Skip to content

Instantly share code, notes, and snippets.

@MikeeI

MikeeI/_how-to.md

Forked from glennschler/_how-to_algovpn_1.md
Created November 8, 2021 16:13
Show Gist options
  • Save MikeeI/2f3d7708c7fdd7755e8fb9067bcfd46a to your computer and use it in GitHub Desktop.
Save MikeeI/2f3d7708c7fdd7755e8fb9067bcfd46a to your computer and use it in GitHub Desktop.
Download ZIP
Algo VPN configs and scripts
Raw
_how-to.md

  • First follow the Algo instructions to install requirements. Confirm the python virtual environment prompt is shown

  • Download the modified config.cfg. Edit as needed

curl -o config.cfg https://gist.githubusercontent.com/glennschler/8edcadb6ba5e151898774441dbffb739/raw/04ce253a5b2a304a77d12968966c3d1a1eb65898/config.cfg
  • Prepare the ansible-vault of aws_secrets
mkdir vars

# download the empty template
curl -o vars/aws_secrets_.yml https://gist.githubusercontent.com/glennschler/8edcadb6ba5e151898774441dbffb739/raw/dbc374ed9826cc9b6699cf502cf18e0761c41ca8/%257Caws_secrets.yml

# encrypt the plain text
ansible-vault encrypt --vault-id spot@prompt vars/aws_secrets_.yml

# edit the vault, to place the real aws secret values
ansible-vault edit --vault-id spot@prompt vars/aws_secrets_.yml
  • Use ansible-vault file to secure the aws secrets
./algo --vault-id @prompt -e @vars/aws_secrets_.yml
  • Use ansible-vault file to secure the aws secrets, plus pass variables
./algo --vault-id @prompt -e @vars/aws_secrets_.yml -e '{provider: ec2,
  ondemand_cellular: false,
  ondemand_wifi: false,
  dns_adblocking: false,
  ssh_tunneling: false,
  store_pki: false }' -e server_name=algo-$(date +%Y%b%d-%H%M)
Raw
_how-to_2.md
  • testing
sed -e '/phone/d' \
 -e '/laptop/d' \
 -e 's/- desktop/- ios-user-01 \
  - ios-user-02 \
  - ios-user-03 \
  - droid-user-01 \
  - droid-user-02 \
  - droid-user-03 \
  - mac-user-01 \
  - mac-user-02 \
  - mac-user-03 \
  - win-user-01 \
  - win-user-02 \
  - win-user-03 \
  - lin-user-01 \
  - lin-user-02 \
  - lin-user-03/' config.cfg
Raw
config.cfg
---
# This is the list of users to generate.
# Every device must have a unique user.
# You can add up to 65,534 new users over the lifetime of an AlgoVPN.
# User names with leading 0's or containing only numbers should be escaped in double quotes, e.g. "000dan" or "123".
# Email addresses are not allowed.
users:
- ios-user-01
- ios-user-02
- ios-user-03
- droid-user-01
- droid-user-02
- droid-user-03
- mac-user-01
- mac-user-02
- mac-user-03
- win-user-01
- win-user-02
- win-user-03
- lin-user-01
- lin-user-02
- lin-user-03
### Review these options BEFORE you run Algo, as they are very difficult/impossible to change after the server is deployed.
# Change default SSH port for the cloud roles only
# It doesn't apply if you deploy to your existing Ubuntu Server
ssh_port: 4160
# Deploy StrongSwan to enable IPsec support
ipsec_enabled: false
# Deploy WireGuard
# WireGuard will listen on 51820/UDP. You might need to change to another port
# if your network blocks this one. Be aware that 53/UDP (DNS) is blocked on some
# mobile data networks.
wireguard_enabled: true
wireguard_port: 51820
# This feature allows you to configure the Algo server to send outbound traffic
# through a different external IP address than the one you are establishing the VPN connection with.
# More info https://trailofbits.github.io/algo/cloud-alternative-ingress-ip.html
# Available for the following cloud providers:
# - DigitalOcean
alternative_ingress_ip: false
# Reduce the MTU of the VPN tunnel
# Some cloud and internet providers use a smaller MTU (Maximum Transmission
# Unit) than the normal value of 1500 and if you don't reduce the MTU of your
# VPN tunnel some network connections will hang. Algo will attempt to set this
# automatically based on your server, but if connections hang you might need to
# adjust this yourself.
# See: https://github.com/trailofbits/algo/blob/master/docs/troubleshooting.md#various-websites-appear-to-be-offline-through-the-vpn
reduce_mtu: 0
# Algo will use the following lists to block ads. You can add new block lists
# after deployment by modifying the line starting "BLOCKLIST_URLS=" at:
# /usr/local/sbin/adblock.sh
# If you load very large blocklists, you may also have to modify resource limits:
# /etc/systemd/system/dnsmasq.service.d/100-CustomLimitations.conf
adblock_lists:
- "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
# Enable DNS encryption.
# If 'false', 'dns_servers' should be specified below.
# DNS encryption can not be disabled if DNS adblocking is enabled
dns_encryption: true
# Block traffic between connected clients. Change this to false to enable
# connected clients to reach each other, as well as other computers on the
# same LAN as your Algo server (i.e. the "road warrior" setup). In this
# case, you may also want to enable SMB/CIFS and NETBIOS traffic below.
BetweenClients_DROP: true
# Block SMB/CIFS traffic
block_smb: true
# Block NETBIOS traffic
block_netbios: true
# Your Algo server will automatically install security updates. Some updates
# require a reboot to take effect but your Algo server will not reboot itself
# automatically unless you change 'enabled' below from 'false' to 'true', in
# which case a reboot will take place if necessary at the time specified (as
# HH:MM) in the time zone of your Algo server. The default time zone is UTC.
unattended_reboot:
enabled: false
time: 06:00
### Advanced users only below this line ###
# DNS servers which will be used if 'dns_encryption' is 'true'. Multiple
# providers may be specified, but avoid mixing providers that filter results
# (like Cisco) with those that don't (like Cloudflare) or you could get
# inconsistent results. The list of available public providers can be found
# here:
# https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v2/public-resolvers.md
dnscrypt_servers:
ipv4:
# - cloudflare
- google
ipv6:
- google-ipv6
# - cloudflare-ipv6
# DNS servers which will be used if 'dns_encryption' is 'false'.
# Fallback resolvers for systemd-resolved
# The default is to use Cloudflare.
dns_servers:
ipv4:
- 1.1.1.1
- 1.0.0.1
ipv6:
- 2606:4700:4700::1111
- 2606:4700:4700::1001
# Store the PKI in a ram disk. Enabled only if store_pki (retain the PKI) is set to false
# Supports on MacOS and Linux only (including Windows Subsystem for Linux)
pki_in_tmpfs: true
# Set this to 'true' when running './algo update-users' if you want ALL users to get new certs, not just new users.
keys_clean_all: false
# StrongSwan log level
# https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration
strongswan_log_level: 2
# rightsourceip for ipsec
# ipv4
strongswan_network: 10.48.0.0/16
# ipv6
strongswan_network_ipv6: '2001:db8:4160::/48'
# If you're behind NAT or a firewall and you want to receive incoming connections long after network traffic has gone silent.
# This option will keep the "connection" open in the eyes of NAT.
# See: https://www.wireguard.com/quickstart/#nat-and-firewall-traversal-persistence
wireguard_PersistentKeepalive: 0
# WireGuard network configuration
wireguard_network_ipv4: 10.49.0.0/16
wireguard_network_ipv6: 2001:db8:a160::/48
# Randomly generated IP address for the local dns resolver
local_service_ip: "{{ '172.16.0.1' | ipmath(1048573 | random(seed=algo_server_name + ansible_fqdn)) }}"
local_service_ipv6: "{{ 'fd00::1' | ipmath(1048573 | random(seed=algo_server_name + ansible_fqdn)) }}"
# Hide sensitive data
no_log: true
congrats:
common: |
"# Congratulations! #"
"# Your Algo server is running. #"
"# Config files and certificates are in the ./configs/ directory. #"
"# Go to https://whoer.net/ after connecting #"
"# and ensure that all your traffic passes through the VPN. #"
"# Local DNS resolver {{ local_service_ip }}{{ ', ' + local_service_ipv6 if ipv6_support else '' }} #"
p12_pass: |
"# The p12 and SSH keys password for new users is {{ p12_export_password }} #"
ca_key_pass: |
"# The CA key password is {{ CA_password|default(omit) }} #"
ssh_access: |
"# Shell access: ssh -F configs/{{ ansible_ssh_host|default(omit) }}/ssh_config {{ algo_server_name }} #"
SSH_keys:
comment: algo@ssh
private: configs/algo.pem
private_tmp: /tmp/algo-ssh.pem
public: configs/algo.pem.pub
cloud_providers:
azure:
size: Standard_B1S
image:
publisher: Canonical
offer: 0001-com-ubuntu-server-focal-daily
sku: 20_04-daily-lts
version: latest
digitalocean:
size: s-1vcpu-1gb
image: "ubuntu-20-04-x64"
ec2:
# Change the encrypted flag to "false" to disable AWS volume encryption.
encrypted: true
# Set use_existing_eip to "true" if you want to use a pre-allocated Elastic IP
# Additional prompt will be raised to determine which IP to use
use_existing_eip: false
size: t4g.micro
image:
name: "ubuntu-focal-20.04"
arch: arm64
owner: "099720109477"
# Change instance_market_type from "on-demand" to "spot" to launch a spot
# instance. See deploy-from-ansible.md for spot's additional IAM permission
# See https://aws.amazon.com/blogs/compute/new-amazon-ec2-spot-pricing/
instance_market_type: on-demand
gce:
size: e2-micro
image: ubuntu-2004-lts
external_static_ip: false
lightsail:
size: nano_2_0
image: ubuntu_20_04
scaleway:
size: DEV1-S
image: Ubuntu 20.04 Focal Fossa
arch: x86_64
hetzner:
server_type: cx11
image: ubuntu-20.04
openstack:
flavor_ram: ">=512"
image: Ubuntu-18.04
cloudstack:
size: Micro
image: Linux Ubuntu 20.04 LTS 64-bit
disk: 10
vultr:
os: Ubuntu 20.04 x64
size: 1024 MB RAM,25 GB SSD,1.00 TB BW
linode:
type: g6-nanode-1
image: linode/ubuntu20.04
local:
fail_hint:
- Sorry, but something went wrong!
- Please check the troubleshooting guide.
- https://trailofbits.github.io/algo/troubleshooting.html
booleans_map:
Y: true
y: true
Raw
|aws_secrets.yml
aws_access_key:
aws_secret_key:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment