How to set up your own free VPN server on AWS

https://www.webdigi.co.uk/blog/2015/how-to-setup-your-own-private-secure-free-vpn-on-the-amazon-aws-cloud-in-10-minutes/

by roflmatz • 11 years ago

85 32 11 years ago

webdigi.co.uk

Nux• 11 years ago

Why is PPTP still used and promoted?

http://en.wikipedia.org/wiki/Point-to-Point_Tunneling_Protoc...

smileplease• 11 years ago

The AWS cloudformation template on the site supports both PPTP and L2TP IPSEC protocol. So use as you like based on your security needs / device compatibility.

anfogoat• 11 years ago

It's fast, easy to setup and has less overhead. It's perfectly fine when all you're looking for is a different geolocation quickly.

But it shouldn't be promoted as secure.

drzaiusapelord• 11 years ago

Because IPSec is a dog in a million different ways (config, firewall, etc) and lots of shops moved to PPTP because it shipped on their Windows servers and is brain-dead simple to implement and use. It was "good enough." A lot of those issues linked are MS specific anyway, regarding MS-CHAP. You don't have to use MS-CHAP.

PPTP has fallen out of fashion now, and I'm a little surprised to see it being promoted. Now we're all moving to IPSec running in L2TP which seems to be the best of both worlds. You lose the various firewall issues plain jane IPSec introduces and get IPSec level security. Of course you still have an IPSec config on your hands, but that's a one time pain. OSX, Windows, and Android support it natively which is a big plus as well.

If you just want something quick and dirty, PPTP or OpenVPN SSL VPN are the obvious choices. Personally, I'd rather just do SOCKS or port forwarding with an ssh server somewhere than do lazy VPN. Its worth getting right.

urda• 11 years ago

Don't use PPTP

goalo2• 11 years ago

You can also use L2TP IPSEC. Use PPTP for devices that dont support L2TP.

desdiv• 11 years ago

Streisand[0] also only takes about 10 times, but with fewer mouse clicks and is much, much more secure. By default it tunnels OpenVPN over stunnel so that your connections looks exactly like regular SSL sessions (albeit SSL sessions that last for months at a time).

https://github.com/jlund/streisand

pacofvf• 11 years ago

is there a way to use streisand at an existing instance of EC2/DO ?

Couto• 11 years ago

Yes.

Streisand is just a bundle of ansible playbooks so it can easily be deployed on any server that meets the requirements: Debian 7 or similar.

It also has a nice menu to deploy to Amazon, Linode, Digital Ocean and Rackspace without extra effort.

fit2rule• 11 years ago

Streisand is amazing. I did the VPN setup that is mentioned in the OP, and it worked well .. but then I read your comment and set it up too .. and its just lightyears ahead in terms of what you get out of the process at the end.

themanual2• 11 years ago

managed to get my Tokyo vpn server quickly. awesome.

xutopia• 11 years ago

They speak of a free tier for new AWS customers but how much does it cost if we're not a new customer?

hu_me• 11 years ago

the same tiered machine running for a full month costs about 7usd.

Someone12344• 11 years ago

Little more than that. $7 with a reserved instance maybe. I'd say $10-11, but sub-$10 with a reserved instance (including the initial buy-in).

kasabali• 11 years ago

Beware that free tier has 15 GB upload limit.

from https://aws.amazon.com/free/:

  Data Transfer
  
  15 GB of bandwidth out aggregated across all AWS services*

goalo2• 11 years ago

Yes, It is per month and further traffic costs $0.09 / GB

jamiesonbecker2• 11 years ago

In case you were wondering, that adds up FAST. :)

Someone12344• 11 years ago

I'd always recommend anyone using the free tier to add a free billing alert to your AWS account. For example when I had a free tier server, it cost me roughly $5/month, so I had an alert set to $15/month.

When my free tier ran out (I got the month wrong) the alert notified me ($16 in charges) and I purchased a reserved instance to bring the cost back down to under $10/month.

TheLoneWolfling2• 11 years ago

Until / unless there is a way to actually put a cap on billing (not just a notification), it's something I'll stay away from when I can.

azurelogic• 11 years ago

I was really hoping this would be a more generic tutorial for various Linux flavors. I failed miserably at setting up L2TP IPSec last time I tried.

scintill76• 11 years ago

However, it has always been hard to trust a VPN provider who could potentially log and intercept your internet traffic!

Later:

Then under Template, Source, select “Specify an Amazon S3 template URL” and paste in this URL https://s3.amazonaws.com/webdigi/VPN/Unified-Cloud-Formation... and then click Next.

Now you're just trusting your obscure VPN machine-image provider not to log and intercept your traffic! (Or am I misunderstanding what using this URL does?)

Like another commenter, I was sort of hoping for something more generic.

JosephRedfern• 11 years ago

I wrote a pretty generic blog post (not AWS specific) a couple of years ago about how to quickly set up a VPN Server: https://redfern.me/quick-and-dirty-vpn-server-with-pptpd/

themanual2• 11 years ago

the project is open source and you can view the code. the underlying os is the base Ubuntu image provided by amazon.

2bluesc• 11 years ago

I created a Docker image that runs OpenVPN and wraps the verbose key and cert generation process. Works on any cloud provider that runs Docker instances (I try to avoid OpenVZ).

https://registry.hub.docker.com/u/kylemanna/openvpn/

https://github.com/kylemanna/docker-openvpn

BrianHutch• 11 years ago

Here is another example using Digital Ocean. This looks complicated but is very simple: https://www.digitalocean.com/community/tutorials/how-to-set-...

If you want to use Docker: https://www.digitalocean.com/community/tutorials/how-to-run-...

lcmatt• 11 years ago

If you don't mind the 2 user limit might as well install OpenVPN Access Server. Gives you a web UI and the setup is easier https://www.digitalocean.com/community/tutorials/how-to-inst...

Someone12344• 11 years ago

Who owns 169.254.169.254? Just looking at the wget in the setup script...

Also I'd suggest people get an OpenVPN VPN if they can. PPTP is insecure/broken, nobody should be using it ever. And while L2TP/IPSec is secure, it is a massive PITA to use and is often blocked on public WiFi (where a VPN is most useful) because they don't allow the ports/protocols (plus IPSec traversal is a nightmare in some cases).

OpenVPN acts like an SSL connection (not dissimilar to that used by HTTPS) so it works more places. It also traverses most network equipment without issue since, again, it looks similar to HTTPS traffic.

PS - I have no horses in this race, but I have setup an L2TP/IPSec VPN on EC2 before, it was an unpleasant experience all around.

PPS - If you REALLY want OpenVPN to work great put it on port 443. If you browse there nothing will happen, but OpenVPN clients will happily use the port and few if any network equipment is designed to block it.

snorkel• 11 years ago

169.254.169.254 explained here http://tools.ietf.org/html/rfc3927

Someone12344• 11 years ago

Ah I see. Here's a better explanation: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-insta...

virtualjj• 11 years ago

I like the CloudFormation bit - I think I'll give that a try. I wrote a book on how to setup your own VPN in AWS for overseas streaming (step-by-step) but using the OpenVPN AS appliance.

Everyone's mileage and needs are different but OpenVPN is probably a better choice over PPTP & L2TP for security and speed - at least in my experience. www.virtualjj.com if you want to take a peak of what I did.

How to set up your own free VPN server on AWS

Related Stories