How do you deploy and configure a VPN server on AWS or self-hosted infrastructure?

VPN server deployment requires selecting appropriate platforms and configurations based on use cases. Here's a detailed guide for mainstream deployment solutions:

Cloud Platform Deployment

1. AWS (Amazon Web Services)

Deployment Steps:

1. Create EC2 instance (recommend t3.medium or higher)
2. Select security group, open UDP 1194 (OpenVPN) or 51820 (WireGuard)
3. Allocate Elastic IP
4. Install VPN software

OpenVPN Installation Example:

bash
# Update system
sudo apt update && sudo apt upgrade -y

# Install OpenVPN
sudo apt install openvpn easy-rsa -y

# Generate certificates and keys
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
source vars
./clean-all
./build-ca
./build-key-server server
./build-dh
openvpn --genkey --secret keys/ta.key

# Configure server
sudo cp keys/ca.crt keys/server.crt keys/server.key keys/ta.key keys/dh2048.pem /etc/openvpn/

WireGuard Installation Example:

bash
# Add WireGuard repository
sudo apt install wireguard -y

# Generate key pair
wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey | sudo tee /etc/wireguard/publickey

# Configure interface
sudo nano /etc/wireguard/wg0.conf

2. Google Cloud Platform (GCP)

Deployment Steps:

1. Create Compute Engine instance
2. Configure firewall rules (VPC Firewall)
3. Set up static external IP
4. Install and configure VPN

Firewall Configuration:

bash
gcloud compute firewall-rules create allow-vpn \
    --allow udp:1194,tcp:1194,udp:51820 \
    --source-ranges 0.0.0.0/0 \
    --description "Allow VPN traffic"

3. Azure

Deployment Steps:

1. Create virtual machine
2. Configure Network Security Group (NSG)
3. Set up public IP
4. Deploy VPN gateway or manual installation

Self-Hosted Server Deployment

1. Hardware Requirements

Minimum Configuration:

• CPU: Dual-core 2.0GHz+
• RAM: 2GB
• Bandwidth: 100Mbps+
• Storage: 20GB SSD

Recommended Configuration:

• CPU: Quad-core 3.0GHz+ (with AES-NI support)
• RAM: 4GB+
• Bandwidth: 1Gbps+
• Storage: 50GB NVMe SSD

2. Operating System Selection

Linux Distributions:

• Ubuntu Server: Good community support, rich documentation
• Debian: Stable, suitable for production
• CentOS/Rocky Linux: Enterprise support
• Alpine Linux: Lightweight, minimal resource usage

3. Network Configuration

Port Forwarding (Router):

shell
OpenVPN: UDP 1194 → Server internal IP
WireGuard: UDP 51820 → Server internal IP

Firewall Configuration (UFW):

bash
sudo ufw allow 1194/udp
sudo ufw allow 51820/udp
sudo ufw enable

Docker Deployment

1. OpenVPN Docker

Using kylemanna/openvpn:

bash
# Pull image
docker pull kylemanna/openvpn

# Create config directory
mkdir -p ~/openvpn-data
cd ~/openvpn-data

# Initialize configuration
docker run -v $PWD:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig -u udp://VPN.SERVER.COM

# Generate certificates
docker run -v $PWD:/etc/openvpn --rm -it kylemanna/openvpn ovpn_initpki

# Start server
docker run -v $PWD:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn

2. WireGuard Docker

Using linuxserver/wireguard:

bash
docker run -d \
  --name=wireguard \
  --cap-add=NET_ADMIN \
  --cap-add=SYS_MODULE \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=Asia/Shanghai \
  -e SERVERURL=your-domain.com \
  -e SERVERPORT=51820 \
  -e PEERS=1,2,3 \
  -e PEERDNS=auto \
  -v /path/to/config:/config \
  -p 51820:51820/udp \
  linuxserver/wireguard

Performance Optimization

1. Kernel Parameter Tuning

bash
# Edit sysctl.conf
sudo nano /etc/sysctl.conf

# Add following configuration
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_congestion_control = bbr

# Apply configuration
sudo sysctl -p

2. MTU Optimization

bash
# Test optimal MTU
ping -c 4 -M do -s 1472 8.8.8.8

# Set MTU in VPN configuration
# OpenVPN: mtu 1400
# WireGuard: MTU = 1420

3. Encryption Optimization

bash
# Use AES-NI hardware acceleration
# OpenVPN configuration
cipher AES-256-GCM
auth SHA256
ncp-ciphers AES-256-GCM:AES-128-GCM

# WireGuard uses ChaCha20-Poly1305 by default

Security Hardening

1. Certificate Management

bash
# Set certificate validity
export CA_EXPIRE=3650
export KEY_EXPIRE=3650

# Regular certificate rotation
# Update every 90-180 days

2. Access Control

bash
# Restrict management access
sudo ufw allow from YOUR_IP to any port 22
sudo ufw deny 22

# Use key authentication
# Disable password login

3. Log Monitoring

bash
# Configure log rotation
sudo nano /etc/logrotate.d/openvpn

Monitoring and Maintenance

1. Performance Monitoring

bash
# Monitor connection count
netstat -an | grep :1194 | wc -l

# Monitor bandwidth
iftop -i eth0

# Monitor CPU
htop

2. Automation Scripts

bash
# Backup configuration
#!/bin/bash
DATE=$(date +%Y%m%d)
tar -czf /backup/vpn-$DATE.tar.gz /etc/openvpn

Troubleshooting

Common Issues

1. Connection Failed: Check firewall and ports
2. Slow Speed: Optimize MTU and encryption settings
3. DNS Issues: Configure correct DNS servers
4. Certificate Errors: Check certificate validity and matching

Debug Commands

bash
# OpenVPN logs
sudo tail -f /var/log/openvpn.log

# WireGuard status
sudo wg show

# Network diagnostics
traceroute vpn-server-ip
tcpdump -i eth0 port 1194

Best Practices

1. Regular Backups: Configuration files and certificates
2. Update Software: Keep system and VPN software up to date
3. Monitor Performance: Set up alerting mechanisms
4. Documentation: Record configurations and changes
5. Test Recovery: Regularly test disaster recovery
6. Security Audits: Regular security assessments