VPN & Tunneling Protocols

# Ubuntu/Debian
sudo apt-get install openvpn openvpn-easy-rsa
 
# Generate certificates (Public Key Infrastructure)
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
./easyrsa init-pki
./easyrsa build-ca
./easyrsa gen-req server nopass
./easyrsa sign-req server server

sudo openvpn --config client.ovpn

# Ubuntu/Debian
sudo apt-get install wireguard wireguard-tools
 
# Generate keys
wg genkey | tee private.key | wg pubkey > public.key

sudo ip link add dev wg0 type wireguard
sudo ip addr add 10.0.0.1/24 dev wg0
sudo ip link set wg0 up
 
sudo wg set wg0 listen-port 51820 private-key <(wg genkey)
 
# Or use wg-quick
sudo wg-quick up wg0

sudo apt-get install strongswan strongswan-swanctl
 
# Generate keys
ipsec pki --gen --type rsa --size 4096 --outform pem > private.pem

# Forward local port 8080 to remote server's MySQL
ssh -L 8080:database.example.com:3306 [email protected]
 
# Now: localhost:8080 → database.example.com:3306 (encrypted)
mysql -h localhost -P 8080

# Forward remote port 9000 to local service
ssh -R 9000:localhost:8080 [email protected]
 
# Now: server.example.com:9000 → localhost:8080

# Create SOCKS proxy
ssh -D 1080 [email protected]
 
# Configure app to use SOCKS proxy on localhost:1080
# All traffic goes through SSH tunnel

[Unit]
Description=SSH Tunnel to Database
After=network.target
 
[Service]
Type=simple
User=app
ExecStart=/usr/bin/ssh -N -L 5432:db.internal:5432 [email protected]
Restart=always
RestartSec=10
 
[Install]
WantedBy=multi-user.target

# Access pods from local machine
kubectl port-forward pod/my-pod 8080:8080
 
# Access service
kubectl port-forward svc/my-service 3306:3306
 
# Now any tool can connect:
mysql -h localhost -P 3306

apiVersion: v1
kind: ConfigMap
metadata:
  name: wireguard-config
data:
  wg0.conf: |
    [Interface]
    Address = 10.100.0.1/24
    ListenPort = 51820
    PrivateKey = {key}
    
    [Peer]
    PublicKey = <other-datacenter-key>
    Endpoint = 198.51.100.1:51820
    AllowedIPs = 10.200.0.0/24

1. Check VPN server running
   sudo systemctl status openvpn@server
 
2. Verify client certificate is valid
   openssl x509 -in client.crt -text -noout
 
3. Check firewall allows port
   sudo ufw status | grep 1194
   sudo iptables -L | grep 1194
 
4. Test connectivity
   telnet vpn.example.com 1194

1. Check routing table
   route -n
   
2. Verify gateway is set
   ip route show
   
3. Check NAT/masquerading
   sudo iptables -L -n -t nat | grep MASQUERADE
 
4. Enable IP forwarding on server
   echo "1" | sudo tee /proc/sys/net/ipv4/ip_forward
   
   # Make permanent
   echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
   sudo sysctl -p

1. Check packet loss
   ping -c 100 vpn.example.com | grep "% packet loss"
 
2. Measure throughput
   iperf3 -c vpn.example.com
 
3. Check encryption overhead
   Check CPU usage: top
 
4. Switch to faster protocol
   WireGuard faster than OpenVPN
   UDP better than TCP

1. Verify routing on VPN client
   route -n | grep -E "VPN|10\\."
 
2. Check firewall rules on destination network
   Can destination ping VPN server?
 
3. Verify split tunneling not blocking traffic
   Should route through VPN, not local
 
4. Test with traceroute
   traceroute destination-host

# Regenerate certificates every 1-2 years
/etc/openvpn/easy-rsa/easyrsa gen-req server nopass
/etc/openvpn/easy-rsa/easyrsa sign-req server server
 
# Restart OpenVPN
sudo systemctl restart openvpn@server

# OpenVPN: check connection logs
tail -f /var/log/openvpn/status.log
 
# WireGuard: show peers
sudo wg show
 
# Monitor bandwidth
nethogs

# If VPN drops, block internet
sudo iptables -A INPUT -i eth0 -j DROP
sudo iptables -A OUTPUT -o eth0 -j DROP
 
# Allow only VPN
sudo iptables -A INPUT -i tun0 -j ACCEPT
sudo iptables -A OUTPUT -o tun0 -j ACCEPT