Your Own OpenVPN Server on mikr.us

What is it and why do I need it?

Open-source software that lets you create secure connections between devices on a network. These connections are tunnels that carry encrypted data over the Internet, together forming a virtual private network, or VPN. What does this give you? You can access private resources hosted on any computer without making them publicly available on the Internet. These resources can include:

• a home automation management panel (e.g. Domoticz or HomeAssistant)

• a drive on your home network

• a printer

• a home Minecraft server

• a home DNS server

• and much, much more :)

Sounds great? Here's what you'll need:

• a server where you'll configure the service - in this tutorial, I'll use mikr.us

• the server must have at least one open port and, preferably, a static IP address

• a little free time and some patience :)

Preparing mikr.us

If you're using a server other than mikr.us, skip this step. Before we start installing anything, we need to make a few small changes in the configuration panel. To do this, log in at https://mikr.us/panel/.

In the panel, select TUN/TAP from the menu on the left.

Then click the "Enable TUN/TAP" button. What does this do? It enables support for the TUN/TAP device required by OpenVPN, which is disabled by default for ordinary mortals :)

Now you need to choose a port for your server. OpenVPN uses port 1194 by default, but unfortunately you can't use it here. mikr.us servers are shared on a single machine, so you're limited to two ports. Recently, you can also request a few extra ports for free, so this isn't much of a problem. You can check your ports by selecting "TCP Ports" from the side menu.

Now you need to make a small decision. I assume you know the difference between TCP and UDP. In short, with TCP every packet must be delivered and acknowledged by the recipient. If delivery fails, the packet is automatically retransmitted. This gives us reliable delivery, but at the cost of flexibility and speed. The meme below shows this quite well.

By default, OpenVPN uses UDP. Why? Because it's faster. TCP packet transfer speed depends heavily on geographical distance and on the fact that packets have to travel both ways - every received packet must be acknowledged. Over short distances this doesn't make much difference. That's why UDP is generally recommended for VPN connections unless you run into connection problems. On mikr.us, I recommend using one of the ports assigned to you by default, because only those ports can use this protocol. If you're already using both of them, then you'll need to add another port and use TCP.

OpenVPN server configuration

We'll use the ready-made openvpn-install script from the repository https://github.com/Angristan/OpenVPN-install. Why this one? Because it is frequently updated and has strong community support. It also officially supports Ubuntu 16.04, which is still used on older mikr.us v3 servers. And why use a script instead of configuring everything manually? Because manual configuration is harder, and I want to keep this guide simple.

Log in to the server console, download the script, and make it executable.

curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
sudo chmod +x openvpn-install.sh

Now run it.

sudo ./openvpn-install.sh

The script will ask you several configuration questions. They are all explained well, but I'll also describe them here. Unfortunately, there is a chance that they will look slightly different in a future version of the script. If that happens and you don't understand something, please leave a comment and I'll try to update the guide.

Question 1 - enter the external IPv4 address. The script detects the internal address. We therefore need to provide the server address, preferably a domain name (so if the server's IP address changes, it won't cause a problem for us). Enter srv03.mikr.us (if you're on a server other than 03, make sure to enter your own server name). If you're using a provider other than mikr.us, you'll need to find your external IP address yourself.

Question 2 - the script will check whether an IPv6 connection is available. Personally, I think it's worth configuring if you have the option. If IPv6 isn't available, the script will skip this step.

Question 3 - the port. I covered this earlier. On mikr.us, choose option 2) so you can enter the port manually, then enter the port you selected earlier. If you're not using mikr.us, leave the default port unless your provider blocks it (some providers block VPN connections).

Question 4 - UDP or TCP. I also covered this earlier. I recommend choosing UDP unless it isn't available or causes connection quality problems.

Question 4 - which default DNS server should be used after the connection is established? Here's what this means. A DNS server resolves domain names to server IP addresses. After connecting to the OpenVPN server, this DNS server will be set as the primary one. If you don't provide one, websites you try to access by domain name won't work. You can use the DNS server currently used by mikr.us or choose another one. You can also host your own or choose one that blocks advertising and phishing servers by default. If you're not sure which one to choose, I recommend OpenDNS or AdGuard.

Question 5 - do you want to use compression? The benefit is more efficient data transfer, but the downside is exposure to the VORACLE attack. I recommend the safer option: don't use compression.

Question 6 - do you want to configure the security settings yourself? I recommend leaving them alone. The default settings are well balanced. They don't use weak options, but they also avoid overly strict settings that would put unnecessary load on the system.

Done! Press any key to finish the configuration. The script will now configure everything based on your choices. Once the setup is complete, you'll be able to generate your first certificate. Press any key and enter a name.

Adding and removing certificates

To add or remove a certificate, run the script again.

sudo ./openvpn-install.sh

If you want to add a new certificate, choose 1 and enter its name. Similarly, if you want to remove one, choose 2 and enter its name.

The certificates will appear in the user's home directory. The script will tell you where the certificate was saved after creating it.

Basic configuration

We want to add a few settings. The goal of this guide is not to route all Internet traffic through the server (although you can of course do that!), but to extend the network with additional devices from outside. To do this, let's add some new settings. First, open the server configuration file:

sudo nano /etc/openvpn/server.conf

And add the settings below at the end of the file. I've tried to describe them so they are easy to understand. The semicolon acts as a comment here, so you can copy the code below together with the descriptions. Client management will be covered later in this guide.

;allow clients to see each other
client-to-client
;allow only a specific address range
route-nopull 
route 10.8.0.0 255.255.255.0
;enable client management
;management 0.0.0.0 5555

Save the file with CTRL+X. Restart the OpenVPN server.

sudo systemctl restart [email protected]

This is where I ran into a problem. The service could not be restarted, and the logs showed "Failed to connect to bus: No such file or directory". I don't know what causes this. It may only happen on mikr.us.

Fortunately, the solution is very simple - you need to increase the process limit. To do this, open the OpenVPN service file for editing.

sudo nano /lib/systemd/system/[email protected]

Then find this line.

LimitNPROC=10

And replace it with the following.

LimitNPROC=infinity

The whole thing should look like the screenshot below.

Now exit the file, save the changes with CTRL+X and confirm. Then reload the services and restart OpenVPN with the following commands.

sudo systemctl daemon-reload
sudo systemctl restart [email protected]

Connecting from Windows

Download the latest version of the OpenVPN client from the official website. Go there and find the latest version of the openvpn-install-X-Win10.exe file (see the screenshot below). At the time of writing, the latest version is openvpn-install-2.4.9-I601-Win10.exe. Download and install it. The installer will install a simple application, a service that runs in the background, and add it to system startup.

By default, the application stores its configuration in the C:\Users\%username%\OpenVPN\config\ folder. Open this folder, create a new folder, for example mikrus, and paste the certificate generated in the "Adding and removing certificates" section into it. I recommend WinSCP for downloading files from mikr.us. Then start OpenVPN GUI - it should now appear in the system tray. Right-click its icon (in the system tray), select your configuration, and click "Connect". That's it. From now on, you have access to the VPN network.

To test that everything works correctly, connect to mikr.us through the new network. In Putty, enter the address 10.8.0.1 and port 22, and use the same login and password.

Connecting from Linux

Open a terminal on your Linux device. I'll use my home Raspberry Pi for this. Then install the OpenVPN client.

sudo apt-get update
sudo apt-get install openvpn

Next, copy the certificate generated earlier to "/etc/openvpn/" and rename it to "client.conf". The easiest way to do this is with WinSCP. Alternatively, from the terminal, go to the directory, create the file, paste the certificate contents, save with CTRL+X, and confirm. Make sure the contents of the file are copied exactly - in my case, text wrapping was enabled by default, and the connection will not work with it!

cd /etc/openvpn
sudo nano client.conf

Then enable and start the OpenVPN service.

sudo systemctl enable [email protected]
sudo service openvpn@client start

Check whether everything started correctly.

sudo service openvpn@client status

You should see something similar to the screenshot below.

Connecting automatically on Raspberry Pi

To make the connection start automatically when Raspberry Pi boots, you need to make a small configuration change. Open the openvpn package configuration file on the Raspberry Pi.

sudo nano /etc/default/openvpn

Then add the following entry to the configuration, as shown in the screenshot.

AUTOSTART="client"

Alternatively, you can uncomment AUTOSTART="all" to make all OpenVPN connections start automatically.

Remember to restart the OpenVPN service.

sudo service openvpn@client restart