A VPN for twelve home workers
A small firm has twelve people working from home. Each needs a safe link to the office. The technician has an afternoon.
The job has two halves. First, build the server at the office. Then set up each client.
Key words
| Word | What it means |
|---|---|
| VPN server | the computer at the office that accepts VPN connections |
| VPN client | the device that connects to the VPN server |
| Interface | a connection a computer uses to talk to others, real or virtual |
| IP address | a number that identifies a device |
| DNS | the service that turns a name into a number address |
| FQDN | fully qualified domain name: a complete name such as vpn.college.test |
| Endpoint | the address and port a client connects to |
| Allowed IPs | the addresses a peer may send to, which acts as its permissions |
| Peer | one end of a VPN connection |
| Authentication | proving who you are, such as with a key |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can set up a simple VPN server and a client, and explain each setting.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Configuring the server
On the server, do three things.
Enable the VPN service. Install the tool and turn it on, so it listens for clients.
Configure the address and name of the VPN interface. The server gets an address inside the VPN's own range, such as 10.8.0.1. Give it a hostname in DNS so clients can find it by name.
Manage user access. Decide who may connect, using authentication and permissions.
Make keys for the server and one client
umask 077; wg genkey | tee server.key | wg pubkey > server.pub; wg genkey | tee client.key | wg pubkey > client.pub; ls *.key *.pubA command for the lesson’s lab terminal. It is shown here and not run.
Write the server file with one user
printf '[Interface]\nAddress = 10.8.0.1/24\nListenPort = 51820\nPrivateKey = %s\n\n[Peer]\nPublicKey = %s\nAllowedIPs = 10.8.0.2/32\n' "$(cat server.key)" "$(cat client.pub)" > wg0.conf && sed 's/PrivateKey = .*/PrivateKey = (hidden)/' wg0.confA command for the lesson’s lab terminal. It is shown here and not run.
Turn the VPN service on
sudo wg-quick up ./wg0.conf 2>&1 | tail -3A command for the lesson’s lab terminal. It is shown here and not run.