5 months ago
#1
I have seen a number of people asking for this guide. My intention with it, is to be helpful for those who would like to use your home network at work or abroad. Meaning if you do bad things with it then that's on you.

Requirements:
 
  1. Old Desktop Computer: Ensure the device has reasonable processing power and at least 4GB of RAM.
  2. Operating System: Linux (Ubuntu Server is recommended for ease of use and support).
  3. Network Connection: Stable home internet with a router that supports port forwarding.
  4. VPN Software: OpenVPN for its strong encryption standards.
  5. Static IP Address or Dynamic DNS (DDNS): Required for consistent remote access.



Step-by-Step Instructions:

1. Prepare the Old Desktop

Install Ubuntu Server on the desktop. During installation, set up a strong root password.

Update the system using:
 
Code:
sudo apt update && sudo apt upgrade

2. Install OpenVPN

Install OpenVPN and Easy-RSA:
 
Code:
sudo apt install openvpn easy-rsa
 
Configure Easy-RSA for certificate management:



Code:
[code]
make-cadir ~/openvpn-caConfigure Easy-RSA for certificate management:
cd ~/openvpn-ca
[/code]


3. Set Up Public Key Infrastructure (PKI)

Initialize the PKI directory:


Code:
./easyrsa init-pki

Build the certificate authority (CA):


Code:
./easyrsa build-ca

Generate the server certificate and key:
 
Code:
./easyrsa gen-req server nopass
./easyrsa sign-req server server

Generate Diffie-Hellman parameters:
 
Code:
./easyrsa gen-dh


4. Configure OpenVPN

Copy the generated keys and certificates to /etc/openvpn.

Create a server configuration file:
 
Code:
sudo nano /etc/openvpn/server.conf

Example configuration:



Code:
[code]
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
[/code]


Enable IP forwarding:


Code:
sudo sysctl -w net.ipv4.ip_forward=1

5. Set Up Port Forwarding

Log in to your router's admin panel.

Forward port 1194 (or the port specified in server.conf) to the local IP address of your desktop.

6. Generate Client Configuration Files

Create client certificates:


Code:
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

7. Secure the VPN

Use the latest encryption algorithms (e.g., AES-256-GCM).

Regularly update the system to patch vulnerabilities:
 
Code:
sudo apt update && sudo apt upgrade


8. Pentest the VPN (Very Important)

Import the .ovpn file into a VPN client (e.g., OpenVPN Connect).

Connect and verify encryption and routing.

Pentesting Checklist for Your VPN

Network Scan:

Use tools like nmap to ensure only required ports are open.

Encryption Check:

Verify the VPN uses AES-256-GCM or equivalent encryption.

Packet Inspection:

Ensure no data leakage by monitoring packets with Wireshark.

Authentication:

Test multi-factor authentication if implemented.

Vulnerability Scanning:

Run tools like Nessus to identify potential weaknesses.

Performance Testing:

Measure latency and bandwidth impact when the VPN is active.

Simulate Attacks:

Perform brute-force, MITM (Man-in-the-Middle), and port-scanning tests.

If you have any questions on how to pentest your own network or your own vpn you can google or ask.