pkarpovich / vpn-exit-node

Tailscale Exit Node & OpenVPN Controller: Automate and manage your traffic exit node with Tailscale integration and easily toggle OpenVPN for enhanced privacy and security

VPN Exit Node

Automated traffic exit node on the base of tailscale with the ability to turn on and control VPN through OpenVPN.

Pre-requirements

If you want to forward traffic through a host machine, you need to apply the following iptables rules on the host machine:

# For default traffic
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE  
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

# For VPN traffic
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE  
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT

If you want to save these rules after reboot, you can use the following commands:

sudo netfilter-persistent save

If you want to clear all iptables rules, you can use the following commands:

sudo netfilter-persistent flush
sudo netfilter-persistent save

Example of usage

Docker Compose

services:
  vpn-exit-node:
    container_name: ${TAILSCALE_HOSTNAME}
    hostname: ${TAILSCALE_HOSTNAME}
    build:
      dockerfile: ./Dockerfile
    environment:
      - TAILSCALE_AUTH_KEY=${TAILSCALE_AUTH_KEY}
      - TAILSCALE_HOSTNAME=${TAILSCALE_HOSTNAME}
      - HTTP_PORT=${HTTP_PORT}
      - VPN_FILES_PATH=${VPN_FILES_PATH}
    restart: unless-stopped
    volumes:
      - "/dev/net/tun:/dev/net/tun"
      - "./vpn-files:/usr/app/vpn-files"
    ports:
      - ${HTTP_PORT}:${HTTP_PORT}
    privileged: true
    network_mode: "host"
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN

HTTP API

#Get all available VPN files:
curl -X GET http://localhost:8080/vpn/files

# Start OpenVPN client with the following file:
curl -X POST http://localhost:8080/vpn/start -d '{"vpnFile": "R4.ovpn"}'

# Stop OpenVPN client
curl -X POST http://localhost:8080/vpn/stop

Environment variables

• TAILSCALE_AUTH_KEY - tailscale auth key
• TAILSCALE_HOSTNAME - name of exit node
• HTTP_PORT - port for web interface for control VPN
• VPN_FILES_PATH - path to directory with VPN files inside container