exspensive ones, ones that claim to not keep logs or spy on you, etc. But can you really be sure? Paid/free VPNs have their place, but ultimatly you do not control the data you are throwing into them. For sketchy activities using another VPN may be viable, as the increased amount of users adds to your entropy, but that is never a full-proof protection and shouldn't be relied on. This is more for protecting privacy, not hiding from law.
Step 1
Finding a host
Finding a host
Firstly, we need to take a look at hosting solutions. For a single user VPN the hardware is a non-issue.
I personally use a $20 VPS from OVH and host 40+ people. Both CPU and RAM are almost uneffected by this load, added latency is negligible and the server has a 100Mbs throughput/unlimited bandwidth.
I also have several $3 VPS hosted by OVH for load balancing, which all host anywhere between 10-15 people at a given time with negligible impact on processing.
I also rent from a few other companies around the globe. My users are generally in areas where speeds under 50kb/s, so they come no where near my server throughputs.
I personally use a $20 VPS from OVH and host 40+ people. Both CPU and RAM are almost uneffected by this load, added latency is negligible and the server has a 100Mbs throughput/unlimited bandwidth.
I also have several $3 VPS hosted by OVH for load balancing, which all host anywhere between 10-15 people at a given time with negligible impact on processing.
I also rent from a few other companies around the globe. My users are generally in areas where speeds under 50kb/s, so they come no where near my server throughputs.
First, You need to ask yourself:
Do I need unlimited bandwidth?
What speeds am I looking at?
What is my under-load bandwidth requirements?
How much latency increase (ping) is considered negligible?
Why am I looking for potection?
DOES THE HOST HAVE TUN MODE
Do I need unlimited bandwidth?
What speeds am I looking at?
What is my under-load bandwidth requirements?
How much latency increase (ping) is considered negligible?
Why am I looking for potection?
DOES THE HOST HAVE TUN MODE
From here you need to do research on hosting solutions. Find hosts that meet your needs. Are you looking to maintain privacy with your ISP? You may want to look into a hosting company outside of your country.
Is latency a concern and would hosting outside of your country cause too much of an issue?
You can still host within your country and mitigate having your privacy infringed on. Generally hosting companies are in huge data centers with lots of data being sent through them. This at least adds increased entropy to the data you are transmitting and receiving while serving as getting it farther away from you and your ISP. You are still terminating in your country, though.
Really look into you requirements and research these companies. You need to make a security-concious decision of where your data is going, how it's going to be processed, the laws of where it is exitting, and how much security vs. convinience you are willing to lean torward.
Another HUGE thing is, ask your host is TUN mode is enabled. Most major hosters will allow this. Smaller ones, you may need to ask.
FOR A LIST OF HOSTS THAT ACCEPT BTC:
http://cryto.net/~joepie91/bitcoinvps.html
Note: Some hosts may allow anonymous registration, some may not.
Is latency a concern and would hosting outside of your country cause too much of an issue?
You can still host within your country and mitigate having your privacy infringed on. Generally hosting companies are in huge data centers with lots of data being sent through them. This at least adds increased entropy to the data you are transmitting and receiving while serving as getting it farther away from you and your ISP. You are still terminating in your country, though.
Really look into you requirements and research these companies. You need to make a security-concious decision of where your data is going, how it's going to be processed, the laws of where it is exitting, and how much security vs. convinience you are willing to lean torward.
Another HUGE thing is, ask your host is TUN mode is enabled. Most major hosters will allow this. Smaller ones, you may need to ask.
FOR A LIST OF HOSTS THAT ACCEPT BTC:
http://cryto.net/~joepie91/bitcoinvps.html
Note: Some hosts may allow anonymous registration, some may not.
Step 2
Preparing your host for a VPN
Preparing your host for a VPN
Once you have your host selected, purchase a server in your desired location using your flavour of Linux. Debian would be a good beginner's choice. This guide is going to cover Linux servers.
First step, you ned to update your package manager and upgrade your system. I will be using Debian for all examples after this.
Code
# apt-get udpate # This updates your package manager with current up-to-date software in your repos
# apt-get upgrade # This upgrades all packages on your system
# reboot # This reboots your serverStep 3 - Installing the OpenVPN Services
And configuring them
And configuring them
Next, we will be using a script created by a Git user named Angristan. This script downloads the most current version of OpenVPN from official repositories, installs it, configures the server with your parameters, generates RSA keys, the certificate authority, creates users and updates the keys.
Here is the link to the official Git. To include source, so you can go through it yourself.
https://github.com/Angristan/OpenVPN-install
The above link covers instructions on the install, however I will also cover them here, covering the same topics and using his screenshots, as they would be indentical even if I took them.
Firstly, we will need to download the script and run it. The following makes an openvpn directory in your home folder and moves to it. Then it downloads the script from the Git, and makes it executable (chmod). It then executes it.
I have you create it's own folder because user .ovpn files are stored in the same directory as the script. This will keep it neat.
Initially the script must be ran as root. PLEASE DO NOT BLINDLY RUN THIS, READ THROUGH THE SCRIPT. NEVER BLINDLY RUN SCRIPTS AS ROOT.
Here is the link to the official Git. To include source, so you can go through it yourself.
https://github.com/Angristan/OpenVPN-install
The above link covers instructions on the install, however I will also cover them here, covering the same topics and using his screenshots, as they would be indentical even if I took them.
Firstly, we will need to download the script and run it. The following makes an openvpn directory in your home folder and moves to it. Then it downloads the script from the Git, and makes it executable (chmod). It then executes it.
I have you create it's own folder because user .ovpn files are stored in the same directory as the script. This will keep it neat.
Initially the script must be ran as root. PLEASE DO NOT BLINDLY RUN THIS, READ THROUGH THE SCRIPT. NEVER BLINDLY RUN SCRIPTS AS ROOT.
Code
cd ~/
mkdir openvpn
cd openvpn
wget https://raw.githubusercontent.com/Angristan/OpenVPN-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
./openvpn-install.shYou will be prompted with this lovely screen.
![[Image: iC0eG6Z.png]](https://i.imgur.com/iC0eG6Z.png)
- • For most users you can simply press enter when it asks for the IPv4 address.
• When it asks for the port you may change it, and I would actually recommend changing it. Some ISPs or public Wifi spots can block this port, as it is the openVPN default used port.
• I personally select UDP. In today's internet networking there is VERY minimal packet loss. TCP in this situation would significantly increase network overhead and possibly slow down your speeds. We select UDP because TCP is an uneeded protocol in this application in today's world and we are trying to make this as seemless as possible for you.
• Next, it asks you for your DNS server. This is important, especially for privacy. Do your research on these DNS services prior to choosing them and choose the one that aligns to your philosophies and ordeals. For example, OpenDNS is huge on fighting for anti-censorship. https://www.opendns.com/about/anti-censorship-policy/
Step 4
Choosing security options
Choosing security options
Now, here's where the magic happens. This is where we decide how your data is secured, why you should make certain choices, and a few links to documentation concerning them.
You will be prompted with these options:
![[Image: 5FD4xMR.png]](https://i.imgur.com/5FD4xMR.png)
AES-CBC is what I personally recommend. It is less cpu intensive than it's counter parts, and secure. It's an industry standard, and you already use it everyday.
128, 192, or 256? Basically, the higher the blocksize the more "rounds" AES runs your data through to encrypt and decrypt. The more rounds, the longer it takes to do. This is also more intensive on CPU processing on both the client and server, but is extremely negligible. The only instance in which I would forsee a major issue with using a bigger blocksize is on a mobile phone application, where it might drain your battery quite quickly. This can be mitigated by using smaller blocksizes, or only using it when on public Wifi to save your data. I personally choose AES256.
You can, however, research the other encryption methods, but I will not be covering them in this guide.
This video does an excelent job at explaining AES principles: https://www.youtube.com/watch?v=7RWP5eO-MPg
Next, we will be choosing your key sizes for your server and future clients. As shown in the screenshot and on your screen, 2048 is fastest, 4096 is most secure. The NSA in recent years has moved away from 2048 bit keys for encryption protocols, which may raise eyebrows, for obvious reasons. They now recommend 3072 bit key sizes for government applications. Now, will you have to worry about people breaking your encryption if you use 2048bit keys? Probably not, it is highly unlikely. It would take, literally, thousands of years for an average hacker to exploit 2048bit key encrypted data.
As before with selecting the block size, bigger keys slows down the amount of time it takes to encrypt/decrypt. It also uses more processing power, which can hav a negative impact on battery life.
Choose your block sizes and key sizes very smartly, but make sure it aligns with your end goal.
You will be prompted with these options:
AES-CBC is what I personally recommend. It is less cpu intensive than it's counter parts, and secure. It's an industry standard, and you already use it everyday.
128, 192, or 256? Basically, the higher the blocksize the more "rounds" AES runs your data through to encrypt and decrypt. The more rounds, the longer it takes to do. This is also more intensive on CPU processing on both the client and server, but is extremely negligible. The only instance in which I would forsee a major issue with using a bigger blocksize is on a mobile phone application, where it might drain your battery quite quickly. This can be mitigated by using smaller blocksizes, or only using it when on public Wifi to save your data. I personally choose AES256.
You can, however, research the other encryption methods, but I will not be covering them in this guide.
This video does an excelent job at explaining AES principles: https://www.youtube.com/watch?v=7RWP5eO-MPg
Next, we will be choosing your key sizes for your server and future clients. As shown in the screenshot and on your screen, 2048 is fastest, 4096 is most secure. The NSA in recent years has moved away from 2048 bit keys for encryption protocols, which may raise eyebrows, for obvious reasons. They now recommend 3072 bit key sizes for government applications. Now, will you have to worry about people breaking your encryption if you use 2048bit keys? Probably not, it is highly unlikely. It would take, literally, thousands of years for an average hacker to exploit 2048bit key encrypted data.
As before with selecting the block size, bigger keys slows down the amount of time it takes to encrypt/decrypt. It also uses more processing power, which can hav a negative impact on battery life.
Choose your block sizes and key sizes very smartly, but make sure it aligns with your end goal.
Step 5
Create a user and watch paint dry
Create a user and watch paint dry
Now, you will be prompted to create a user. The username doesn't matter, you can name it whatever you wish. It should be noted that only one user can log in with each .ovpn file. This is so another use cannot hijack your session. I will go over creating more files later in the guide.
Now that you have pressed enter, the script will download OpenVPN, all it's dependencies, everything for crypto, etc etc. Pretty much everything you need for this. It will also set the OpenVPN service to run at boot, so when the server reboots it will be back up and running.
It will then generate RSA keys, this could take 5 minutes, it could take 3 hours. It depends on how "lucky" you get. It is calculating perfect prime numbers, extremely large prime numbers. Not only that, but it divides the prime number in half, and if the half isn't also a prime number it discards it and calculates a new one. There are arguements that perfect primes and primes are not more or less secure than eachother, but I will no go into semantics about that.
Now that you have pressed enter, the script will download OpenVPN, all it's dependencies, everything for crypto, etc etc. Pretty much everything you need for this. It will also set the OpenVPN service to run at boot, so when the server reboots it will be back up and running.
It will then generate RSA keys, this could take 5 minutes, it could take 3 hours. It depends on how "lucky" you get. It is calculating perfect prime numbers, extremely large prime numbers. Not only that, but it divides the prime number in half, and if the half isn't also a prime number it discards it and calculates a new one. There are arguements that perfect primes and primes are not more or less secure than eachother, but I will no go into semantics about that.
Step 6
Setting up the firewall
Setting up the firewall
You have the services running. Now, we need to confiure iptables, or your firewall on the server, to forward traffic correctly. Below is everything you'll need to do so.
Code
iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 1194 -j ACCEPT #change dport to whatever you selected previously. This allows connections on this port.
iptables -A INPUT -i tun+ -j ACCEPT #This allows TUN interfaces on the server
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT # These three allows forwarding through the tun interface to the eth0 interface. If "ifconig" does not have eth0 replace eth0 with your ethernet device name.
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE #This set up NATing
iptables -A OUTPUT -o tun+ -j ACCEPT #This is optional if your output line in iptables is not set to DECLINEStep 7
Adding more users and devices
Adding more users and devices
So, you now have a fully functioning OpenVPN server in the country you desire, with the encryption standards you prefer. But only one user can connect right now. Simply run the script again and you can add a new user, revoke users, or uninstall everything.
Running the script again and creating a user will not take long at all, maybe 5 seconds. It will throw their .ovpn file in teh same directory.
The way it is set up right now, it is using TLS for authentication, and your keys for encryption. Only one device per session per key can be connected at a time. So you will need to make one for each device you plan on connecting at the same time.
Step 8
Connecting to the VPN
Connecting to the VPN
Now, you need to get the files off of the server. You can use SCP on a Linux box for this.
You can also use FileZilla, or any SSH/SCP enabled software. You simply download the file to your device and connect.
As there are a plethora of devices and operating systems that can be used to connect I will provide a few links to guide on how to connect to OpenVPN servers.
Official OpenVPN documentation for clients
OpenVPN official guide for Windows
Official OpenVPN Guide for Linux
Official OpenVPN Guide for MacOS
Unofficial Guide for iOS
NOTE: iOS users MUST either load via iTunes like this example, or you can email them to yourself, and open the attatchment in the "Mail" App, then select OpenVPN Connect
Unofficial Guide for Android
The TL;DR
For people like me
For people like me
Buy a server/VPS
Enter through all the bullshit, should take 5 minutes-3 hours depending on key generation
Download the files
Follow the guides to connect to the server
Code
sudo su
apt-get udpate
apt-get upgrade
reboot
cd ~/
mkdir openvpn
cd openvpn
wget https://raw.githubusercontent.com/Angristan/OpenVPN-install/master/openvpn-install.sh
sudo chmod +x openvpn-install.sh
sudo ./openvpn-install.shDownload the files
Follow the guides to connect to the server
This is my first guide. If you find any errors let me know. I will fix it prompty.
If you need help with this I can help set it up in my free time for free.
I take people's privacy seriously, and I want to spread this little bit of knowledge with you guys.
I will be fixing formatting on this over time. I know, it's an eye sore.
I'm shit at designing these. I used the following tool to format text:
https://xadamxk.github.io/ThreadDesignGenerator/
[Beta Release] Thread Design Generator
yes
![[Image: pia_banner_3.png]](https://www.privateinternetaccess.com/affiliates/banners/pia_banner_3.png)
