VPNserver - Revision history

Wikisailor: /* Introduction */

2026-02-20T17:14:30Z

Introduction

← Older revision		Revision as of 17:14, 20 February 2026
Line 1:		Line 1:
	==Introduction==		==Introduction==

	The general idea of the VPN was to allow RDP access to the desktop hosts on the '''[[Remote Access Terminal \| terminals]]''' network from a remote location to the '''[[Home Lab]]''' and any ~~virtual~~ Machine that may be required. There may be some gain in having a Samba share to Satsuma as well as the VPN will secure the connection. There does not need to be a Internet connection through the VPN at this time so we will not add the Ip as the default route for Internet at this time, If that changes it should be fairly straight forward to add it on to the client connection. There may be other requirements at a later date.		The general idea of the VPN was to allow RDP access to the desktop hosts on the '''[[Remote Access Terminal \| terminals]]''' network from a remote location to the '''[[Home Lab]]''' and any '''[[Virtual Machines \| Virtual Machine]]''' that may be required. There may be some gain in having a Samba share to Satsuma as well as the VPN will secure the connection. There does not need to be a Internet connection through the VPN at this time so we will not add the Ip as the default route for Internet at this time, If that changes it should be fairly straight forward to add it on to the client connection. There may be other requirements at a later date.

	==Reasons for choosing Wireguard over OpenVPN==		==Reasons for choosing Wireguard over OpenVPN==

Wikisailor: /* Introduction */

2026-02-20T17:12:58Z

Introduction

← Older revision		Revision as of 17:12, 20 February 2026
Line 1:		Line 1:
	==Introduction==		==Introduction==

	The general idea of the VPN was to allow RDP access to the desktop hosts on the '''[[Remote Access Terminal \| terminals]]''' network from a remote location to the '''[[Home Lab]]'''. There may be some gain in having a Samba share to Satsuma as well as the VPN will secure the connection. There does not need to be a Internet connection through the VPN at this time so we will not add the Ip as the default route for Internet at this time, If that changes it should be fairly straight forward to add it on to the client connection. There may be other requirements at a later date.		The general idea of the VPN was to allow RDP access to the desktop hosts on the '''[[Remote Access Terminal \| terminals]]''' network from a remote location to the '''[[Home Lab]]''' and any virtual Machine that may be required. There may be some gain in having a Samba share to Satsuma as well as the VPN will secure the connection. There does not need to be a Internet connection through the VPN at this time so we will not add the Ip as the default route for Internet at this time, If that changes it should be fairly straight forward to add it on to the client connection. There may be other requirements at a later date.

	==Reasons for choosing Wireguard over OpenVPN==		==Reasons for choosing Wireguard over OpenVPN==

Wikisailor: /* Introduction */

2026-02-20T17:09:11Z

Introduction

← Older revision		Revision as of 17:09, 20 February 2026
Line 1:		Line 1:
	==Introduction==		==Introduction==

	The general idea of the VPN was to allow RDP access to the desktop hosts on the '''[[Remote Access Terminal \| terminals]]''' network from a remote location . There may be some gain in having a Samba share to Satsuma as well as the VPN will secure the connection. There does not need to be a Internet connection through the VPN at this time so we will not add the Ip as the default route for Internet at this time, If that changes it should be fairly straight forward to add it on to the client connection. There may be other requirements at a later date.		The general idea of the VPN was to allow RDP access to the desktop hosts on the '''[[Remote Access Terminal \| terminals]]''' network from a remote location to the '''[[Home Lab]]'''. There may be some gain in having a Samba share to Satsuma as well as the VPN will secure the connection. There does not need to be a Internet connection through the VPN at this time so we will not add the Ip as the default route for Internet at this time, If that changes it should be fairly straight forward to add it on to the client connection. There may be other requirements at a later date.

	==Reasons for choosing Wireguard over OpenVPN==		==Reasons for choosing Wireguard over OpenVPN==

Wikisailor at 17:04, 20 February 2026

2026-02-20T17:04:58Z

← Older revision		Revision as of 17:04, 20 February 2026
Line 1:		Line 1:
	==Introduction==		==Introduction==

	The ~~only host on~~ the ~~VPNNet is Vanilla it has an IP Address of 192.168.130.5. OpenVPN~~ was ~~tried~~ on ~~Voavanga but although it works it had problems with routing so Wireguard has been tried and it now works. It is possible that~~ the ~~routing problems were the same as was on Wireguard and maybe they could have been overcome but as there is now~~ a ~~working Wireguard solution on Vanilla there is only~~ a ~~limited reason~~ to ~~try OpenVPN again. The bigger and more important difference between~~ the ~~two is that Wireguard is designed to work in stealth mode but OpenVPN is designed to be more helpful and retry failed~~ connection ~~attempts~~. ~~Wireguard expects the client~~ to ~~supply the correct signature to create the connection over UDP and if the signature is correct~~ a connection ~~is established but if incorrect~~ the ~~packets are simply dropped,~~ so ~~any bot trying to guess~~ the ~~signature will just timeout without confirming there is a live service~~ at ~~the IP address. OpenVPN will also reject any failed connections but~~ it ~~will send a reply~~ to the client ~~offering to attempt another handshake, while that is fine for some networks with robust attack mitigation but we would prefer the more stealthy approach of Wireguard~~. ~~It is not that the edge router is any worse than any~~ other ~~it is simply that the consumer grade internet connection will likely black box our current IP address if there are too many probes~~.		The general idea of the VPN was to allow RDP access to the desktop hosts on the '''[[Remote Access Terminal \| terminals]]''' network from a remote location . There may be some gain in having a Samba share to Satsuma as well as the VPN will secure the connection. There does not need to be a Internet connection through the VPN at this time so we will not add the Ip as the default route for Internet at this time, If that changes it should be fairly straight forward to add it on to the client connection. There may be other requirements at a later date.

	==~~The Solution required~~==		==Reasons for choosing Wireguard over OpenVPN==

			The only host on the VPNNet is Vanilla it has an IP Address of 192.168.130.5. OpenVPN was tried on Voavanga 192.168.130.5 but although it works it had problems with routing so Wireguard has been tried and it now works. It is possible that the routing problems were the same as was on Wireguard and maybe they could have been overcome but as there is now a working Wireguard solution on Vanilla there is only a limited reason to try OpenVPN again. The bigger and more important difference between the two is that Wireguard is designed to work in stealth mode but OpenVPN is designed to be more helpful and retry failed connection attempts. Wireguard expects the client to supply the correct signature to create the connection over UDP and if the signature is correct a connection is established but if incorrect the packets are simply dropped, so any bot trying to guess the signature will just timeout without confirming there is a live service at the IP address. OpenVPN will also reject any failed connections but it will send a reply to the client offering to attempt another handshake, while that is fine for some networks with robust attack mitigation but we would prefer the more stealthy approach of Wireguard. It is not that the edge router is any worse than any other it is simply that the consumer grade internet connection will likely black box our current IP address if there are too many probes.

	The general idea of the VPN was to allow RDP access to the desktop hosts on the '''[[Remote Access Terminal \| terminals]]''' network from a remote location . There may be some gain in having a Samba share to Satsuma as well as the VPN will secure the connection. There does not need to be a Internet connection through the VPN at this time so we will not add the Ip as the default route for Internet at this time, If that changes it should be fairly straight forward to add it on to the client connection. There may be other requirements at a later date.

	==Installation of Wireguard==		==Installation of Wireguard==

Wikisailor: /* Introduction */

2026-02-20T17:01:08Z

Introduction

← Older revision		Revision as of 17:01, 20 February 2026
Line 1:		Line 1:
	==Introduction==		==Introduction==

	The only host on the VPNNet is Vanilla it has an IP Address of ~~VPNnet~~.5. OpenVPN was tried on Voavanga but although it works it had problems with routing so Wireguard has been tried and it now works. It is possible that the routing problems were the same as was on ~~wireguard~~ and maybe they could have been overcome but as there is now a working Wireguard solution on Vanilla there is only a limited reason to try OpenVPN again.		The only host on the VPNNet is Vanilla it has an IP Address of 192.168.130.5. OpenVPN was tried on Voavanga but although it works it had problems with routing so Wireguard has been tried and it now works. It is possible that the routing problems were the same as was on Wireguard and maybe they could have been overcome but as there is now a working Wireguard solution on Vanilla there is only a limited reason to try OpenVPN again. The bigger and more important difference between the two is that Wireguard is designed to work in stealth mode but OpenVPN is designed to be more helpful and retry failed connection attempts. Wireguard expects the client to supply the correct signature to create the connection over UDP and if the signature is correct a connection is established but if incorrect the packets are simply dropped, so any bot trying to guess the signature will just timeout without confirming there is a live service at the IP address. OpenVPN will also reject any failed connections but it will send a reply to the client offering to attempt another handshake, while that is fine for some networks with robust attack mitigation but we would prefer the more stealthy approach of Wireguard. It is not that the edge router is any worse than any other it is simply that the consumer grade internet connection will likely black box our current IP address if there are too many probes.

	==The Solution required==		==The Solution required==

Wikisailor: /* Installation of OpenVPN */

2026-02-20T16:41:49Z

Installation of OpenVPN

← Older revision		Revision as of 16:41, 20 February 2026
Line 141:		Line 141:
	==Installation of OpenVPN==		==Installation of OpenVPN==

	I wanted to compare the two competing VPN solutions another VM was created call Voavanga on 192.168.130.4 (one number lower than than the Wireguard VPN server). I had heard that OpenVPN was more complicated to setup but had more options. Now that it is done I can confirm that it is indeed more complicated to setup but not by much. The host used in both is the same specifications and as there will not be a need to host many clients it does not need to be huge.		I wanted to compare the two competing VPN solutions another VM was created call Voavanga on 192.168.130.4 (one number lower than than the Wireguard VPN server). I had heard that OpenVPN was more complicated to setup but had more options. Now that it is done I can confirm that it is indeed more complicated to setup but not by much. The host used in both is the same specifications and as there will not be a need to host many clients it does not need to be huge.

			===OpenVPN Disabled===

			'''Update''', OpenVPN works and and does allow VPN connections to the network but it does not do the split DNS well in that windows does not fix the local DNS on the OpenVPN network interface. it is assumed that it would not be a problem if the entire internet was routed through the OpenVPN NIC. The other feature of OpenVPN is that it will always reply to connection requests with a handshake request and thus confirm that there is a live service at the public facing IP address regardless of whether the signature is valid. In view of these two features it has been decided to use Wireguard for remote access only and switch off Voavanga.

	===Setup The VPN Server===		===Setup The VPN Server===

Wikisailor: /* Introduction */

2026-01-27T14:41:01Z

Introduction

← Older revision		Revision as of 14:41, 27 January 2026
Line 1:		Line 1:
	==Introduction==		==Introduction==

	The only host on the VPNNet is Vanilla it has an IP Address of VPNnet.5. OpenVPN was tried but it had problems with routing so Wireguard has been tried and it now works. It is possible that the routing problems were the same as was on wireguard and maybe they could have been overcome but as there is now a working Wireguard solution on Vanilla there is only a limited reason to try OpenVPN again.		The only host on the VPNNet is Vanilla it has an IP Address of VPNnet.5. OpenVPN was tried on Voavanga but although it works it had problems with routing so Wireguard has been tried and it now works. It is possible that the routing problems were the same as was on wireguard and maybe they could have been overcome but as there is now a working Wireguard solution on Vanilla there is only a limited reason to try OpenVPN again.

	==The Solution required==		==The Solution required==

Wikisailor: /* Client install */

2025-06-07T13:51:32Z

Client install

← Older revision		Revision as of 13:51, 7 June 2025
Line 184:		Line 184:
	=== Client install ===		=== Client install ===

	client		client
	dev tun		dev tun
	proto udp # Or tcp, depending on your server config		proto udp # Or tcp, depending on your server config
	remote walnut.seaoffate.net 1194 # Replace with the public IP or hostname of your Proxmox host		remote walnut.seaoffate.net 1194 # Replace with the public IP or hostname of your Proxmox host
	resolv-retry infinite		resolv-retry infinite
	nobind		nobind
	persist-key		persist-key
	persist-tun		persist-tun
	ca ca.crt		ca ca.crt
	cert dragonfruit.crt		cert dragonfruit.crt
	key dragonfruit.key		key dragonfruit.key
	remote-cert-tls server		remote-cert-tls server
	tls-client		tls-client
	cipher AES-256-CBC # Match your server config		cipher AES-256-CBC # Match your server config
	auth SHA256 # Match your server config		auth SHA256 # Match your server config
	compress lz4-v2 # Match your server config		compress lz4-v2 # Match your server config
	verb 3		verb 3

Wikisailor: /* Setup The VPN Server */

2025-05-15T02:36:13Z

Setup The VPN Server

← Older revision		Revision as of 02:36, 15 May 2025
Line 155:		Line 155:
	./easyrsa init-pki		./easyrsa init-pki
	./easyrsa build-ca nopass		./easyrsa build-ca nopass
	These commands create a directory for Easy-RSA, navigates into it, initializes the PKI, and builds the Certificate Authority		These commands create a directory for Easy-RSA, navigates into it, initializes the PKI, and builds the Certificate Authority. Next to generate the keys
			./easyrsa build-server-full server nopass ./easyrsa gen-dh
			This generates the server certificate and private key, and the Diffie-Hellman parameters.
			sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
			sudo gzip -d /etc/openvpn/server.conf.gz
			sudo nano /etc/openvpn/server.conf
			Copies the sample server configuration file, unzips it, and opens it for editing.
			sudo cp ~/openvpn-ca/pki/ca.crt /etc/openvpn/
			sudo cp ~/openvpn-ca/pki/issued/server.crt /etc/openvpn/
			sudo cp ~/openvpn-ca/pki/private/server.key /etc/openvpn/
			sudo cp ~/openvpn-ca/pki/dh.pem /etc/openvpn/dh.pem
			Copies the necessary certificate and key files to the `/etc/openvpn/` directory.
			sudo nano /etc/sysctl.conf
			Opens the system configuration file to enable IP forwarding much like we did with Wireguard

			save and exit the apply the changes with
			sudo sysctl -p

			Next we need to edit the firewall.

			Then as a final step we eanble start and chec the satus of the OpenVPN service
			sudo systemctl enable openvpn@server
			sudo systemctl start openvpn@server
			sudo systemctl status openvpn@server

			Next we need to install the Client

	=== Client install ===		=== Client install ===

Wikisailor: /* Installation of OpenVPN */

2025-05-15T02:23:58Z

Installation of OpenVPN

← Older revision		Revision as of 02:23, 15 May 2025
Line 140:		Line 140:

	==Installation of OpenVPN==		==Installation of OpenVPN==

			I wanted to compare the two competing VPN solutions another VM was created call Voavanga on 192.168.130.4 (one number lower than than the Wireguard VPN server). I had heard that OpenVPN was more complicated to setup but had more options. Now that it is done I can confirm that it is indeed more complicated to setup but not by much. The host used in both is the same specifications and as there will not be a need to host many clients it does not need to be huge.

			===Setup The VPN Server===

			The setup is a bit different to Wireguard in that we have to generate our own SSL certs & keys. So we will need something to do generate them and we have chosen easyrsa. To start we need to do the standard update upgrade.
			sudo apt update
			sudo apt upgrade -y
			Then openvpn and Easy-RSA
			sudo apt install openvpn easy-rsa -y
			Next we need to setup the SSL Certificate Authority
			mkdir ~/openvpn-ca
			cd ~/openvpn-ca
			./easyrsa init-pki
			./easyrsa build-ca nopass
			These commands create a directory for Easy-RSA, navigates into it, initializes the PKI, and builds the Certificate Authority




















			=== Client install ===

			client
			dev tun
			proto udp # Or tcp, depending on your server config
			remote walnut.seaoffate.net 1194 # Replace with the public IP or hostname of your Proxmox host
			resolv-retry infinite
			nobind
			persist-key
			persist-tun
			ca ca.crt
			cert dragonfruit.crt
			key dragonfruit.key
			remote-cert-tls server
			tls-client
			cipher AES-256-CBC # Match your server config
			auth SHA256 # Match your server config
			compress lz4-v2 # Match your server config
			verb 3