This is a project I was using personally to get access to the Internet when I was living in Iran. Iran's infrastructure, is controlled by the government, utilizes different technologies to block access to the major internet services. One of the most advanced solutions (apart from complete Complete Shutdown) is known as DPI.
To my understanding, encrypting the outgoing traffic (or obfuscating it by any other means), and passing it through standard internet ports, reduce the chance of the service getting blocked (unless someone reports the server's IP address).
That's where this setup is coming from. Basically what it does is:
- Utilizes Stunnel to encrypt the traffic.
- Use port 993 (IMAP TLS) to pass the traffic.
- Use OpenVPN as the VPN solution.
To provide Stunnel access securely, it relies on another project I'm maintaining called Docker Stunnel.
First make sure:
- Using a Debian driven distro for the host server (preferably latest version of Ubuntu server).
- Make sure Docker and Docker Compose are installed on the server.
- Make sure UFW is enabled (to ensure the security of your server).
- Make sure port 993 is accessible through any other gateway configured for your server. This is the only port that needs to be open.
Then clone the project, and run:
make init # To initialize the configuration
make start # To start the serverThe server should be up and running in a few minutes.
You can use:
make new_userTo create a new user for the server. After user creation, you need to send two files to your users:
- stunnel.conf generated with make init command (located in the root directory of the project).
- USERNAME.ovpn generated by make new_user command (located in the clients directory).
Make sure openvpn and stunnel packages are installed on your system. Then:
sudo cp stunnel.conf /etc/stunnel/stunnel.conf
sudo systemctl restart stunnelAnd after that everytime you need to setup the VPN, you can just use openvpn CLI like:
sudo openvpn CLIENT.ovpn