Deploying on Debian & Ubuntu#

For one server deployments, we have a deploy script available you can run on a fresh Debian or Ubuntu installation. It will configure all components and will be ready for use after running!

Requirements#

Clean Debian or Ubuntu installation, see Server OS Support for a list of supported OS versions;
Installation with all updates installed and rebooted after installing those updates;
Have a STATIC IPv4 and IPv6 address configured on your external interface;
Network equipment/VM platform allows access to the very least tcp/80, tcp/443 and udp/51820 for basic functionality, the deploy script will take care of the host firewall;
Working DNS entry for your VPN server, e.g. vpn.example.org.
Have the correct hostname configured on your system. Use hostnamectl set-hostname vpn.example.org (as root) to set your hostname. If you need to change the hostname, reboot after to make sure it “sticks”.

If you have a more complicated setup, we recommend to manually walk through the deploy script and follow the steps.

NOTE: we only test with relatively clean and unmodified installations of Debian/Ubuntu. If you, or your organization (heavily) modified the OS installation the VPN deployment MAY not work…

Base Deploy#

Perform these steps on the host where you want to deploy:

$ sudo apt -y install ca-certificates wget
$ wget https://codeberg.org/eduVPN/deploy/archive/v4.tar.gz
$ tar -xzf v4.tar.gz
$ cd deploy

We assume you have sudo installed and configured for your user first, after this:

$ sudo -s
# ./deploy_debian.sh

NOTE: if the script does NOT suggest the actual hostname you want to use on your system, make sure you configure your hostname first, see above.

NOTE: you can NOT use localhost as a hostname, nor an IP address!

NOTE: by default there is NO firewall for the traffic between VPN client and VPN server. So if you have SSH running on your server, the clients will be able to connect to it when you don’t take additional steps! Look here.

TLS Certificate#

See TLS on how to configure a TLS certificate for your server.