If you want to create a VPN server, let me tell you that there is an excellent option you can use to achieve your goal: the Firezone project is developing a VPN server to organize access to hosts on an internal network isolated from user devices located on external networks.
The project aims to achieve a high level of security and simplify the VPN implementation process.
About Firezone
The project is being developed by a Cisco security automation engineer , who sought to create a solution that automates working with host configuration and eliminates the problems they had to face when organizing secure access to VPCs in the cloud.
Firezone acts as an interface for both the WireGuard kernel module and the netfilter kernel subsystem. It creates a WireGuard interface (named wg-firezone by default) and a netfilter table, adding the appropriate routes to the routing table. Other programs that modify the Linux routing table or the netfilter firewall may interfere with Firezone's operation.
You can think of Firezone as an open source counterpart to OpenVPN Access Server, built on top of WireGuard instead of OpenVPN.
WireGuard is used to organize communication channels in Firezone . Firezone also has built-in firewall functionality that uses nftables.
In its current form, the firewall is limited by blocking outgoing traffic to specific hosts or subnets on internal or external networks. This is because Firezone is beta software, so for now, its use is only recommended by limiting network access to the web user interface to avoid exposing it to the public internet.
Firezone requires a valid SSL certificate and a matching DNS record to run in production, which can be generated and managed by the Let's Encrypt tool to generate a free SSL certificate.
On the administration side , it is mentioned that this is done through the web interface or in command-line mode using the firezone-ctl utility. The web interface is built on the Admin One Bulma platform.
Currently, all Firezone components run on the same server, but the project is initially being developed with an eye on modularity, and in the future, the ability to distribute components for the web interface, VPN, and firewall across different hosts is planned.
The plans also mention the integration of a DNS-based ad blocker, support for host and subnet block lists, the ability to authenticate via LDAP / SSO, and additional user management capabilities.
Of the mentioned features of Firezone:
- Fast: use WireGuard to be 3-4 times faster than OpenVPN.
- No dependencies: all dependencies are grouped thanks to Chef Omnibus.
- Simple: takes a few minutes to set up. Manage through a simple CLI API.
- Safe: works without privileges. HTTPS applied.
- Encrypted cookies.
- Firewall included - Uses Linux nftables to block unwanted outbound traffic.
For installation, rpm and deb packages are offered for different versions of CentOS, Fedora, Ubuntu, and Debian, whose installation does not require external dependencies, since all the necessary dependencies are already included using the Chef Omnibus toolkit.
To operate, it only requires a Linux distribution with a Linux kernel version 4.19 or earlier and a kernel module compiled with WireGuard VPN . According to the author, starting and configuring a VPN server can be done in just a few minutes. The web interface components run under an unprivileged user account, and access is only possible via HTTPS.
Firezone consists of a single distributable Linux package that you can install and manage. The project code is written in Elixir and Ruby, and is distributed under the Apache 2.0 license.
Finally, if you are interested in learning more about this or want to follow the installation instructions, you can do so from the following link.