setup-ipsec-vpn/README.md

IPsec/L2TP VPN Server Auto Setup Scripts

Note: This repository was created from (and replaces) these GitHub Gists:

• gist.github.com/hwdsl2/9030462 (225 Stars, 88 Forks as of 01/18/2016)
• gist.github.com/hwdsl2/e9a78a50e300d12ae195 (10 Stars, 6 Forks)

Overview

Scripts for automatic configuration of IPsec/L2TP VPN server on Ubuntu 14.04 & 12.04, Debian 8 and CentOS/RHEL 6 & 7. All you need to do is providing your own values for IPSEC_PSK, VPN_USER and VPN_PASSWORD, and they will handle the rest. These scripts can also be directly used as the Amazon EC2 "user-data" when creating a new instance.

We will use Libreswan as the IPsec server, and xl2tpd as the L2TP provider.

Link to my VPN tutorial with detailed usage instructions

Features

• Fully automated IPsec/L2TP VPN server setup, no user input needed
• Encapsulates all VPN traffic in UDP - does not need the ESP protocol
• Can be directly used as "user-data" for a new Amazon EC2 instance
• Automatically determines public IP and private IP of server
• Includes basic IPTables rules and sysctl.conf settings
• Tested with Ubuntu 14.04 & 12.04, Debian 8 and CentOS/RHEL 6 & 7

Requirements

A newly created Amazon EC2 instance, using these AMIs: (See the link above for usage instructions)

• Ubuntu 14.04 (Trusty) or 12.04 (Precise)
• Debian 8 (Jessie) EC2 Images
• CentOS 7 (x86_64) with Updates HVM
• CentOS 6 (x86_64) with Updates HVM

-OR-

A dedicated server or any KVM- or Xen-based Virtual Private Server (VPS), with these Linux OS:
 (Using the VPN scripts on a freshly installed system is recommended)

• Ubuntu 14.04 (Trusty) or 12.04 (Precise)
• Debian 8 (Jessie)
• Debian 7 (Wheezy) - NOT recommended. Requires this workaround to work.
• CentOS / Red Hat Enterprise Linux (RHEL) 6 or 7

OpenVZ VPS users should instead use Nyr's OpenVPN script.

» I want to run my own VPN but don't have a server for that

DO NOT run these scripts on your PC or Mac! They are meant to be run on a dedicated server or VPS!

Installation

For Ubuntu and Debian:

First, update your system with apt-get update && apt-get dist-upgrade and reboot. This is optional, but recommended.

wget https://github.com/hwdsl2/setup-ipsec-vpn/raw/master/vpnsetup.sh -O vpnsetup.sh
nano -w vpnsetup.sh
[Edit and replace IPSEC_PSK, VPN_USER and VPN_PASSWORD with your own values]
/bin/sh vpnsetup.sh

For CentOS and RHEL:

First, update your system with yum update and reboot. This is optional, but recommended.

yum -y install wget nano
wget https://github.com/hwdsl2/setup-ipsec-vpn/raw/master/vpnsetup_centos.sh -O vpnsetup_centos.sh
nano -w vpnsetup_centos.sh
[Edit and replace IPSEC_PSK, VPN_USER and VPN_PASSWORD with your own values]
/bin/sh vpnsetup_centos.sh

If unable to download via wget, you may open the VPN scripts above and click the Raw button on the right. Press Ctrl+A to select all, Ctrl-C to copy, then paste into your favorite editor.

Next Steps

Get your computer to use the VPN. Search the web for instructions, e.g. https://www.google.com/#q=setup+ipsec+l2tp+client

Enjoy your very own VPN! ✨🎉🚀✨

Important Notes

To support multiple VPN users with different credentials, just edit a few lines in the scripts.

For Windows users, a one-time registry change is required if the VPN server and/or client is behind NAT (e.g. home router).

Android 6 (Marshmallow) users: Edit /etc/ipsec.conf and append ,aes256-sha2_256 to both ike= and phase2alg=. Also add a new line sha2-truncbug=yes. Must start lines with two spaces. Finally, run service ipsec restart. (Ref)

iPhone/iPad users: In iOS settings, choose L2TP (instead of IPSec) for the VPN type. In case you're unable to connect, edit ipsec.conf and replace rightprotoport=17/%any with rightprotoport=17/0. Then restart ipsec service.

Clients are configured to use Google Public DNS when the VPN is active. To change, set ms-dns in options.xl2tpd.

If you configured a custom SSH port or wish to allow other services, edit the IPTables rules in the scripts before using.

The scripts will backup your existing config files before making changes, to the same folder with .old-date-time suffix.

Upgrading Libreswan

You may use vpnupgrade_Libreswan.sh (for Ubuntu/Debian) and vpnupgrade_Libreswan_centos.sh (for CentOS/RHEL) to upgrade Libreswan to a newer version. Check and update the SWAN_VER variable on top of the scripts as necessary.

Bugs & Questions

• Have a question? Please first read other people's comments in this Gist and on my blog.
• For Libreswan related questions, you may ask on the mailing list, or check out the official wiki.
• If you found a reproducible bug, open a GitHub Issue to submit a bug report.

Copyright and license

Copyright (C) 2014-2016 Lin Song   
Based on the work of Thomas Sarlandie (Copyright 2012)

This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Unported License
Attribution required: please include my name in any derivative and let me know how you have improved it!