Setup Vpn Server Linux Ubuntu

Understanding VPN and Its Importance

A Virtual Private Network (VPN) is a technology that creates a secure and encrypted connection over a less secure network, such as the internet. It enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. This level of security is crucial for organizations and individuals concerned with protecting their data and maintaining privacy online.

Choosing the Right VPN Protocol

Before setting up a VPN server on Linux Ubuntu, it’s essential to understand the different VPN protocols available and choose the one that best fits your needs. The most common protocols include OpenVPN, L2TP/IPsec, and WireGuard.

OpenVPN: An open-source VPN protocol known for its flexibility and security. It’s widely supported and considered one of the most secure options.
L2TP/IPsec: A combination of Layer 2 Tunneling Protocol (L2TP) and Internet Protocol Security (IPsec) that provides strong encryption and compatibility with various devices.
WireGuard: A newer protocol that aims to be simpler, faster, and more secure than its predecessors. It’s gaining popularity for its performance and ease of use.

Each protocol has its strengths and weaknesses, and the choice will depend on the specific requirements such as speed, security, and compatibility.

Prerequisites for Setting Up a VPN Server

Before diving into the setup process, ensure that you have the following prerequisites in place:

A machine running Linux Ubuntu with root privileges.
A static IP address for your server or a dynamic DNS service if you have a dynamic public IP.
Access to the server’s firewall to open the necessary ports for your chosen VPN protocol.
An updated system:
```
sudo apt update && sudo apt upgrade
```

Installing and Configuring OpenVPN Server

Step 1: Install OpenVPN and Easy-RSA

OpenVPN is available in the Ubuntu repositories, and Easy-RSA is a shell-based CA utility that can be used to manage a certificate authority. Install both using the following command:

sudo apt install openvpn easy-rsa

Step 2: Set Up the Certificate Authority

Certificates are used by OpenVPN to authenticate the server and clients. To create these certificates, we need to set up our own simple certificate authority using Easy-RSA.

make-cadir ~/openvpn-ca
cd ~/openvpn-ca

Follow the instructions to configure the vars file with your information. Then, source the vars file and clean up any previous keys:

source vars
./clean-all

Now, build the CA certificate and key by running:

./build-ca

Step 3: Create the Server Certificate, Key, and Encryption Files

After setting up the CA, generate the server certificate and key. You will also need to generate a strong Diffie-Hellman key to set up the encryption:

./build-key-server server
./build-dh
openvpn --genkey --secret keys/ta.key

Step 4: Configure the OpenVPN Service

Copy the example server configuration file to the OpenVPN directory and then edit it to adjust the settings:

gunzip -c /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz | sudo tee /etc/openvpn/server.conf

Within the configuration file, make sure to adjust the paths to the certificate and key files you’ve created and set the appropriate encryption settings.

Step 5: Adjust the Server Networking Configuration

You’ll need to adjust your server’s networking configuration to allow IP forwarding and set up firewall rules to direct traffic through the VPN.

sudo sysctl -w net.ipv4.ip_forward=1
sudo ufw allow 1194/udp

Additionally, configure UFW to allow traffic from the VPN clients to the internet:

sudo ufw allow from 10.8.0.0/24 to any port 80
sudo ufw allow from 10.8.0.0/24 to any port 443

Step 6: Start and Enable the OpenVPN Service

Finally, start the OpenVPN service and enable it to start on boot:

sudo systemctl start openvpn@server
sudo systemctl enable openvpn@server

Setting Up a WireGuard VPN Server

Step 1: Install WireGuard

WireGuard can be easily installed from Ubuntu’s default repositories:

sudo apt install wireguard

Step 2: Generate Server Keys

Generate the private and public keys for the WireGuard server:

umask 077
wg genkey | tee privatekey | wg pubkey > publickey

Step 3: Configure WireGuard Interface

Create a new WireGuard configuration file and define your server’s private key, listening port, and internal VPN subnet:

sudo nano /etc/wireguard/wg0.conf

The configuration file should include the following details:

[Interface]
Address = 10.200.200.1/24
SaveConfig = true
PrivateKey = SERVER_PRIVATE_KEY
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Step 4: Enable IP Forwarding and Configure Firewall

Similar to OpenVPN, enable IP forwarding and configure the firewall to allow VPN traffic:

sudo sysctl -w net.ipv4.ip_forward=1
sudo ufw allow 51820/udp

Step 5: Start and Enable WireGuard

Activate the WireGuard interface and ensure it starts on boot:

sudo systemctl start wg-quick@wg0
sudo systemctl enable wg-quick@wg0

Configuring VPN Clients

Once the VPN server is up and running, you’ll need to configure your clients to connect to it. This involves creating client certificates and configuration files for OpenVPN or generating client keys and configuration for WireGuard.

FAQ Section

How do I maintain my VPN server?

Regularly update your server’s software, monitor logs for any unusual activity, and periodically renew and revoke client certificates or keys as needed.

Can I set up a VPN server on a virtual machine?

Yes, you can set up a VPN server on a virtual machine as long as the hosting environment allows VPN traffic and port forwarding.

Is it necessary to have a static IP for a VPN server?

While having a static IP is ideal, you can use dynamic DNS services to handle a dynamic IP address.

How many clients can connect to a VPN server?

The number of clients that can connect to a VPN server depends on the server’s hardware, network bandwidth, and configuration settings.

What is the best VPN protocol for speed and security?

WireGuard is known for its speed and security, but OpenVPN is more widely supported and has stood the test of time in terms of security.

References

OpenVPN Project: https://openvpn.net/
WireGuard Official Site: https://www.wireguard.com/
Ubuntu Documentation: https://ubuntu.com/server/docs
Easy-RSA GitHub Repository: https://github.com/OpenVPN/easy-rsa