Elaborated step by step guide to setup OpenVPN on Azure via student discount

azure-openvpn-setup.md

Setup OpenVPN Server on Azure

• Get Microsoft Azure
• Create an EC2 instance
• SSH into the remote server
  • Windows
  • Linux & MacOS
• Setup OpenVPN Access Server
  • Gaming Configuration
• Download ovpn files
  • Windows
  • Linux & MacOS
• Connecting to the VPN on client devices
• Budget Control
• Authors

---

Step 1: Get Microsoft Azure

• Avail the Github Student Developer Pack.
• Now navigate to the benefits page and apply a filter for cloud or just click here. Follow the steps to sign up for Azure, and you will receive $100 credits.

Note Although, we could have done it directly using Institute ID on Microsoft Azure. But the afore-mentioned method exposes you to various other possibilities which you might have not even thought of. We chose Microsoft Azure here, if you want you can also choose DigitalOcean or any other cloud platform of your preference.

Step 2: Create an EC2 instance

• Goto Azure portal

• Click on the hamburger menu > Create a resource > Compute > Ubuntu Server 22.04 LTS. Fill in the necessary details in the Basics section.
  

  • Create a new Resource Group & give your virtual machine a name.
    

  • Now about region & disk size.
    First select the cheapest size and then select the region from the available options. A standard B1s size is going to be good enough and will last around 11 months using free credits. Now choose the closest region where the said size is available, which in our case will be South-East Asia. A bigger (aka more costly) size would probably be available in Indian regions.
    
    
    
    

  • Now choose an Authentication method according to your preference.

    • Using ssh keys is more secure but hard to follow.

      Using SSH keys

      • Select SSH public key as the Authentication Method and fill in the required fields.
        

      • Choose HTTPS(443) in Select inbound ports.
        

      • Leave the rest of the settings as default in other sections and click Review+Create.

      • Now you will be prompted to Generate a new key pair, select Download private key and create Resource. This step will download a .pem file onto your local machine.
        
        

    • Using password is easy to follow but less secure.

      Using password

      • Select Password as the Authentication Method and fill in the required fields.
        

      • Choose HTTPS(443) in Select inbound ports.
        

      • Leave the rest of the settings as default in other sections and click Review+Create.

• Now, wait for the VM to be deployed. Once the VM is deployed

  • Click Goto Resource.
    

  • Click Configure for the DNS option under Networking.
    

  • Type in any DNS name like your username in the DNS name label field and press Save.
    

Step 3: SSH into the Remote Server

Warning

For this step you will need to switch to a network other than that of campus as PORT 22(default port for SSH) IS BLOCKED ON CAMPUS NETWORK.

SSH steps are drastically different for a Windows client & a Linux/MacOS (*nix) client.
Click on the following links to read about the steps for the client of your interest:

• Windows
• Linux & MacOS

SSHing via a Windows machine

• To make sure your PC has SSH client and server both installed, run the following command on Command Prompt as Administrator.

  Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
  Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

  • Windows also has Powershell and the new Windows Terminal which combines all the different shell environments. So, you can choose one from these as well, but it doesn't matter in this context.

• Now ssh into the remote server

  Using SSH keys

  ssh -i C:\path\to\privatekey user@host_address

  C:\path\to\privatekey¹ • user² • host_address³

  Using Password

  ssh user@host_address

  user² • host_address³

SSHing via a Linux or MacOS machine

• You can ssh via the following methods

  Using SSH keys

  ssh -i path/to/privatekey user@host_address

  path/to/privatekey¹ • user² • host_address³

  Note

  The afore-mentioned method has a long command to type in, the recommended method will not be an alias but utilize something which SSH itself provides us.
  We can add the config details to the ssh config file (~/.ssh/config). The format is given below, replace the content inside <_> with your values and save it into the config file.
  Then you can ssh directly by using ssh MyAzure.

   Host <MyAzure>
      HostName <Host Address>
      User <Username>
      IdentityFile </path/to/privatekey>
      IdentitiesOnly yes

  Note make sure you have set the correct permissions on the private key or else you will get an error during ssh. You can fix this by changing the permissions using the following command:

  chmod 400 path/to/privatekey

  path/to/privatekey¹

  Using Password

  ssh user@host_address

  user² • host_address³

Step 4: Setup OpenVPN Access Server

After we have ssh'ed into the machine, we have to set up the OpenVPN Access Server.

• Before that, it's a good practice to update and upgrade your system via

  sudo apt update
  sudo apt upgrade

• Execute the following command

  wget https://git.io/vpn -O openvpn-install.sh && sudo bash openvpn-install.sh

  It will download and execute a script that automates OpenVPN server configuration.
• Keep in mind to update the following options during the setup process & leave the rest in their default state:
  • IP address: Your Public IP for the azure machine.
  • UDP or TCP: Enter 2 for TCP as UDP ports are blocked on campus network.
  • PORT: 443
  • DNS RESOLVER: Enter 4 for OpenDNS.
  • CLIENT: One configuration for one client/device. Name it like pc, mobile, etc.
• The .ovpn file will be stored inside /root directory, copy it into your user's home directory using the following command

  sudo cp /root/client_name.ovpn ~/

  client_name⁴

Note Run the same script to generate new clients (you will need a unique client for each device that’s going to be connected to the VPN), i.e., one .ovpn file one connection.

Configuration for Gaming

Use the TCP_NODELAY option if you are planning to use this VPN for gaming. Execute the following command on the remote VPN server

sudo echo "tcp-nodelay" | sudo tee -a /etc/openvpn/server.conf

Now restart the OpenVPN service using

sudo systemctl restart openvpn.service && sudo systemctl restart [email protected]

Step 5: Download ovpn files

Now we have to transfer the .ovpn files generated on the remote server to our local machine. The steps to achieve this are different for *nix (Linux or MacOS) & Windows, refer to the following links to read about the steps for your platform of interest:

• Windows
• Linux & MacOS

Windows

• Download WinSCP a GUI implementation for scp (secure copy) on windows. Open it.

• Click on New Session
  

• Now refer to the procedure mentioned below based on your authentication method.

  Using SSH keys

  • Download PuTTY for converting the .pem file to .ppk via PuTTYgen. Open it.

    • From the Start menu, choose All Programs > PuTTY > PuTTYgen.

    • Choose Load.
      

    • By default, PuTTYgen displays only files with the extension .ppk. To locate your .pem file, choose the option to display files of all types.
      

    • Select your .pem file for the key pair that you specified when you launched your instance and choose Open. PuTTYgen displays a notice that the .pem file was successfully imported. Choose OK.
      
      

    • To save the key in the format that PuTTY can use, choose Save private key.
      

    • PuTTYgen displays a warning about saving the key without a passphrase. Choose Yes.
      

  • Now head back to the WinSCP window & enter the following login configuration

    • File Protocol: SCP.
    • Host Name: Your remote machine's Public IP address.
    • Port: 22 (Default).
    • Username: username which you set for the remote machine.
      

  • Navigate to Advanced > Authentication

  • Browse and select your .ppk file.
    

  • Press OK then Login & finally YES.

  Using Password

  • Enter the following login configuration

    • File Protocol: SCP.
    • Host Name: Your remote machine's Public IP address.
    • Port: 22 (Default).
    • Username: Username which you set for the remote machine.
    • Password: Password which you set for the remote machine
      

  • Press Login then YES.

• Select and download all the .ovpn files you created which will be shown on the interface.
  

• Now shut down the WinSCP session

Linux & MacOS

Using SSH keys

Run the following command, the key will be downloaded in the Downloads directory.

scp -i path/to/privatekey user@host_address:client_name.ovpn ~/Downloads/

path/to/privatekey¹ • user² • host_address³ • client_name⁴

You can skip the -i (identity file) parameter if you have added the ssh config earlier.

Using Password

Run the following command, the key will be downloaded in the Downloads directory after you enter the correct password set by you earlier.

scp user@host_address:client_name.ovpn ~/Downloads/

user² • host_address³ • client_name⁴

To start/stop/check status of the OpenVPN server using systemctl:

sudo systemctl start/stop/status [email protected]

Android: Follow either of the aforementioned methods and then transfer the downloaded .ovpn file to your Android device via Telegram/Bluetooth/Mail or whatever to your android device.

Step 6: Connecting to the VPN on client devices

• Android: Download Open VPN Connect app from Play Store. Open the app and after going through the first screen, go to Files tab, there import the .ovpn file, and connect.

• Linux: In most of the distros, you can go to the network manager and import the .ovpn file. If not then install OpenVPN with sudo apt install openvpn and connect using sudo openvpn --config /path/to/config.ovpn.

• MacOS: You can either download the GUI tool tunnelblick for importing the .ovpn file or download the CLI tool for openvpn via MacPorts or HomeBrew using sudo ports install openvpn and brew install openvpn respectively; then execute sudo openvpn --config /path/to/config.ovpn.

• Windows: Download the official OpenVPN Connect client for Windows, import the .ovpn file, and toggle it ON to finally connect - video guide.

Step 7: Budget Control

Warning This is a very important step, to ensure the long-term usability of your credits

• Use only one instance.
• Bandwidth is free up to $100 credits, so it's better not to waste resources on the VPN.

Note If in any case, you have to stop an instance forcibly, do it; to be on the safer side.

---

Authors

• Arpit Bhardwaj (@proffapt)

Created with lots of </> and ♥

Footnotes

1. It is the path to the .pem file which you downloaded just before deploying the VM. ↩ ↩² ↩³ ↩⁴

2. Name of the user given while creating the virtual machine. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

3. Public IP address of the machine. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

4. Name of the client you specified in the script. ↩ ↩² ↩³

Nice work mate, can you also add networking inbound port rules?

Hey there, the command sudo systemctl restart [email protected] in step 4 fails because the filename in the /etc/systemd/system/multi-user.target.wants directory is changed to [email protected].

So this should be changed to sudo systemctl restart [email protected]. Thanks for the tutorial

Will this work decently to access blocked content in China?

Will this work decently to access blocked content in China?
@CxdeBits

Yes, the method is independent of country and restriction level - if the server is reachable and the Chinese restrictions doesn't apply on that server - then this will work.

Hey there, the command sudo systemctl restart [email protected] in step 4 fails because the filename in the /etc/systemd/system/multi-user.target.wants directory is changed to [email protected].

So this should be changed to sudo systemctl restart [email protected]. Thanks for the tutorial

Hi @nespar7,

I have updated the gist, thanks for the info!

Nice work mate, can you also add networking inbound port rules?

Hi @lukeymyuan,

As far as I remember the default configuration works just fine, please correct me if things have changed.

Also the article is also available and updated at: https://proffapt.hashnode.dev/openvpn-server-on-azure

@proffapt I followed all steps exactly as described, however when connecting through Android OpenVPN connect app I get back:
Server poll timeout, trying next remote entry... Any tips? Only difference is that I selected UDP except for TCP. Is this really the issue?

@proffapt I followed all steps exactly as described, however when connecting through Android OpenVPN connect app I get back: Server poll timeout, trying next remote entry... Any tips? Only difference is that I selected UDP except for TCP. Is this really the issue?

I have figured it out, that is because the firewall blocks the inbound requests. Here is the solution:

On the Azure Virtual Machine page, go to "Network settings" under "Networking", you'll see the panel called "Network Security Group" which is for configuring the firewall. I assume you've set port 443 and protocol UDP for the VPN, so click the Inbound port rule which has port "443" and change to protocol from "TCP" to "UDP" and restart the server. If it doesn't work, then you should run the openVPN script again for selecting another available port number (like 1194), and don't forget register the new port number with its protocol type on the "Network Security Group" panel by clicking "Create port rule" then "Inbound port rule".

Hi, when im trying to ssh into the vm with password, it says port 22 connection timed out. I tried it while on mobile network ....any solutions?

@emonb247 you probably haven't whitelisted your ip-adress in the firewall or allowed connections from that port.

Hi, when im trying to ssh into the vm with password, it says port 22 connection timed out. I tried it while on mobile network ....any solutions?

https://gist.github.com/proffapt/15cacf6c0abdd5509e5c1b7d2c7a49ce?permalink_comment_id=5042839#gistcomment-5042839

Hi @emonb247, this is the step which i missed to mention in the doc, will update it soon, this should be enough to fix the problem if there aren't any other reasons.

Excellent thanks for the brief doc, really helpful

Is there any limitations on bandwidth? Like 1GB per month or like 1GB for 1$ like that? I don't want my 100$ to exhausted within 12 months.