From cf2a368ddd18e28ad19ba3a3c12ff28454e8b572 Mon Sep 17 00:00:00 2001 From: willemserruys Date: Wed, 19 Oct 2022 22:20:41 +0200 Subject: [PATCH] updated documentation --- VPN/readme.md | 8 ++ VPN/{ => unify-vpn}/login.sh | 0 VPN/{ => unify-vpn}/logout.sh | 0 VPN/unify-vpn/readme.md | 111 +++++++++++++++++++++++++++ VPN/wireguard-vpn/docker-compose.yml | 12 +++ VPN/wireguard-vpn/readme.md | 5 ++ server.md => VPS/readme.md | 0 vpn.md | 18 ----- 8 files changed, 136 insertions(+), 18 deletions(-) create mode 100644 VPN/readme.md rename VPN/{ => unify-vpn}/login.sh (100%) rename VPN/{ => unify-vpn}/logout.sh (100%) create mode 100644 VPN/unify-vpn/readme.md create mode 100644 VPN/wireguard-vpn/docker-compose.yml create mode 100644 VPN/wireguard-vpn/readme.md rename server.md => VPS/readme.md (100%) delete mode 100644 vpn.md diff --git a/VPN/readme.md b/VPN/readme.md new file mode 100644 index 0000000..6699350 --- /dev/null +++ b/VPN/readme.md @@ -0,0 +1,8 @@ +# VPN Setup + +I used 2 VPNs in my home setup + +1. Unify VPN +2. WireGuard VPN + +Reason being that Unify VPN is not easy to set up for an ubuntu machine, and I was not able to configure my VPS with it. That is why I set up a wireguard VPN to connect my local network to the VPS. diff --git a/VPN/login.sh b/VPN/unify-vpn/login.sh similarity index 100% rename from VPN/login.sh rename to VPN/unify-vpn/login.sh diff --git a/VPN/logout.sh b/VPN/unify-vpn/logout.sh similarity index 100% rename from VPN/logout.sh rename to VPN/unify-vpn/logout.sh diff --git a/VPN/unify-vpn/readme.md b/VPN/unify-vpn/readme.md new file mode 100644 index 0000000..a04314f --- /dev/null +++ b/VPN/unify-vpn/readme.md @@ -0,0 +1,111 @@ +# VPN setup + +## Intro + +This is a manual to set up the Unify VPN server on an ubuntu machine. Note that this is quite difficult to set up, and I was not able to complete the set up on my VPN. This is why I still use a WireGuard VPN next to this one. + +The advantages of this VPN however are that Ubiquity has quite a nice app (android/iOS/windows) to connect to the local network. That is why the main use of this VPN will be to connect to the home network from the outside. + +## Installation on linux + +See [this github thread](https://gist.github.com/nahall/6b23603ce9df2500a4053b280071d1ad) + +- In Debian install the "xl2tpd" and "strongswan" packages. + +- Edit /etc/ipsec.conf to add the connection: + + conn YOURVPNCONNECTIONNAME + authby=secret + pfs=no + auto=start + keyexchange=ikev1 + keyingtries=3 + dpddelay=15 + dpdtimeout=45 + dpdaction=clear + rekey=no + ikelifetime=3600 + keylife=3600 + type=transport + left=%defaultroute + leftprotoport=17/1701 + # Replace IP address with your VPN server's IP + right=IPADDRESSOFVPNSERVER + rightprotoport=17/%any + ike=aes128-sha1-modp2048,aes256-sha1-modp4096,aes128-sha1-modp1536,aes256-sha1-modp2048,aes128-sha1-modp1024,aes256-sha1-modp1536,aes256-sha1-modp1024,3des-sha1-modp1024! + esp=aes128-sha1-modp2048,aes256-sha1-modp4096,aes128-sha1-modp1536,aes256-sha1-modp2048,aes128-sha1-modp1024,aes256-sha1-modp1536,aes256-sha1-modp1024! + + +- Edit /etc/ipsec.secrets to add the secret key for this connection: + + IPADDRESSOFVPNSERVER : PSK "SECRETPRESHAREDKEY" + + +- Edit /etc/xl2tpd/xl2tpd.conf to add this connection: + + [lac YOURVPNCONNECTIONNAME] + lns = IPADDRESSOFVPNSERVER + ppp debug = yes + pppoptfile = /etc/ppp/options.l2tpd.client-YOURVPNCONNECTIONNAME + length bit = yes + + +- Create the file /etc/ppp/options.l2tpd.client-YOURVPNCONNECTIONNAME: + + ipcp-accept-local + ipcp-accept-remote + noccp + refuse-eap + refuse-chap + noauth + idle 1800 + mtu 1410 + mru 1410 + defaultroute + + # Uncomment if you want to use the DNS servers of the VPN host: + #usepeerdns + + debug + logfile /var/log/xl2tpd.log + connect-delay 5000 + proxyarp + name VPNUSERNAME + password "VPNPASSWORD" + + +- Now to connect to the VPN create a script: + + #!/bin/bash + + echo "Connecting to VPN..." + + echo "c YOURVPNCONNECTIONNAME" > /var/run/xl2tpd/l2tp-control + + sleep 10 + + # To have all internet traffic routed through the VPN uncomment: + #ip route add default dev ppp0 + + # To only have a remote subnet routed through the VPN uncomment + # (this line assumes the remote subnet you want routed is 192.168.0.0/24 and the remote VPN end is 10.11.0.1: + ip route add 192.168.0.0/24 via 10.11.0.1 dev ppp0 uplink + +> Script above didn't work exacly. I had to add `onlink` at the end + +```bash +/etc/init.d/ipsec restart +/etc/init.d/xl2tpd restart +``` + + +- And to disconnect to the VPN create a script: + + #!/bin/bash + + ip route del default dev ppp0 + ip route del 192.168.0.0/24 dev ppp0 + + echo "d YOURVPNCONNECTIONNAME" > /var/run/xl2tpd/l2tp-control + service xl2tpd restart + diff --git a/VPN/wireguard-vpn/docker-compose.yml b/VPN/wireguard-vpn/docker-compose.yml new file mode 100644 index 0000000..41e8f78 --- /dev/null +++ b/VPN/wireguard-vpn/docker-compose.yml @@ -0,0 +1,12 @@ +version: "3.9" +services: + whoami: + network_mode: "host" + image: traefik/whoami + command: + - --port=2001 + traefik: + network_mode: "host" + image: "traefik:1.7.10" + volumes: + - /home/pi/repos/homeAutomation/traefik/traefik.1.7.10.toml:/etc/traefik/traefik.toml diff --git a/VPN/wireguard-vpn/readme.md b/VPN/wireguard-vpn/readme.md new file mode 100644 index 0000000..0e76198 --- /dev/null +++ b/VPN/wireguard-vpn/readme.md @@ -0,0 +1,5 @@ +# WireGuard VPN + +## Intro + +This VPN is meant to connect the VPS with the home network. This folder also contains a docker-compose with a traefik setup. This traefik setup connects the home network with the VPS. diff --git a/server.md b/VPS/readme.md similarity index 100% rename from server.md rename to VPS/readme.md diff --git a/vpn.md b/vpn.md deleted file mode 100644 index 77cbcfa..0000000 --- a/vpn.md +++ /dev/null @@ -1,18 +0,0 @@ -# VPN setup - -## OS - -I used a raspberry pi with Raspberry PI OS lite on it. - ->Best to use Raspberry Pi Imager to flash image onto SD card. This flasher allows you to enable SSH and configure WLAN during flashing - -After that, I followed [this tutorial](https://pimylifeup.com/raspberry-pi-wireguard/) - -Notes on the tutorial: - -- Working with a no-ip hostname did not work. Probably because I did not wait long enough after configuring the hostname? For now, I have configured an IP address, but this is not ideal, as the IP address can change. -- After configuring the pivpn, best to run `pivpn -d` to fix an iptables issue (see [faq](https://docs.pivpn.io/faq/)) - -## Install docker & docker compose - -See [this](https://www.jfrog.com/connect/post/install-docker-compose-on-raspberry-pi/) \ No newline at end of file