From b937dd42113a54ab7a59ad8ab947191bb82c019a Mon Sep 17 00:00:00 2001 From: Lin Song Date: Sat, 6 Feb 2016 13:30:30 -0600 Subject: [PATCH] Update README.md --- README.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 940c43f..ba8c477 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ We will use Libreswan as th ## Features - Fully automated IPsec/L2TP VPN server setup, no user input needed -- Encapsulates all VPN traffic in UDP - does not need the ESP protocol +- Encapsulates all VPN traffic in UDP - does not need the ESP protocol - Can be directly used as "user-data" for a new Amazon EC2 instance - Automatically determines public IP and private IP of server - Includes basic IPTables rules and `sysctl.conf` settings @@ -18,7 +18,7 @@ We will use Libreswan as th ## Requirements -A newly created Amazon EC2 instance, using these AMIs: (See the link above for usage instructions) +A newly created Amazon EC2 instance, using these AMIs: (Follow the link above for instructions) - Ubuntu 14.04 (Trusty) or 12.04 (Precise) - Debian 8 (Jessie) EC2 Images - CentOS 7 (x86_64) with Updates HVM @@ -33,7 +33,7 @@ A dedicated server or any KVM- or Xen-based Virtual Private Server (VPS), with t - Debian 7 (Wheezy) - Not recommended. Requires this workaround to work. - CentOS / Red Hat Enterprise Linux (RHEL) 6 or 7 -OpenVZ VPS users should instead use Nyr's OpenVPN script. +OpenVZ VPS users should instead try Nyr's OpenVPN script. ##### » I want to run my own VPN but don't have a server for that @@ -74,16 +74,18 @@ Enjoy your very own VPN! :sparkles::tada::rocket::sparkles: ## Important Notes -To support multiple VPN users with different credentials, just edit a few lines in the scripts. - For **Windows users**, a one-time registry change is required if the VPN server and/or client is behind NAT (e.g. home router). -**Android 6 (Marshmallow) users**: Edit `/etc/ipsec.conf` and append `,aes256-sha2_256` to both `ike=` and `phase2alg=`. Also add a new line `sha2-truncbug=yes`. Must start lines with two spaces. Finally, run `service ipsec restart`. (Ref) +**Android 6 (Marshmallow) users**: After install, edit `/etc/ipsec.conf` and append `,aes256-sha2_256` to both `ike=` and `phase2alg=`. Also add a new line `sha2-truncbug=yes`. Start lines with two spaces. Finally, run `service ipsec restart`. **iPhone/iPad users**: In iOS settings, choose `L2TP` (instead of `IPSec`) for the VPN type. In case you're unable to connect, edit `ipsec.conf` and replace `rightprotoport=17/%any` with `rightprotoport=17/0`. Then restart `ipsec` service. +If you wish to enable multiple VPN users with different credentials, just edit a few lines in the scripts. + Clients are configured to use Google Public DNS when the VPN is active. To change, set `ms-dns` in `options.xl2tpd`. +If using Amazon EC2, open these ports in the server's security group: **UDP 500 & 4500**, and **TCP port 22** (optional, for SSH). + If you configured a custom SSH port or wish to allow other services, edit the IPTables rules in the scripts before using. The scripts will backup your existing config files before making changes, to the same folder with `.old-date-time` suffix. @@ -94,11 +96,11 @@ You may use `vpnupgrade_Libreswan.sh` (for Ubuntu/Debian) and `vpnupgrade_Libres ## Bugs & Questions -- Have a question? Please first read other people's comments in this Gist and on my blog. +- Have a question? Please first check other people's comments in this Gist and on my blog. - For Libreswan related questions, you may ask on the mailing list, or check out the official wiki. - If you found a reproducible bug, open a GitHub Issue to submit a bug report. -## Copyright and license +## Copyright and License Copyright (C) 2014-2016 Lin Song   View my profile on LinkedIn Based on the work of Thomas Sarlandie (Copyright 2012)