Learn how to – Algo VPN – Setup a personal IPSEC VPN in the Cloud

Learn how to – Algo VPN – Setup a personal IPSEC VPN in the Cloud.

What is Algo VPN?

According to their Github Page, “Algo VPN is a set of Ansible scripts that simplify the setup of a personal IPSEC and Wireguard VPN. It uses the most secure defaults available, works with common cloud providers, and does not require client software on most devices.”.

Algo gives you an easy way to install and configure a secure VPN in promise or in Cloud for Personal use. Please note you don’t need a mastery of Linux or Ansible to set this up, the process is not burdensome.

“Rivers know this: there is no hurry. We shall get there some day.” 
― A.A. Milne,

Features of Algo VPN

Below is a list of Algo VPN features that you get out of the box.

• Supports only IKEv2 with strong crypto (AES-GCM, SHA2, and P-256) and WireGuard
• Generates Apple profiles to auto-configure iOS and macOS devices
• Includes a helper script to add and remove users
• Blocks ads with a local DNS resolver (optional)
• Sets up limited SSH users for tunneling traffic (optional)
• Based on current versions of Ubuntu and strongSwan
• Installs to DigitalOcean, Amazon Lightsail, Amazon EC2, Vultr, Microsoft Azure, Google Compute Engine, Scaleway, OpenStack, or internal server.

Setup Algo VPN on Ubuntu / Debian

For an Ubuntu and Debian based systems, install required dependencies by running the commands below.

# Update package list index
sudo apt update

# Python 3
sudo apt-get install -y git build-essential python3-dev python3-pip python3-setuptools python3-virtualenv libffi-dev libssl-dev 

# Python 2
sudo apt-get install -y git build-essential python-dev python-pip python-setuptools python-virtualenv libffi-dev libssl-dev 

Once the dependencies have been installed, clone the Algo VPN repository.

git clone https://github.com/trailofbits/algo.git

Install Algo Python dependencies

Change to algo directory and install Python dependencies such as ansible, jinja, PyYAML.

cd algo
python3 -m virtualenv --python=$(which python3) env
source env/bin/activate
python3 -m pip install -U pip virtualenv
python3 -m pip install -r requirements.txt

This will collect ansible, jinja, PyYAML and many others.

List Users to create

Open config.cfg in your favorite text editor. Specify the users you wish to create in the users list. I encountered an error when I added a user with the name of a user in the system. The user may be running a given process and the Algo script returns an error. So use unique usernames.

vim config.cfg

Add users like below:

users:
  - test
  - pench
  - admin

Disable resolved service (for dnsmasq to work)

Run the following commands to disable the resolved service:

sudo systemctl disable systemd-resolved
sudo systemctl stop systemd-resolved

Also, remove the symlink to resolv.conf file.

sudo unlink /etc/resolv.conf

Then create new resolv.conf file.

echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf

Start the deployment

While still on the algo directory, begin the deployment by running the algo script as shown below. This leads to a series of questions that you will answer according to your set-up. My settings were like below.

# ./algo

Select your Cloud Provider or existing server.

PLAY [Ask user for the input] 
 TASK [Gathering Facts] *
 ok: [localhost]
 [pause]
 What provider would you like to use?
    1. DigitalOcean
    2. Amazon Lightsail
    3. Amazon EC2
    4. Microsoft Azure
    5. Google Compute Engine
    6. Hetzner Cloud
    7. Vultr
    8. Scaleway
    9. OpenStack (DreamCompute optimised)
    10. CloudStack (Exoscale optimised)
    11. Linode
    12. Install to existing Ubuntu 18.04 or 20.04 server (for more advanced users)

Enter the number of your desired provider
: 12

Set if to allow macOS/iOS clients to enable “VPN On Demand” when connected to cellular networks/Wi-Fi.

TASK [pause] ***
 ok: [localhost]
 TASK [Set facts based on the input] **
 ok: [localhost]
 [pause]
 Do you want macOS/iOS clients to enable "VPN On Demand" when connected to cellular networks?
 [y/N]
 :
 y
Do you want macOS/iOS clients to enable "VPN On Demand" when connected to Wi-Fi?
 [y/N]
 :
 y

Set list of trusted Wi-Fi networks.

List the names of trusted Wi-Fi networks (if any) that macOS/iOS clients exclude from using the VPN
 (e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi)
 :
Netpap

Set other options as you see fit.

Do you want to install a DNS resolver on this VPN server, to block ads while surfing?
 [y/N]
 :
 y
 TASK [pause] ***
 ok: [localhost]
 [pause]
 Do you want each user to have their own account for SSH tunneling?
 [y/N]
 :
 y
 TASK [pause] ***
 ok: [localhost]
 [pause]
 Do you want the VPN to support Windows 10 or Linux Desktop clients? (enables compatible ciphers and key exchange, less secure)
 [y/N]
 :
 y
 TASK [pause] ***
 ok: [localhost]
 [pause]
 Do you want to retain the CA key? (required to add users in the future, but less secure)
 [y/N]
 :
 y

The ansible deployment should start.

 TASK [pause] **
 ok: [localhost]
 TASK [Set facts based on the input] *
 ok: [localhost]
 PLAY [Provision the server] *
 TASK [Gathering Facts] 
 ok: [localhost]
 --> Please include the following block of text when reporting issues:
Algo running on: Ubuntu 18.04.1 LTS (Virtualized: kvm)
 Created from git clone. Last commit: 40b42c4 Get started with Azure more easily (#1323)
 Python 2.7.15rc1
 Runtime variables:
     algo_provider "local"
     algo_ondemand_cellular "True"
     algo_ondemand_wifi "True"
     algo_ondemand_wifi_exclude "X251bGw="
     algo_local_dns "True"
     algo_ssh_tunneling "True"
     algo_windows "True"
     wireguard_enabled "True"
     dns_encryption "True"
 TASK [Display the invocation environment] *
 changed: [localhost -> localhost]
 TASK [Install the requirements] ***
 changed: [localhost -> localhost]
 TASK [Generate the SSH private key] *
 changed: [localhost]
 TASK [Generate the SSH public key] 
 changed: [localhost]
 [local : pause]
 Enter the IP address of your server: (or use localhost for local installation):
 [localhost]
 :
 localhost
 TASK [local : pause] 
 ok: [localhost]
 TASK [local : Set the facts] 
 ok: [localhost]
 TASK [local : Set the facts] 
 ok: [localhost]
 [local : pause]
 Enter the public IP address of your server: (IMPORTANT! This IP is used to verify the certificate)
 [localhost]
 :
 192.168.1.10 (Your Public IP Here)

When it is successfully done, you should see a banner like the one below

TASK [debug] ******************************************************************************************************************************************

ok: [localhost] => {

    "msg": [

        [

            ""#                          Congratulations!                            #""""