Build your own VPN Service
Hi Guys, Today, we will set up our own VPN Service. I rented a server in the USA, installed VPN Software on it and can connect to it with a Windows or Mac or Linux client or I can quickly scan a QR Code to connect with my iPhone. (Intro) My Family was urging me to have Netflix. I did some research and found out that their offering in Germany is much smaller than in the US. In Canada, pricing was much lower due to the conversion rate and on top of this you get the French versions in Canada – we are a bilingual German-French family and the kids liked to watch the original English versions. So I thought – hey, why not just subscribe to Netflix in Canada?
You may already have guessed what happened – apparently, I was not the first person on earth has had that idea. Netflix just kept redirecting me to the German page. If only I would have thought of using a VPN at that time. I could have changed my Geo-location just by connecting to a Canadian VPN and hence Netflix would have thought that I shop from Canada. Of course in Hindsight, thinking it over, I would have had to give a wrong address which probably would not have been OK. Furthermore, I found the various VPN services that you can buy on the internet to be a bit on the pricey side – they all had free 30 day trials or so of course but then they quickly went up to 7 or 12 Dollars per month. And I have heard that the VPN services are often blocked from streaming services. Anyhow, these days I thought, hey, why not run my very own VPN service?
All I need is a cheap virtual server or vserver or VPS – the terminology varies between the providers - and a VPN software running on it. So I searched the internet and I found that there are quite cheap offerings these days. For a VPN Server we do not really need a powerful machine. One CPU, 512 Megabytes of Ram and 5 to 10 Gigabytes of Disk are plenty. The one I found here (ionos) has a couple of interesting attributes – I need to specify at this point that I am neither affiliated with them in any way nor do they pay me in any way – so my dear friends from Ionos,I am doing free publicity for you here. You might consider adding me to your christmas card list. Guys, again, you may freely chose any provider. There are just a couple of things that made this offering attractive for me: First, they are using KVM as virtualization technology. That means I can have a KVM web console if ever I locked myself out, and – most importantly for me – I could run Docker on it. Second, they are German and I can book the offering from Germany without having to spoof an identity or anything dodgy like that. So I expect this whole thing to run reliably and smoothly like a German Diesel engine :-) Third, as far as I can tell, there are no hidden setup costs such as activation etc. if I engage for 12 months. At 1 Euro per month this is a manageable risk. Even if I barked up the wrong tree here it would not throw me into poverty.
Fourth, I can upload my own images (even though not for free) and can select from a variety of pre configured Linuxes. We will use Ubuntu 18 for this exercise. On the downside, they do not seem to have more recent images such as Ubuntu 20 which would come in handy for our VPN installation as Wire guard can be more easily installed on the newer Ubuntu versions. With Version 18 we will have to add the installation sources from Wire guard. Alternatively we could just upgrade Ubuntuonce we have access to the server. It also seems that once you have selected a distribution then you can not easily switch to another one, like Cent OS.
Pinterest video downloader - Just Downloader
You need to make your choice and stick to it. Another not so good experience with them was the time they needed to send me the login details. It took them roughly 3 days. But I can’t compare to others here. Another limitation is that I will have to pay for extras such as backup. But I am not planning to store any data on this machine and the setup can be done again very easily at any time. And I fully understand that I do probably not get the first class all inclusive exec club for a dollar. Generally speaking, there are some selection criteria which you might consider before choosing a provider. The virtualization technology is most certainly an important factor, especially if you want to run Docker. Look at the pricing – is it a flat fixed price or is it time or load based charges.
Volume or bandwidth limitations would be a downer as well. But enough talking, let’s get this thing installed. Like always I have prepared a couple of things for you which you may download from my git hub repository. The link is like always in the description of this video. There is an installation script called wire guard.sh that does all the necessary things for you in order to install wire guard on the virtual server. A second script called add peer.sh can be used to add an additional client or peer, such as a laptop running windows or an iPhone. I have designed the scripts in a way that you can either transfer them over to the server as a file and call them from the command line or – alternatively – you can copy and paste the content directly into the terminal window. I could either connect to the server using the KVM Web console, but I personally find working with it a bit awkward, I prefer using secure shell, ssh. If you are a Windows user, you may use a software called Putty to do this.
Let me quickly download this from the web and install it. In order to transfer the files on the serverI use WinSCP. Alternatively, you could use Filzilla – for example if you are on a Mac. Same procedure, searching for it on the web quickly and installing it. I have already put in the parameters for my server into WinSCP and can now connect to it with one click. I also have the scripts available here, so all I need to do is drag and drop them over to my server. That’s all. The files are now on the Server in the USA. I just need to go to the properties of the scripts and check the “Executable” flag so that I can run them on the linux server. Next, I connect to the server using Putty. Under Windows 10, there is now built-in ssh functionality. So you could just run ssh from the command line as well. I have put the scripts directly in the home directory of the root user, so I can execute them from here. First the installation script. It takes roughly 30 seconds to run. The script will install all necessary software packages, it will set up the interface and the necessary firewall rules for me.
Now that the Wireguard software is installed,I want to add a client to it. From the wire guard web site I can download the software for Windows. Installing it is pretty straightforward. The client for the iPhone can be found in the app store. Now let me log into my server with Putty and run the add peer script which will add a new peer and show the configuration data. You might need to tweak the font and window size settings for putty a little bit so that the QR code shows up correctly. I have noticed that it works best with 120 columns, 40 rows and with the consolas 16 point font even an old man wearing glasses like myself can read everything. Here we go, I launch the script, now I can copy and paste the generated config data into my windows client. I just create a new empty config and over write it with the data that I have copied from the installation script. Now I can connect to the VPN by clicking on the “Activate” button and it does not even take a second to connect. Let me check my IP address to see where my Server is located. It looks like I am in the US and more preciselyin Kansas – that’s probably where one of their data centers is located. Cool. Let me check in to Amazon and see if Amazon gives me prices in Dollars or Euros. Quickly searching for a product, let’s sayaWemos D1.
All Prices in Dollars. We are in the US. Beautiful. One last test. What if I would want to sign in to Netflix. Just give it any mailinator address – allI want to see is if it gives me Dollar or Euro prices or tells me to go away. All Plans in Dollars. Good. Now let’s set this up for the iPhone. Clicking on the plus sign in the Wire guard app let’s me set up a new tunnel either from scratch or much fancier, from a QR code. That is actually a very nice way to transfer data from a terminal window to an iphone. Scanning the code creates a new tunnel. Let’s call it USA. Quickly connecting to it and doing the same check – open Amazon and see if prices are in Dollars. Yep, all good – everything works as expected. Guys, before we have a closer look at the scripts and what they do in detail I have a call to action for you. Rather than me just guessing what you might be interested in it would be so much easier if you just told me. So I have two questions – you didn't think you get this for free, did you ? Just kidding. Please let me know in the comments of this video if you are using a VPN or not or if you are planning to do so. Furthermore I would love to understand what your main concern is why you would consider using a VPN. Do you need to connect to your home or work environment or is it safety and security or privacy for browsing ? In other words, which problem are you trying to solve?
Please do write me in the comments. Alternatively you find me on facebook, twitter or redd it. My username is always one marcfifty. So I’m not really trying to hide here ;-) Ido take and answer questions as well :-) Thanks a lot guys. The installation script needs to be run asroot. First thing it does is that it deletes any wire guard configuration that might reside on the machine. Second, it installs the necessary repositories and software packages for wire guard. During the development of this script I have tried out a couple of things – I have not removed them from the script but rather commented them out because I though it might help understand the script better. Next, it generates a key pair and stores the private and public key in the two files which you can see here. The umask 077 sets the file permissions so that the file can only be accessed by root. You should always set the tightest possible access rights on key files in general so that nobody else could access them.
Next we need to enable forwarding, that means we need to tell linux that it should act as a router. This is done by setting the ip_forward parameter to 1 using sysctl. The script is made for IP4, that means if you only get an IP6 address from your Provider you would need to adapt this here. I have arbitrarily chosen a private class c address for the wire guard interface. You may change this to any private address if you wanted to. Next we configure the wg0 link – that is just another randomly chosen interface name for the wire guard network interface. Feel free to set this to something else if you want. The port we are listening on is set to 51820,again you might change this to something else if you want. In any case, you need to open that port on the firewall of the virtual server. Depending on your Provider this may be done in different ways. But anyhow you need to open that port so that Wire guard can answer on it. The wg show conf command shows the configuration. Up to this point the configuration would not be persistent, that is it would be lost after a reboot.
This is probably not what we want. We want the VPN to be available immediately after reboot. So I am writing the config data into the filewg0.conf. I also need to store the ip address of the interface here explicitely as the show conf does not print it out. Might be worth improving this dear Wire guard team, if you are watching. Specifying the Save Config parameter makes sure that peers that I create are automatically stored in the config file. Add this point I needed to do a couple of twists in order to find out the name of the public interface, which is the network card of my v server which is connected to the internet. I need this because I need to add some firewall rules to the config files. For the moment, the Linux server acts as a router. It would hence route me over to the internet. But it would not yet hide my IP address or rather mask it. It would just route my own private address out to the internet. But a private address can not be routed publicly. So I need NAT or Masquerading. This is done with Iptables by adding a masquerading target to the post routing chain of the nat table. Nearly finished, we have the config, we have maquerading, we have it stored in persistent files.
All we need to make sure is that it comes up automatically after a reboot . For this, we can use system. We just enable the wg-quick command with the parameter wg0 as a system unit and this way Linux will automatically launch the config after each boot. Perfect, so much for the Server installation script. Now let’s look at the add peer script. I designed it so that it can take two parameters– the first one is a client name, that is actually not really used anywhere for the time being and the second parameter is the IP address that the client should get. Chose a different IP address for each client you want to connect. I default to the .2 address if you don’t specify it. For the new peer we need to generate a key pair very much like for the server itself. I am reading out the public key and the public IP address of the server. If you wanted to connect to the server overa dynamic DNS address you would need to adapt this later in your client. Next I just write the whole config into the new peer.conf file and tell wire guard that it has a new peer using the wg set command.
I have noticed that the config file does not update immediately but that the interface needs to be taken down and up again in order to have the config written into the wg0.conf file. Last but not least I clean out the variables so that they are not stored on the machine and print out the config file as a QR code using qr encode and below as a text file. Perfect. Guys, this concludes today’s episode. Thank you very much for watching. In one of the next episodes we will use this virtual server to launch a browser remotely, that means we will surf the internet with a browser that is not running on our local PC but rather in the cloud. The goal is to increase privacy for browsing and also security in the sense that we generate some airspace between the browser and our client. Also, there are still a couple of settings that we need to change on this server, such as changing username and password authentication with ssh to public and private key.
More information about Nord VPN check out this article CLICK HERE
Do you want to know about Surfshark VPN Check out this article CLICK HERE
If you want to know about CyberGhost VPN Check out this article CLICK HERE
If you want to know about Express VPN Check out this article CLICK HERE
If you want to Double up internet speed then check out this article CLICK HERE
No comments: