8 ms·

Show HN: Use Ansible to Run a “friends and Family” OpenVPN Server on Digital Ocean

206 points by robbintt 10y ago

tribby 10y ago
> Do not check use IPv6 last time I set up an openvpn server on digitalocean without `tun-ipv6`, it leaked my ISP's ipv6 address to the internet while my ipv4 address was correct (a digitalocean address). disabling ipv6 on a vpn by default doesn't make a lot of sense to me if the intention is a layer of privacy around your ISP.
- robbintt 10y ago
  Hi, thanks for your feedback. Can you submit a github issue? I need to establish a traffic testing method for assessing whether any traffic is leaking. This would be a valuable general tool for all vpn toolchains.
  - tribby 10y ago
    testing is a good idea, and I've seen it done in other "road warrior" type scripts in an unsafe way via `curl -s6 https://canhazip.com` https://canhazip.com`. I may not have the time to contribute for a while, but what I would contribute is mostly laid out in the openvpn docs for enabling ipv6[0]. most of what you need to do with ipv6 is analagous to what you'd do with ipv4 like remembering to uncomment net.ipv6.conf.all.forwarding=1 in /etc/sysctl.conf ( just as you would with net.ipv4.ip_forward). use tun-ipv6 instead of tun, and server-ipv6 in addition to server. ip6tables rules in addition to iptables rules. etc etc. although that may be it -- can't think of anything else of the top of my head. I'll look more at your code and see if there's anything I can help with as time allows- ping me if I forget :) 0. https://community.openvpn.net/openvpn/wiki/IPv6 https://community.openvpn.net/openvpn/wiki/IPv6
    - tomschlick 10y ago
      Would love to see those additions made to this script: https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install
      - tribby 10y ago
        wow, I admire the dedication to supporting multiple operating systems, but that script is a mess IMHO. why is there a hardcoded version of easyrsa? I haven't worked with easyrsa in a while but does it still do 1024 bit dh parameters by default? because that would also be a mistake. it looks like there is sufficient interest, so maybe I'll cobble together a bash script.
- jwilk 10y ago
  How did it leak it?
  - dijit 10y ago
    I'm guessing the author was resolving AAAA records on the client side which caused his network stack to prefer IPv6 routing. Which means anything he was connecting to that was IPv6 capable was not using the VPN.
    - tribby 10y ago
      I think this is correct, which was default behavior
NickBusey 10y ago
I prefer Sovereign for this. Sets up OpenVPN as well as a bunch of other goodies. https://github.com/sovereign/sovereign https://github.com/sovereign/sovereign
- tlrobinson 10y ago
  I'm not sure I trust myself to run that many services securely. I'd be interested in something like this with a strong focus on security.
  - paws 10y ago
    Algo[1] may be a good fit for you. Just be aware the authors deliberately target only very recent clients. [2] I recently spun up a new Algo instance on an Ubuntu host and discovered I could no longer SSH from an old Snow Leopard Mac because it locked sshd down to only 'modern ciphers'[3]. (No affiliation, just a fan) [1] https://github.com/trailofbits/algo https://github.com/trailofbits/algo [2] https://github.com/trailofbits/algo/issues/168 https://github.com/trailofbits/algo/issues/168 [3] https://github.com/trailofbits/algo/blob/master/roles/security/templates/sshd_config.j2#L48 https://github.com/trailofbits/algo/blob/master/roles/securi...
- mos_basik 10y ago
  Wew, goodies is about right. That's pretty cool. I have a VPS and I use it for webhosting for myself and some friends. I've thought about (in some cases tried) and then decided against setting up my own mail server, my own irc bouncer, my own xmpp server and my own cloud storage. Each time, the killer was basically "I could do this, but it would take too long to figure out and it would probably not be super secure at the end. At the very least, a project like Sovereign (written using something as declarative and idempotent as Ansible) would be great to look through and see how it manages certain things. And that doesn't detract from your project, OP - I like that your focus is tight and your setup instructions detailed. I'm far more likely to actually try installing a small project like yours than a behemoth that will change who knows what throughout my system.
necessity 10y ago
You can simply run a sh script that sets it up... https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install
- dstryr 10y ago
  I use this script for my servers as well and it seems much quicker and easier. What benefits does OP's method provide?
  - robbintt 10y ago
    Ansible provides idempotency and some measure of auditabity. Ansible is one way to manage things.
- JonoBB 10y ago
  I use this as well. Takes all of 2 mind to set up, or add a new user
tedmiston 10y ago
I'd like to see some hardening of the box if it's going to be used as a VPN server. My boxes in the DO IP range routinely get targeted by malicious traffic from China and Russia.
- andreareina 10y ago
  Is there a checklist/guide you could point to? I've come across a few but not being experienced I have a hard time judging how good/complete they are.
  - tedmiston 10y ago
    I'm not a security expert by any means, but I like these three guides in the DO tutorials for a typical box. https://www.digitalocean.com/community/tutorials/an-introduction-to-securing-your-linux-vps https://www.digitalocean.com/community/tutorials/an-introduc... https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-keys--2 https://www.digitalocean.com/community/tutorials/how-to-set-... https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-on-ubuntu-14-04 https://www.digitalocean.com/community/tutorials/how-to-secu... There are a dozen or so tools mentioned in the above.
- robbintt 10y ago
  Please add an issue with any reference and ideas for doing this. I would love PRs too.
insubstantive 10y ago
A VPN on the cloud. Totally private. Great idea.
- eeZah7Ux 10y ago
  /s
- andreareina 10y ago
  Depending on your threat model it's perfectly fine. It won't work against a nation-state-level adversary, but I don't get the feeling it's meant to. Against opportunistic passive sniffing or active MitM in cafés and such it's adequate.
  - robbintt 10y ago
    Yeah exactly -- it's a condom rather than an enigma machine.
    - spdionis 10y ago
      Condoms are good security for sex. An enigma machine wouldn't be very helpful on the other hand.
  - fulafel 10y ago
    It's oftentimes worse than nothing against passive surveillance: If you surf from home, your local spooks are with some likelihood forbidden from arbitrarily looking into your communications. Once you pipe it to abroad and terminate the "VPN" on that end, you can be pretty sure your browsing/torrenting habits enjoy no protection from any country's spooks, including your own. And traffic analysis lets eavesdroppers trivially correlate the VPN endpoints with the traffic leaving the VPN.
- scoot 10y ago
  Name checks out! (As they like to say on a certain other message board where snarky comments are de rigueur. )
wstrange 10y ago
Given that most families probably want to use this to torrent, would this not violate Digital Ocean's terms of service?
- robbintt 10y ago
  This tool is to protect you from verizon supercookies and comcast deep packet inspection. These companies sell access to this data to local law enforcement without requiring a warrant. LEO make choices based on the narrative about you they can build. We need to protect ourselves from people who would do us harm in clever and careful ways.
cyberferret 10y ago
I'd like to hear how this is different from Streisand? [0] (and also Sovereign, which I see someone else posted below). I set up Streisand on a $5/mo Digital Ocean droplet a while back and the whole family uses it on all our devices with great results. It is pretty much a 'fire and forget' solution that I haven't had to touch in over a year. [0] - https://github.com/jlund/streisand https://github.com/jlund/streisand
- rosser 10y ago
  Came here to say the same thing. How is this better than Streisand? Both even use Ansible.
  - subliminalpanda 10y ago
    They have different objectives. Streisand's goal is to circumvent censorship, so it provisions a set of different VPN protocols (OpenVPN, LT2P/IPSEC, Shadowsocks, etc...) and instructions on how to use them, where as sovereign sets up e-mail, caldav, and other cloud related tools (which Streisand does not do).
    - rosser 10y ago
      Yeah, my question was comparing the linked project to Streisand, not Sovereign to Streisand.
      - robbintt 10y ago
        This project is designed to be auditable and disposable. It does only one thing and (hopefully) does it well. Also this project is intended to be broadly accessible to people who feel they can do the basics of managing a server.
      - subliminalpanda 10y ago
        I misread your question, my apologies. At a quick glance (and a very quick one at that), Streisand's OpenVPN setup is configured to work on both TCP and UDP ports, where as the references project is being templated from [https://github.com/Stouts/Stouts.openvpn/tree/9c83736608e4cce03fd728a6c9b67dc825ffb978 https://github.com/Stouts/Stouts.openvpn/tree/9c83736608e4cc...]. Looking at the linked project's setup, it seems it's using outdated configurations for OpenVPN (BF-CBC instead of AES-CBC, 1024 bit keys instead of 2048) [https://github.com/Stouts/Stouts.openvpn/blob/9c83736608e4cce03fd728a6c9b67dc825ffb978/defaults/main.yml https://github.com/Stouts/Stouts.openvpn/blob/9c83736608e4cc...]. It's also configured to log info where as Streisand tries its best not to.
jlgaddis 10y ago
Any one have a similar project but based on CentOS that they use and recommend?
lucasjans 10y ago
I'm surprised no one's mentioned pritunl. Open source and one click deployment on DO https://pritunl.com https://pritunl.com
vxNsr 10y ago
This is really great! I didn't even know this was possible thanks!
caspereeko 10y ago
You can also use Oh-My-VPN to install OpenVPN with a one-liner. https://github.com/alaa/oh-my-vpn https://github.com/alaa/oh-my-vpn
cabalamat 10y ago
Why not just use: ssh -D {port} {server} ?

206 points by robbintt 10y ago

> Do not check use IPv6 last time I set up an openvpn server on digitalocean without `tun-ipv6`, it leaked my ISP's ipv6 address to the internet while my ipv4 address was correct (a digitalocean address). disabling ipv6 on a vpn by default doesn't make a lot of sense to me if the intention is a layer of privacy around your ISP.

robbintt 10y ago
Hi, thanks for your feedback. Can you submit a github issue? I need to establish a traffic testing method for assessing whether any traffic is leaking. This would be a valuable general tool for all vpn toolchains.
- tribby 10y ago
  testing is a good idea, and I've seen it done in other "road warrior" type scripts in an unsafe way via `curl -s6 https://canhazip.com` https://canhazip.com`. I may not have the time to contribute for a while, but what I would contribute is mostly laid out in the openvpn docs for enabling ipv6[0]. most of what you need to do with ipv6 is analagous to what you'd do with ipv4 like remembering to uncomment net.ipv6.conf.all.forwarding=1 in /etc/sysctl.conf ( just as you would with net.ipv4.ip_forward). use tun-ipv6 instead of tun, and server-ipv6 in addition to server. ip6tables rules in addition to iptables rules. etc etc. although that may be it -- can't think of anything else of the top of my head. I'll look more at your code and see if there's anything I can help with as time allows- ping me if I forget :) 0. https://community.openvpn.net/openvpn/wiki/IPv6 https://community.openvpn.net/openvpn/wiki/IPv6
  - tomschlick 10y ago
    Would love to see those additions made to this script: https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install
    - tribby 10y ago
      wow, I admire the dedication to supporting multiple operating systems, but that script is a mess IMHO. why is there a hardcoded version of easyrsa? I haven't worked with easyrsa in a while but does it still do 1024 bit dh parameters by default? because that would also be a mistake. it looks like there is sufficient interest, so maybe I'll cobble together a bash script.
jwilk 10y ago
How did it leak it?
- dijit 10y ago
  I'm guessing the author was resolving AAAA records on the client side which caused his network stack to prefer IPv6 routing. Which means anything he was connecting to that was IPv6 capable was not using the VPN.
  - tribby 10y ago
    I think this is correct, which was default behavior

NickBusey 10y ago

I prefer Sovereign for this. Sets up OpenVPN as well as a bunch of other goodies. https://github.com/sovereign/sovereign https://github.com/sovereign/sovereign

tlrobinson 10y ago
I'm not sure I trust myself to run that many services securely. I'd be interested in something like this with a strong focus on security.
- paws 10y ago
  Algo[1] may be a good fit for you. Just be aware the authors deliberately target only very recent clients. [2] I recently spun up a new Algo instance on an Ubuntu host and discovered I could no longer SSH from an old Snow Leopard Mac because it locked sshd down to only 'modern ciphers'[3]. (No affiliation, just a fan) [1] https://github.com/trailofbits/algo https://github.com/trailofbits/algo [2] https://github.com/trailofbits/algo/issues/168 https://github.com/trailofbits/algo/issues/168 [3] https://github.com/trailofbits/algo/blob/master/roles/security/templates/sshd_config.j2#L48 https://github.com/trailofbits/algo/blob/master/roles/securi...
mos_basik 10y ago
Wew, goodies is about right. That's pretty cool. I have a VPS and I use it for webhosting for myself and some friends. I've thought about (in some cases tried) and then decided against setting up my own mail server, my own irc bouncer, my own xmpp server and my own cloud storage. Each time, the killer was basically "I could do this, but it would take too long to figure out and it would probably not be super secure at the end. At the very least, a project like Sovereign (written using something as declarative and idempotent as Ansible) would be great to look through and see how it manages certain things. And that doesn't detract from your project, OP - I like that your focus is tight and your setup instructions detailed. I'm far more likely to actually try installing a small project like yours than a behemoth that will change who knows what throughout my system.

necessity 10y ago

You can simply run a sh script that sets it up... https://github.com/Nyr/openvpn-install https://github.com/Nyr/openvpn-install

dstryr 10y ago
I use this script for my servers as well and it seems much quicker and easier. What benefits does OP's method provide?
- robbintt 10y ago
  Ansible provides idempotency and some measure of auditabity. Ansible is one way to manage things.
JonoBB 10y ago
I use this as well. Takes all of 2 mind to set up, or add a new user

tedmiston 10y ago

I'd like to see some hardening of the box if it's going to be used as a VPN server. My boxes in the DO IP range routinely get targeted by malicious traffic from China and Russia.

andreareina 10y ago
Is there a checklist/guide you could point to? I've come across a few but not being experienced I have a hard time judging how good/complete they are.
- tedmiston 10y ago
  I'm not a security expert by any means, but I like these three guides in the DO tutorials for a typical box. https://www.digitalocean.com/community/tutorials/an-introduction-to-securing-your-linux-vps https://www.digitalocean.com/community/tutorials/an-introduc... https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-keys--2 https://www.digitalocean.com/community/tutorials/how-to-set-... https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-on-ubuntu-14-04 https://www.digitalocean.com/community/tutorials/how-to-secu... There are a dozen or so tools mentioned in the above.
robbintt 10y ago
Please add an issue with any reference and ideas for doing this. I would love PRs too.

insubstantive 10y ago

A VPN on the cloud. Totally private. Great idea.

eeZah7Ux 10y ago
/s
andreareina 10y ago
Depending on your threat model it's perfectly fine. It won't work against a nation-state-level adversary, but I don't get the feeling it's meant to. Against opportunistic passive sniffing or active MitM in cafés and such it's adequate.
- robbintt 10y ago
  Yeah exactly -- it's a condom rather than an enigma machine.
  - spdionis 10y ago
    Condoms are good security for sex. An enigma machine wouldn't be very helpful on the other hand.
- fulafel 10y ago
  It's oftentimes worse than nothing against passive surveillance: If you surf from home, your local spooks are with some likelihood forbidden from arbitrarily looking into your communications. Once you pipe it to abroad and terminate the "VPN" on that end, you can be pretty sure your browsing/torrenting habits enjoy no protection from any country's spooks, including your own. And traffic analysis lets eavesdroppers trivially correlate the VPN endpoints with the traffic leaving the VPN.
scoot 10y ago
Name checks out! (As they like to say on a certain other message board where snarky comments are de rigueur. )

wstrange 10y ago

Given that most families probably want to use this to torrent, would this not violate Digital Ocean's terms of service?

robbintt 10y ago
This tool is to protect you from verizon supercookies and comcast deep packet inspection. These companies sell access to this data to local law enforcement without requiring a warrant. LEO make choices based on the narrative about you they can build. We need to protect ourselves from people who would do us harm in clever and careful ways.

cyberferret 10y ago

I'd like to hear how this is different from Streisand? [0] (and also Sovereign, which I see someone else posted below). I set up Streisand on a $5/mo Digital Ocean droplet a while back and the whole family uses it on all our devices with great results. It is pretty much a 'fire and forget' solution that I haven't had to touch in over a year. [0] - https://github.com/jlund/streisand https://github.com/jlund/streisand

rosser 10y ago
Came here to say the same thing. How is this better than Streisand? Both even use Ansible.
- subliminalpanda 10y ago
  They have different objectives. Streisand's goal is to circumvent censorship, so it provisions a set of different VPN protocols (OpenVPN, LT2P/IPSEC, Shadowsocks, etc...) and instructions on how to use them, where as sovereign sets up e-mail, caldav, and other cloud related tools (which Streisand does not do).
  - rosser 10y ago
    Yeah, my question was comparing the linked project to Streisand, not Sovereign to Streisand.
    - robbintt 10y ago
      This project is designed to be auditable and disposable. It does only one thing and (hopefully) does it well. Also this project is intended to be broadly accessible to people who feel they can do the basics of managing a server.
    - subliminalpanda 10y ago
      I misread your question, my apologies. At a quick glance (and a very quick one at that), Streisand's OpenVPN setup is configured to work on both TCP and UDP ports, where as the references project is being templated from [https://github.com/Stouts/Stouts.openvpn/tree/9c83736608e4cce03fd728a6c9b67dc825ffb978 https://github.com/Stouts/Stouts.openvpn/tree/9c83736608e4cc...]. Looking at the linked project's setup, it seems it's using outdated configurations for OpenVPN (BF-CBC instead of AES-CBC, 1024 bit keys instead of 2048) [https://github.com/Stouts/Stouts.openvpn/blob/9c83736608e4cce03fd728a6c9b67dc825ffb978/defaults/main.yml https://github.com/Stouts/Stouts.openvpn/blob/9c83736608e4cc...]. It's also configured to log info where as Streisand tries its best not to.

jlgaddis 10y ago

Any one have a similar project but based on CentOS that they use and recommend?

lucasjans 10y ago

I'm surprised no one's mentioned pritunl. Open source and one click deployment on DO https://pritunl.com https://pritunl.com

vxNsr 10y ago

This is really great! I didn't even know this was possible thanks!

caspereeko 10y ago

You can also use Oh-My-VPN to install OpenVPN with a one-liner. https://github.com/alaa/oh-my-vpn https://github.com/alaa/oh-my-vpn

cabalamat 10y ago

Why not just use: ssh -D {port} {server} ?