Introduction#
This is the eduVPN/Let’s Connect! documentation repository. This repository targets administrators and developers. It contains information on how to deploy the VPN software on a server, but also (technical) details about the implementation needed to (better) integrate it in existing infrastructure, and how to modify the software for one’s own needs.
For more information see:
- https://www.eduvpn.org
- https://letsconnect-vpn.org
NOTE: if you are an end-user of eduVPN and want to contact someone, please try to find the contact information of your organization here. If you don’t know where to go, then simply contact us at eduvpn-support@lists.geant.org.
Supported Versions#
| Version | Release Date | OS Support | EOL |
|---|---|---|---|
| 3 | 2022-05-25 | Debian (>= 11), Ubuntu (>= 22.04), Fedora (>= 37), EL (>= 9) | TBD |
| 2 | 2019-04-02 | Debian (>= 10), CentOS 7, Fedora (>= 37) | 2024-06-30 |
| 1 | 2017-07-13 | N/A | N/A |
We support a release until such time the EOL date has been reached or none of the eduVPN servers we officially support are running that version anymore, whichever comes first.
We only support the particular release on operating systems that are still supported by their vendor!
Features#
This is an (incomplete) list of features of the VPN software:
- OpenVPN server accepting connections on both UDP and TCP ports;
- Uses multiple OpenVPN processes for load sharing purposes;
- Scales from a Raspberry Pi to many core systems with 10GBit networking;
- Full IPv6 support, using IPv6 inside the tunnel and connecting over IPv6;
- Support both NAT and publically routable IP addresses;
- CA for managing client certificates;
- Secure server and client configuration out of the box;
- Portal to allow users to manage their configurations for their devices and admins to manage users, configurations and connections;
- Multi Language support;
- Authentication to portals using local user database (default), LDAP, RADIUS, SAML and Client Certificates;
- OAuth 2.0 API for integration with native eduVPN/Let’s Connect! applications;
- Two-factor authentication TOTP support with user self-enrollment;
- Deployment scenarios:
- Route all traffic over the VPN (for safer Internet usage on untrusted networks);
- Route only some traffic over the VPN (for access to the organization network);
- Client-to-client (only) networking;
- Group ACL support with SAML and LDAP;
- Ability to disable all OpenVPN logging (default);
- Support multiple deployment scenarios simultaneously;
- SELinux fully enabled (on CentOS and Fedora);
- Guest Usage scenario for allow users of one server to use other designated servers (optional);
- Native applications available for most common platforms.
Client Support#
See Client Compatibility for more information about the supported OpenVPN clients.
Deployment#
NOTE: if you plan to install and run a eduVPN/Let’s Connect! server please subscribe to the “deployers” mailing list here. It will be used for announcements of updates and discussion about running eduVPN/Let’s Connect!.
IRC Contact#
You can also join IRC for technical questions/discussions/feedback on
Libera.Chat, channel #eduvpn. Please stick around for
a while to wait for a response!
You can also easily use the Web Chat if you can’t be bothered to setup an IRC client. See you there!
Instruction Videos#
- Basic eduVPN/Let’s Connect! Server Installation
- Integrate your Active Directory via LDAP with eduVPN/Let’s Connect!
Supported Operating Systems#
- CentOS & Red Hat Enterprise Linux 7 (
x86_64) - Fedora >= 37 (
x86_64) - Debian >= 10 (
x86_64)
Current Recommendation: install your VPN server on Debian 12.
We do NOT and will not support Red Hat Enterprise Linux 8. We were waiting for this to be resolved. We avoid using third party PHP repositories to prevent having to support these repositories in the future.
NOTE: we expect ALL software updates to be installed and the server rebooted before you install the software!
NOTE: if you want to deploy on multiple machines for load balancing, please follow these instructions!
Development#
If you want to set up your own server development environment see DEVELOPMENT_SETUP.
License#
This work (this documentation repository) is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
See LICENSE.
The VPN server software is licensed under the AGPLv3+.
Security Contact#
If you find a security problem in the code, the deployed service(s) and want to
report it responsibly, contact fkooman@tuxed.net.
You can use PGP. My key is 0x9C5EDD645A571EB2. The full fingerprint is
6237 BAF1 418A 907D AA98 EAA7 9C5E DD64 5A57 1EB2.