This is a hacker/developer/sysadmin oriented guide to set up on demand VPN on Amazon EC2 server. Amazon EC2 t2.micro instance costs 0.013 USD per hour, so the deal is very light for your purse, beating commercial VPN pricing by an order of magnitude. Further, Amazon provides 750 hours of free of t2.micro instance usage for new users.

We automatize the cumbersome server configuration tasks using Ansible automatization tool. With Ansible, you’ll get your own VPN service up’n’running in 30 minutes. The instructions work on OSX and Linux systems and Ansible won’t run on Windows.

We set up PPTP VPN. The VPN is good for watching Netflix where US region enjoys wider availability of entertainment. The VPN is also good defeating other US geofencing services and protecting your privacy on open Wi-Fi hotspots. Android, iOS (iPhone / iPad), OSX, Linux and Windows all support PPTP protocol out of the box, so no additional software is needed on your device.

Prerequisites

Command line basics
git and ssh installed
credit card

Setting up EC2

Go to AWS and sign up for an account. The payment options include all common credit cards.

Sign up for t2.micro on demand instance using Ubuntu 14.04 image. Pick an instance from US East Coast (N. Virginia) availability zone for the maximum speed from Europe. AWS prompts yoy to download SSH keys to access the instance. Store them safely. Below we assume you download keys named amazon and store them in your SSH folder:

mv ~/Downloads/amazon.pem ~/.ssh
chmod 400 ~/ssh/amazon.pem

By default, EC2 instances are firewalled. In your EC2 instance list, click Security Group for the instance (Security group name should be like launch-wizard-1). Go to Inboud > Edit and choose All traffic. This allows access to PPTP service and Squid proxy which will be installed on the server.

Installing PPTP using Ansible

Install Ansible. Packages available for Ubuntu, OSX Homebrew and others. Ansible is a tool installed on your local computer and it will connect the server over SSH.

Clone the Ansible playbook which automates PPTP installation on your server.:

git clone https://github.com/liangshan/drill-ansible.git

Replace hosts file in the playbook. Change the IP address to your instance IP address as shown in Amazon AWS console:

[amazon]
1.2.3.4 ansible_ssh_user=ubuntu ansible_sudo=true ansible_ssh_private_key_file=~/.ssh/amazon.pem

You need to wait until instance state says Running in AWS console. Then proceed to install and configure PPTP on the server using Ansible:

ansible-playbook -i hosts site.yml --extra-vars '{"hosts":"1.2.3.4","username":"vpn","password":"changeme"}'

Now you can connect to your VPN using the instance IP address, username vpn and password changeme.

Connecting to VPN with Android

Test your VPN on Android by going to menu Settings > Wireless & networks > More > VPN. Hit + to add new entry. Choose PPTP, enter your server IP, username and password. Choose the created entry to connect. In few seconds you should see Connected status and a key icon appears in Android status bar.

Please note that the instance IP address changes on every start and stop. You can update the VPN IP address by doing a long press on the entry in Android VPN menu.

Starting and stopping EC2 instance on demand

Download AWS Console app from Google Play Store or from App Store for your mobile. The app takes your AWS credentials and allows you to start and stop the EC2 instances with a single click.

After starting you’ll see the new IP address of the instance in Public IP field of AWS Console app.

Other

Please note that PPTP does not work on cheap OpenVZ virtual machines due to lack of kernel support – a full virtual machine is required. The Ansible playbook is kindly provided by Liang Shan.

$\"\"$ Subscribe to RSS feed Follow me on Twitter Follow me on Facebook Follow me Google+

This is short guide how to set-up VPN service on Ubuntu Linux server. VPN is intended to secure your internet traffic against local snooping by encrypting the traffic and tunneling it out from known good server. Possible use cases are

Secure your organization internal traffic between home office, mobile devices an the office
Hide internet traffic from the big brother
Spoof your location for TV and video streams: you are renting a server in a different country, like US, allowing you to watch US only video streams
Spoof your location for iPhone / iPad / iPod / Android apps
Visit sites which are otherwise unreachable (though in this case an SSH tunnel + SOCKS proxy is easier to set-up, more lightweight, alternative)
Test mobile applications against local servers during mobile app development

These instructions set-up VPN using PPTP protocol which is widely supported. After the server has been set-up you can use any modern OS or device to connect to the VPN: Windows, OSX, Linux, iOS, Android, etc.

1. Prerequisitements

Basics of UNIX command line (the hacker typing thing)
Basics of Linux server administration

2. Setting up PPTP daemon

We are using (old) Ubuntu 8.04 server though instructions should apply for later Ubuntu versions too. These installation instructions are restart free – however few commands must be placed into /etc/rc.local file to make the changed settings persist over Linux restarts.

First install some free software

sudo apt-get install pptpd telnet iptables

Pick up your server public fixed IP address. Usually this is what you see in ethernet 0 adapter.

ipconfig

Then edit /etc/pptpd.conf

sudo nano /etc/pptpd.conf

(Use sudo nano for editing other files too later in this tutorial)

Uncomment and change the localip line to your server public IP address

localip 70.164.204.106

Then edit /etc/ppp/pptpd-options

Make PPTP service to give DNS name resolving servers for the VPN clients. In optimal case you use the DNS server from your server provider, but Google’s public DNS servers (below) work fine:

sudo nano /etc/ppp/pptpd-options

Uncomment and change ms-dns lines to

ms-dns 8.8.8.8
ms-dns 8.8.4.4

Edit /etc/ppp/chap-secrets as sudo and add your PPTP username and password (plaintext)

sudo nano /etc/ppp/chap-secrets 

# Secrets for authentication using CHAP
# client    server    secret            IP addresses
opensource  pptpd     hacker            *

Run the following commands to enable IP NAT routing on your server (allows piping traffic through the public IP of the server):

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

sudo sysctl net.ipv4.ip_forward=1

These settings above are effective only until the server restart. Put them into /etc/rc.local start-up script file to make sure Linux runs them on the start-up.

Restart PPTP daemon to make it read settings again

sudo /etc/init.d/pptpd restart

3. Setting VPN PPTP client

For the VPN client (iPad, Windows, OSX, Ubuntu Network Manager) the settings would be for the example above:

Protocol: PPTP
Server: your server public IP or DNS name
Login: opensource
Password: hacker
Encryption level: auto (or it should pick secure MPPE 128 by default)
Send all traffic: Yes (will forward all traffic through VPN, not just one inside your VPN devices)

4. Troubleshooting

If the VPN traffic is not going through, i.e. your internet stops working when VPN client is active, here are some instructions to pinpoint where the error happens.

Inspect the server syslog while connecting to the VPN service

sudo tail -f /var/log/syslog

These lines are “normal”:

Oct 22 18:34:05 ubuntu pppd[19129]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Oct 22 18:34:05 ubuntu pppd[19129]: pppd 2.4.4 started by root, uid 0
Oct 22 18:34:05 ubuntu pppd[19129]: Using interface ppp0
Oct 22 18:34:05 ubuntu pppd[19129]: Connect: ppp0 <--> /dev/pts/1
Oct 22 18:34:05 ubuntu pptpd[19128]: GRE: Bad checksum from pppd.
Oct 22 18:34:08 ubuntu pppd[19129]: MPPE 128-bit stateless compression enabled
Oct 22 18:34:09 ubuntu pppd[19129]: Cannot determine ethernet address for proxy ARP
Oct 22 18:34:09 ubuntu pppd[19129]: local  IP address x.x.x.x
Oct 22 18:34:09 ubuntu pppd[19129]: remote IP address 192.168.0.234

On the client side, try to use ping command to reach servers by IP address to determine if you have problems with DNS set-up

Your server public IP
8.8.8.8 (Internet IP, Google’s public DNS server)
google.com

E.g. run the command

ping 8.8.8.8

.. and see if the packets go through.

If you manage to ping numeric IPs, but not google.com the problem is with DNS settings.

After the traffic is flowing through check the public IP address your device using duckduckgo.com:

https://duckduckgo.com/?q=!what+is+my+ip

It should give your VPN server IP address instead of your lcoal public IP address.

5. Random notes

iOS devices and Android devices also may use crowdsourced WLAN / 3G station data for determining yout location, so you might need to spoof your local WLAN connection somehow
To determine if WLAN is being used just open Google Maps, show your location and if it doesn’t go to the location of VPN server then it is using your WLAN position
Practical workaround: Just set a temporary tethering WLAN access point using your mobile phone (e.g. Android) and walk to somewhere where your device cannot hear WLAN to work around this – most of apps check the location only once during the launch