Deploying on Enterprise Linux#

For simple one server deployments and tests, we have a deploy script available you can run on a fresh EL installation. It will configure all components and will be ready for use after running!

Requirements#

Clean EL installation with all updates installed and rebooted after updates;
SELinux MUST be enabled;
You SHOULD use static IPv4 and IPv6 address configured on your external interface;
Network equipment/VM platform allows access to the very least tcp/80, tcp/443 and udp/51820 for basic functionality, the deploy script will take care of the host firewall;
Working DNS entry for your VPN server, e.g. vpn.example.org.
Have the correct hostname configured on your system. Use hostnamectl set-hostname vpn.example.org (as root) to set your hostname. If you need to change the hostname, reboot after to make sure it “sticks”.

If you have a more complicated setup, we recommend to manually walk through the deploy script and follow the steps.

NOTE: we only test with relatively clean and unmodified installations of Enterprise Linux. If you, or your organization (heavily) modified the OS installation the VPN deployment MAY not work…

Base Deploy#

NOTE: make sure you have tar installed, the EL “minimal” image does not have tar:

$ sudo dnf -y install tar

Perform these steps on the host where you want to deploy:

$ curl -L -O https://codeberg.org/eduVPN/deploy/archive/v4.tar.gz
$ tar -xzf v4.tar.gz
$ cd deploy

Run the script (as root):

$ sudo -s
# ./deploy_el.sh

NOTE: if the script does NOT suggest the actual hostname you want to use on your system, make sure you configure your hostname first, see above.

NOTE: you can NOT use localhost as a hostname, nor an IP address!

NOTE: by default there is NO firewall for the traffic between VPN client and VPN server. So if you have SSH running on your server, the clients will be able to connect to it when you don’t take additional steps! Look here.

TLS Certificate#

See TLS on how to configure a TLS certificate for your server.