Setup Streisand VPN on Hetzner Cloud
Published: 2020-10-23 09:34:23

<!-- wp:paragraph -->
<p><a href="https://github.com/StreisandEffect/streisand">Streisand</a> is a open source VPN setup builder. We can use this every time we want and access to all sites and services. We setup this service to own cloud virtual machine which we get from Hetzner. You only pay 2.49 € / mon. This is very cheap.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Some Streisand services include add-ons for VPN</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li><a href="https://www.openssh.com/" target="_blank" rel="noreferrer noopener nofollow">OpenSSH</a></li><li><a href="https://ocserv.gitlab.io/www/index.html" target="_blank" rel="noreferrer noopener nofollow">OpenConnect</a>&nbsp;/&nbsp;<a href="https://www.cisco.com/c/en/us/products/security/anyconnect-secure-mobility-client/index.html" target="_blank" rel="noreferrer noopener nofollow">Cisco AnyConnect</a></li><li><a href="https://openvpn.net/index.php/open-source.html" target="_blank" rel="noreferrer noopener nofollow">OpenVPN</a></li><li><a href="https://shadowsocks.org/en/index.html" target="_blank" rel="noreferrer noopener nofollow">Shadowsocks</a></li><li>A private&nbsp;<a href="https://www.torproject.org/" target="_blank" rel="noreferrer noopener nofollow">Tor</a>&nbsp;bridge relay</li><li><a href="https://www.wireguard.com/" target="_blank" rel="noreferrer noopener nofollow">WireGuard</a>, a modern high-performance protocol.</li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Today We will setup OpenConnect . Then We use iOS application and terminal access on desktop(If you want you can download GUI to desktop from App Store).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Normally Streisand setup is very easy but If you only setup on providers on below.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>Amazon Web Services (AWS)</li><li>Microsoft Azure</li><li>Digital Ocean</li><li>Google Compute Engine (GCE)</li><li>Linode</li><li>Rackspace</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>But We will setup on the hetzner and We must follow the advanced installation instructions.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Streisand need a second server for using builder and setup VPN to second server which is your primary VPN server but today we will build directly local VPN to on our primary machine We won't use a second builder server.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":5} -->
<h5>Requirements</h5>
<!-- /wp:heading -->

<!-- wp:list {"ordered":true} -->
<ol><li>Verified the hetzner account </li><li>Knowledge of terminal level of beginner.</li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>I hope you have requirements because this article does not contain above things. Now If you are ready to start virtual machine on cloud let's start. 💻</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3>Up Hetzner Virtual Machine.</h3>
<!-- /wp:heading -->

<!-- wp:list {"ordered":true} -->
<ol><li>Go to <a href="https://console.hetzner.cloud/projects">cloud console</a> then If you have not any project create new project and type <code>project name</code> (ex: VPN Project).</li><li>Enter to this and click <code>Add Server</code> <ol><li>Select location what you want (I selected Helsinki because of it is sitting in Europe.)</li><li>Select Linux <strong>Ubuntu 16.04</strong> </li><li>Select Type is Standart and Machine <strong>CX11</strong> (You can select dedicated machine but it is expensive). This combination is the best choice. If too many people don't be use this VPN.</li><li>You can skip Volume,  Network, Additional features.</li><li>You should a ssh key to access to your virtual machine with on terminal. <ol><li>Basically you can run this command  <code>ssh-keygen -t ecdsa -b 521</code> </li></ol></li><li>You paste content of &lt;your ssh key&gt;.pem file and enter name.</li><li>Last step click <code>Create &amp; Buy Now</code> button.</li></ol></li></ol>
<!-- /wp:list -->

<!-- wp:heading {"level":3} -->
<h3>Setup Streisand On Your Virtual Machine.</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Connect your machine with ssh using <code>root</code> user. Then first things we update and upgrade linux packages.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>$ apt update</code></pre>
<!-- /wp:code -->

<!-- wp:code -->
<pre class="wp-block-code"><code>$ apt upgrade -y</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Now create id_rsa to be used by streisand. Run below command and press enter  to all questions.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>$ ssh-keygen -t rsa -b 4096</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Now We gonna clone source code from github.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>$ git clone https://github.com/StreisandEffect/streisand.git
$ cd streisand</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Install required additional packages. There is a util script in the streisand source code it checks all dependencies for ubuntu.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>$ ./util/ubuntu-dependencies.sh</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Now We will create python environment and activate that. Be sure you are in streisand directory.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>$ ./util/venv-dependencies.sh ./venv</code></pre>
<!-- /wp:code -->

<!-- wp:code -->
<pre class="wp-block-code"><code>$ source ./venv/bin/activate</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>! If you get error such this <span style="color:#cf2e2e" class="tadv-color">Failing command: ['/root/streisand/venv/bin/python3', '-Im', 'ensurepip', '--upgrade', '--default-pip']</span></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>You should copy and paste below three lines to server terminal and press enter.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>export LC_ALL="en_US.UTF-8"
export LC_CTYPE="en_US.UTF-8"
sudo dpkg-reconfigure locales</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>This is last step. We create a site.yml file for builder to get standart configs. Create a file in parent directory of your streisand folder. Create hidden folder named <code>.streisand</code> and then create file names <code>site.yml</code></p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>$ mkdir .streisand
$ vim site.yml</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Paste below block to site.yml</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>---
# Site specific Streisand configuration.
#
# This file is mutated by the playbooks/customize.yml tasks when a user chooses
# to customize which Streisand services are installed.

# The SSH private key that Ansible will use to connect to the Streisand node.
# The associated public key will be used if required when provisioning cloud
# nodes for the authorized_keys file.
streisand_ssh_private_key: "~/.ssh/id_rsa"

vpn_clients: 10

streisand_ad_blocking_enabled: no
streisand_openconnect_enabled: yes
streisand_openvpn_enabled: no
streisand_shadowsocks_enabled: yes
streisand_shadowsocks_v2ray_enabled: no
streisand_ssh_forward_enabled: yes
# By default sshuttle is disabled because it creates a `sshuttle` user that has
# full shell privileges on the Streisand host
streisand_sshuttle_enabled: no
streisand_stunnel_enabled: no
streisand_tinyproxy_enabled: no
streisand_tor_enabled: no
streisand_wireguard_enabled: no
streisand_cloudflared_enabled: no</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>This configuration allows only openconnect to be configured. Now run builder.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>$ ./streisand</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>This builder ask some questions to you. You should answer <code>no</code> to below question.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Press enter to customize your installation:</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>When Installation is ended builder generate to <strong><code>generated-docs</code></strong> folder in directory. You should install this folder to your computer(you could use secure copy...).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>You drag and drop html file to chrome browser You can see all instructions client configs for all devices (macos, ios, android,...)</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Congratulations now you own a VPN 🎉🎉</p>
<!-- /wp:paragraph -->