How to write a VPN (P1)
A VPN is simply a way of bridging two otherwise disconnected networks, such that users in network A could reach users in network B, where A and B are two disconnected networks. A VPN may also provide encryption but that is not a requirement.
A more practical way to describe a VPN, is a tunnel, an IP tunnel to be exact.
IP tunnels
An IP tunnel simply forwards IP packets by encapsulating them in another packet, the encapsulated packet is then extracted at the other end of the tunnel before being sent to its original destination.
Now let’s talk implementation, First let’s consider the parts illustrated in the figure above:
- Client (this tutorial).
- Transport.
- Server.
The Client
To tunnel packets generated at the client, We need a way of achieving the following:
- Capturing locally generated packets at the client.
- Sending packets through transport.
- Reading incoming packets from the transport and forwarding them to the kernel.
Packet capture
The natural way to tunnel packets in Linux is through TUN and TAP.
- TUN works in layer3 (Captures IP packets) and is preferred for routing purposes (tunneling).
- TAP works in layer2 (Captures Ethernet frames) and is preferred for switching purposes.
Put simply, TUN and TAP are just network interfaces backed by the kernel instead of physical hardware.
VPNs intercept outgoing packets by overriding the default route to have packets go through the TUN interface, and they route incoming packets to their original destinations by writing the packets to the TUN interface.
This relies on the fact that packets written to the TUN interface is treated by the kernel as incoming packets and they follow the normal routing rules as if they were received by a physical interface, This is critical to the function of a tunnel.
Okay, now let’s demystify what we covered so far by way of example:
The following gist creates the TUN interface and overrides the default route to route all packets through it.
As you can see, packets are now being routed through our interface ��
Packet routing
Having captured the outgoing packets, Now we need to route them somewhere.
Linux routing rules are very simple:
- Outgoing packets received by the TUN interface will have the TUN interface IP address as the source and will retain their original destination.
- To hand-over an incoming packet to its original sender, Packet can simply be written to the TUN interface.
- Routing is symmetric, So packets routed through eth0 -> tun0 will have their responses automatically routed through tun0 -> eth0. Routing an incoming packet to eth0 is as simple as writing the packet to tun0.
- Packets written to the TUN interface should have the TUN interface address as the destination and not the originating interface, The Linux kernel will automatically detect that a packet is a response to a previously sent packet and route it to the originating interface (eth0).
Now, You should have some idea about what is needed to implement the client, in the next part we will discuss the transport and finish the client implementation.
Как написать свой vpn на python
To Protect Our system from unauthorized users Access you can spoof our system’s IP Address using VPN service provided by different organizations. You can set up a VPN on your system for free.
After you set up and log in to the VPN over the Ubuntu system you need to manually connect with different VPN servers after some duration. We can automate it using python so that automatically the IP address of our system keeps changing after some duration so that no one can have track of our system anyhow. It will make our system more protected.
Follow the steps to Automate VPN using Python:
Step 1: Open your terminal (Ctrl+Alt+T) and create a file using gedit by typing the following command on the terminal.
Step 2: import the modules of python into the opened file.
Connect VPN Using Python
In the world, security and privacy have become major concerns for people. In search of a solution, developers made VPNs.
What is a VPN
Since VPN creates a private network within the public network, what we do on the internet can’t be virtually traced. It hides our IP address, so third parties can’t track our activities.
Hiding the IP means the website we visit through a VPN sees the VPN server as the origin of the traffic.
So, VPN will mask the user’s IP address, and the IP of the VPN server will be visible. Most importantly, this process prevents exploitation of the user’s location and the traffic; therefore, the user’s privacy is protected.
VPN also encrypts our online data. The VPN encrypts the data we send throughout the internet so that hackers and other third parties can’t retrieve them.
Even if they retrieve them, they will not be able to understand the content or decrypt the data.
Connect VPN Using Python
This tutorial will use a free VPN service from VPNGate and OpenVPN software. VPNGate is a public VPN cloud service that we can use for free.
To use OpenVPN , we need to install it on our system. For Windows OS, you can manually download and install it.
For Linux or Ubuntu users, use the below command.
After installing it, we can build a Python script to connect to the VPN. When we run this script in the terminal, we have to provide a country as an argument.
VPN Server
To take it a step further, if you have a registered domain in AWS, vpn-server can be accessed with an alias record in route53 pointing to the public IP of the ec2 instance.
- All the above steps are performed automatically when creating a new VPN server.
- This module can also be used to clean up all the AWS resources spun up for creating a vpn server.
ENV Variables
Environment variables are loaded from .env file if present.
- IMAGE_ID — AMI ID to be used. Defaults to a pre-built AMI from SSM parameter for OpenVPN Access Server AMI Alias.
- INSTANCE_TYPE — Instance type to use for the VPN server. Defaults to t2.nano , use t2.micro if under free-tier.
- VPN_USERNAME — Username to access OpenVPN Connect client. Defaults to log in profile or openvpn
- VPN_PASSWORD — Password to access OpenVPN Connect client. Defaults to awsVPN2021
- DOMAIN — Domain name for the hosted zone.
- RECORD_NAME — Alias record name using which the VPN server has to be accessed.
To get notification about login information:
- GMAIL_USER — Username of the gmail account.
- GMAIL_PASS — Password of the gmail account.
- RECIPIENT — Email address to which the notification has to be sent.
- PHONE — Phone number to which the notification has to be sent (Works only for US based cellular)
Optionally env vars for AWS config ( AWS_ACCESS_KEY , AWS_SECRET_KEY , AWS_REGION_NAME ) can be setup.
Install
Usage
Following are the prompts and response required to configure the VPN server.
- Are you sure you want to continue connecting (yes/no)? yes
- Please enter ‘yes’ to indicate your agreement [no]: yes
- Will this be the primary Access Server node? Default: yes
- Please specify the network interface and IP address to be used by the Admin Web UI: Default: all interfaces: 0.0.0.0
- Please specify the port number for the Admin Web UI. Default: 943
- Please specify the TCP port number for the OpenVPN Daemon. Default: 443
- Should client traffic be routed by default through the VPN? yes
- Should client DNS traffic be routed by default through the VPN? Default: No
- Use local authentication via internal DB? Default: yes
- Should private subnets be accessible to clients by default? Default: yes
- Do you wish to login to the Admin UI as «openvpn»? Default: yes
- Specify the username for an existing user or for the new user account:
- Type the password for the ‘vicky’ account:
- Confirm the password for the ‘vicky’ account:
- Please specify your Activation key (or leave blank to specify later):
- Download the OpenVPN application and get connected to the VPN server.
AWS Resources Used
- EC2
- Instance — To redirect traffic through the instance’s IP
- SecurityGroup — To allow traffic over specific TCP ports
- Systems Manager — To access OpenVPN SSM parameter store to retrieve the AMI ID
- Route53 [Optional] — To access VPN server using an A record in Route 53
Release Notes
Requirement
Usage
Linting
PreCommit will ensure linting, and the doc creation are run on every commit.