Repository files navigation

English |中文

Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2.

An IPsec VPN encrypts your network traffic, so that nobody between you and the VPN server can eavesdrop on your data as it travels via the Internet. This is especially useful when using unsecured networks, e.g. at coffee shops, airports or hotel rooms.

We will useLibreswan as the IPsec server, andxl2tpd as the L2TP provider.

First, prepare your Linux server* with a fresh install of Ubuntu, Debian or CentOS.

Use this one-liner to set up an IPsec VPN server:

wget https://get.vpnsetup.net -O vpn.sh&& sudo sh vpn.sh

Your VPN login details will be randomly generated, and displayed when finished.

Optional: InstallWireGuard and/orOpenVPN on the same server.

curl -fsSL https://get.vpnsetup.net -o vpn.sh&& sudo sh vpn.sh

https://github.com/hwdsl2/setup-ipsec-vpn/raw/master/vpnsetup.shhttps://gitlab.com/hwdsl2/setup-ipsec-vpn/-/raw/master/vpnsetup.sh

A pre-builtDocker image is also available. For other options and client setup, read the sections below.

* A cloud server, virtual private server (VPS) or dedicated server.

• Fully automated IPsec VPN server setup, no user input needed
• Supports IKEv2 with strong and fast ciphers (e.g. AES-GCM)
• Generates VPN profiles to auto-configure iOS, macOS and Android devices
• Supports Windows, macOS, iOS, Android and Linux as VPN clients
• Includes helper scripts to manage VPN users and certificates

A cloud server, virtual private server (VPS) or dedicated server, freshly installed with:

• Ubuntu 22.04, 20.04 or 18.04
• Debian 11 or 10
• CentOS 7 or CentOS Stream 9/8
• Rocky Linux or AlmaLinux 9/8
• Oracle Linux 9, 8 or 7
• Red Hat Enterprise Linux (RHEL) 9, 8 or 7
• Amazon Linux 2
• Alpine Linux 3.16 or 3.15

This also includes Linux VMs in public clouds, such asDigitalOcean,Vultr,Linode,OVH andMicrosoft Azure. Public cloud users can also deploy usinguser data.

» I want to run my own VPN but don't have a server for that

For servers with an external firewall (e.g.EC2/GCE), open UDP ports 500 and 4500 for the VPN.

A pre-builtDocker image is also available. Advanced users can install on aRaspberry Pi.[1][2]

⚠️DO NOT run these scripts on your PC or Mac! They should only be used on a server!

First, update your server withsudo apt-get update && sudo apt-get dist-upgrade (Ubuntu/Debian) orsudo yum update and reboot. This is optional, but recommended.

To install the VPN, please choose one of the following options:

Option 1: Have the script generate random VPN credentials for you (will be displayed when finished).

wget https://get.vpnsetup.net -O vpn.sh&& sudo sh vpn.sh

Option 2: Edit the script and provide your own VPN credentials.

wget https://get.vpnsetup.net -O vpn.shnano -w vpn.sh[Replace with your own values: YOUR_IPSEC_PSK, YOUR_USERNAME and YOUR_PASSWORD]sudo sh vpn.sh

Note: A secure IPsec PSK should consist of at least 20 random characters.

Option 3: Define your VPN credentials as environment variables.

# All values MUST be placed inside 'single quotes'# DO NOT use these special characters within values: \ " 'wget https://get.vpnsetup.net -O vpn.shsudo VPN_IPSEC_PSK='your_ipsec_pre_shared_key' \VPN_USER='your_vpn_username' \VPN_PASSWORD='your_vpn_password' \sh vpn.sh

After setup, you may optionally installWireGuard and/orOpenVPN on the same server.

sudo VPN_DNS_NAME='vpn.example.com' sh vpn.sh

sudo VPN_CLIENT_NAME='your_client_name' sh vpn.sh

sudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 sh vpn.sh

sudo VPN_PROTECT_CONFIG=yes sh vpn.sh

curl -fL https://get.vpnsetup.net -o vpn.shsudo sh vpn.sh

https://github.com/hwdsl2/setup-ipsec-vpn/raw/master/vpnsetup.shhttps://gitlab.com/hwdsl2/setup-ipsec-vpn/-/raw/master/vpnsetup.sh

Read this in other languages:English,中文.

Get your computer or device to use the VPN. Please refer to:

Configure IKEv2 VPN Clients (recommended)

Configure IPsec/L2TP VPN Clients

Configure IPsec/XAuth ("Cisco IPsec") VPN Clients

Download PDF versions of VPN docs (supporters)

Enjoy your very own VPN! ✨🎉🚀✨

Like this project? You can show your support or appreciation.

 

Windows users: For IPsec/L2TP mode, aone-time registry change is required if the VPN server or client is behind NAT (e.g. home router).

The same VPN account can be used by your multiple devices. However, due to an IPsec/L2TP limitation, if you wish to connect multiple devices from behind the same NAT (e.g. home router), you must useIKEv2 orIPsec/XAuth mode. To view or update VPN user accounts, seeManage VPN users.

For servers with an external firewall (e.g.EC2/GCE), open UDP ports 500 and 4500 for the VPN. Aliyun users, see#433.

Clients are set to useGoogle Public DNS when the VPN is active. If another DNS provider is preferred, seeAdvanced usage.

Using kernel support could improve IPsec/L2TP performance. It is available onall supported OS. Ubuntu users should install thelinux-modules-extra-$(uname -r) package and runservice xl2tpd restart.

The scripts will backup existing config files before making changes, with.old-date-time suffix.

Use this one-liner to updateLibreswan (changelog |announce) on your VPN server.

wget https://get.vpnsetup.net/upg -O vpnup.sh&& sudo sh vpnup.sh

curl -fsSL https://get.vpnsetup.net/upg -o vpnup.sh&& sudo sh vpnup.sh

https://github.com/hwdsl2/setup-ipsec-vpn/raw/master/extras/vpnupgrade.shhttps://gitlab.com/hwdsl2/setup-ipsec-vpn/-/raw/master/extras/vpnupgrade.sh

The latest supported Libreswan version is4.7. Check installed version:ipsec --version.

Note:xl2tpd can be updated using your system's package manager, such asapt-get on Ubuntu/Debian.

SeeManage VPN users.

• Manage VPN users using helper scripts
• View VPN users
• View or update the IPsec PSK
• Manually manage VPN users

SeeAdvanced usage.

• Use alternative DNS servers
• DNS name and server IP changes
• IKEv2-only VPN
• Internal VPN IPs and traffic
• Customize VPN subnets
• Port forwarding to VPN clients
• Split tunneling
• Access VPN server's subnet
• Modify IPTables rules
• Deploy Google BBR congestion control

To uninstall IPsec VPN, run thehelper script:

Warning: This helper script will remove IPsec VPN from your server. All VPN configuration will bepermanently deleted, and Libreswan and xl2tpd will be removed. Thiscannot be undone!

wget https://get.vpnsetup.net/unst -O vpnunst.sh&& sudo bash vpnunst.sh

curl -fsSL https://get.vpnsetup.net/unst -o vpnunst.sh&& sudo bash vpnunst.sh

https://github.com/hwdsl2/setup-ipsec-vpn/raw/master/extras/vpnuninstall.shhttps://gitlab.com/hwdsl2/setup-ipsec-vpn/-/raw/master/extras/vpnuninstall.sh

For more information, seeUninstall the VPN.

• Have a suggestion for this project? Open anEnhancement request.Pull requests are also welcome.
• If you found a reproducible bug, open a bug report for theIPsec VPN or for theVPN scripts.
• Got a question? Please first searchexisting issues and commentsin this Gist andon my blog.
• Ask VPN related questions on theLibreswan orstrongSwan mailing list, or read these wikis:[1][2][3][4][5].

Copyright (C) 2014-2022Lin Song
Based onthe work of Thomas Sarlandie (Copyright 2012)

This work is licensed under theCreative Commons Attribution-ShareAlike 3.0 Unported License
Attribution required: please include my name in any derivative and let me know how you have improved it!