Plan to build our own self-hostable VPNAzure Services

[andrewfer000]

What I plan for testing

• VPS in the cloud with a dedicated IP address
• Server will use a Wildcard SSL certificate from Let's Encrypt. But it can be from any SSL provider if wanted.
• HAProxy, FastReverseProxy, or Traefic as reverse proxy server. Will use TCP Multiplexing to share port 443
• Either WireGuard VPN (Standalone) or SoftEther VPN Server to securely and reliably connect servers behind LAN to the reverse-proxy VPS.

What I need from the SoftEther VPN Developers:

• SE needs to support ProxyProtocol v2 in order to get the real IP from the reverse proxy server on HAProxy, traefik, or FRP.
• While I had no issues with SSTP or OpenVPN (TCP/443) behind HAProxy, SoftEther protocol had issues in my testing. Maybe implementing ProxyProtocol v2 will fix it by allowing SE to get the real IP. However I am not sure and will need to test again. Note this was tested when I did my RADIUS project for school and the RP and SoftEther were on the same server. I will need to re-build this setup to test again.
• Figure out a way for people to register their servers (maybe a simple web interface?) where they will enter some information (create an account?) and get a subdomain and access credentials (Either Login credentials or a WireGuard profile based on the VPN Server). If we end up using SoftEtherVPN on reverse proxy server, we can use the API to automatically create users when they register. Not sure if HAProxy has an API. We can use something like sed and cat to modify HAProxy if needed. traefik does have a REST API if that is the Reverse Proxy choice.

The Main Issues
They will need to import both the public and private key for the SSL certificate on SoftEther in order for this to work. This may be insecure if using a Wildcard. Maybe if there was an easy way to get separate certs for each subdomain and allow the user to download their certs to import it will work. Traefik has Let's Encrypt support built in. I will try to test that out.

This is no plug and play solution like the current DynamicDNS and VPNAzure is. While the server owner needs to do most of the hard work a user will still need to

1. Register with the service
2. Setup either WireGuard or SoftEther Client on their server to connect to the service
3. Download and Import the certificates manually to their SoftEtherVPN Service

There is a possibility the service can be abused if not setup properly such as people using the service as a Free VPN. This will be a major problem for people who may want to host public services. We will need to work with the firewall and tweak as needed.

Final Notes
This will be a good solution for replacing DynamicDNS and VPNAzure if we can work it right. It will also be much easier compared to starting from scratch and since we will be using standard software such as HAProxy and Let's Encrypt it will be easier to maintain compared to a huge new project. What we will need to do is work on making a simple registration fronted and work with the APIs available to us. Also creating easy to follow documentation for possible service hosts and clients of their service will be very important.

So what do you guys say? This sound like it can work? It's easier said than done but it's our best bet as of now!

P.S.
Why doesn't the SoftEther devs ever host an open conference? I would love to talk to you guys one day. I can setup a Jitsi Meet room on the Free Software Foundation's server if you'd like.

[andrewfer000]

If you need help visualizing what I'm talking about, here's pictures.

Single Server and Client. (Single User Scale or Private Service)

Multiple Servers and Clients. (Large Scale or Public Service)

[chipitsine]

proxy protocol v2 is fairly recent beast. it allows encoding ssl parameters, but not many server software support v2.
in theory we can try v1 and get much more server software (including aws balancers)

that's nitpicking, do not take it seriously :)

thanks for your efforts, we'll drive it as much as possible

[andrewfer000]

proxy protocol v2 is fairly recent beast. it allows encoding ssl parameters, but not many server software support v2.
in theory we can try v1 and get much more server software (including aws balancers)

I'm sure AWS balancers will get working soon. So far, all the proxy software I looked at (HAProxy, FRP, Traefik, and Envoy) seem to support v2.

[chipitsine]

I'm open to any online event (I live in YEKT timezone, except deep night, I'm awake)

[andrewfer000]

Getting the timezones to work will be a pain. What's your timezone in UTC?

Just found it. Your UTC +5 it looks like. That's 9 hours ahead of me. Not too bad. I think Davide is in Italy, so he is UTC +2, I think Domo is in Hong Kong based on his GitHub profile, his timezone would be UTC +8. These are just guesses, Idk where everyone is at all the time. Also I'm not sure where other board members are at.

[chipitsine]

I'm not sure about summer shift. either +4 or +5

[davidebeatrici]

I confirm my timezone is currently UTC+2.

[chipitsine]

what your are describing usually called "vpn fronting", i.e. reverse proxy using https (or tcp + proxy protocol). not sure we'll benefit from using term "vpn fronting", naming itself does not change things

[andrewfer000]

Lol ur awake. That's cool.

Also I didn't know that term existed xD. But I still think it's worth a shot. Honestly it's probably what VPNAzure does behind the scenes anyway so what's the difference?

[chipitsine]

it's matter of search engine optimization. if people will search for "vpn fronting" they'll find us

except SEO, it does not matter

[chipitsine]

as for haproxy api, there's https://github.com/haproxytech/dataplaneapi
it has limitations (e.g. full reload after config change), but still nice

[andrewfer000]

I think it may be best to try and work with Traefik mainly because it has a native API and it has the best Let's Encrypt support meaning every instance can have it's own SSL certificate which in turn increases privacy and security.

Here is documentation. Feel free to glance over it. I will be trying to get a VPS to this out asap. My goal is to get a proof of concept before we move forward. I need you (a SE Dev) to take a look and see what will be needed on the SoftEther side and make a todo list or something to keep track of what's needed.

[chipitsine]

PoC might be done without any change on SE side. Even in TCP mode, without proxy protocol it should be mostly usable

[andrewfer000]

What does PoC mean? I would like to look into it.

My end goal is to make this work with as little hassle as possible for both developers and users.

[chipitsine]

PoC = proof of concept.

quick and dirty implementation

like creating vm manually, installing and configuring traefic manually, check things manually

[andrewfer000]

Oh yea, That's what I intend.

[andrewfer000]

Documentation to keep track of for different Reverse Proxy products. At the end of the day, we only need to choose the one that works best.:
HAProxy
http://cbonte.github.io/haproxy-dconv/
https://kevinbentlage.nl/blog/lets-encrypt-with-haproxy/

Traefik
https://doc.traefik.io/traefik/

Envoy
https://www.envoyproxy.io/docs/envoy/latest/start/start

FRP
https://github.com/fatedier/frp

SSLH
https://github.com/yrutschle/sslh
https://github.com/yrutschle/sslh/blob/master/doc/tproxy.md

[domosekai]

What is the benefit of hosting a reverse proxy over installing softether server that cascades with your home server?

[andrewfer000]

I thought about cascading but I couldn't get it to work the way I wanted. Also having full reverse proxy support in SE would be a nice to have since I can run a webserver and SE on the same machine with Port 443 being shared. Also better reverse proxy support will allow me to run multiple SoftEther servers one one machine at the same time for testing. (I'm not in a great place financially and can only afford one VPS for everything)

[domosekai]

I had no issues running softether server with a reverse proxy, sharing the 443 port.
I used https://github.com/yrutschle/sslh.
I believe the setup is almost identical with most reverse proxy. One thing you might need to take care of is that if you use sni to identify SE traffic, the sni becomes yourserver.com/tcp instead of just yourserver.com if the client has nat traversal disabled.

[andrewfer000]

@domosekai Are you able to run multiple SoftEther servers behind SSLH? Also would you mind giving me an example configuration so I can get something quick up and running?

The other purpose of this discussion is to try and build a similar system to VPNAzure and DynamicDNS that works well enough so we do not have to reverse engineer or rebuild a whole new VPNAzure/DynamicDNS program. Using already existing software means all we have to do is work it to our needs using scripts and user-friendly instructions.

For example, at the end of the day I want a system that can support multiple users and will be as easy as possible for both the end user and the server host (we want this to be as accessible as possible to promote growth).

You seem like you know what you're doing with SSLH. I am reading it's documentation and examples now and it looks awesome. The only thing I need to work out is getting Let's Encrypt certificates working so they can be generated/renewed automatically. Any help will be greatly appreciated!

[domosekai]

I don't see why you can't. But I don't have my configuration left.

[andrewfer000]

I really am going to test out SSLH. It seems like it has the best transparent proxy functionality which means there would need to be zero changes needed on the SoftEther VPN side.

SSLH has the following major features needed to get this to work, such as-

• Transparent Proxy functionality to get real client IPs which is easy to setup on both server and host.
• SNI hostname support to allow for use of subdomains.
• I have seen some Certbot (Let's Encrypt) documentation out there. But we can generate certificates using either Apache or Nginx on port 80.
• Host configurations are one-liners making it simple to add/remove hosts using GNU or UNIX programs such as Awk, and Sed (or we can build our own file processor for more complex work if needed).
• Will allow a Webserver such as Apache or Nginx to run along side everything so a admin/user panel and registration page can be ran on the same server and have HTTPS support on port 443.
• Can proxy services from other machines on the "LAN" (In this case the LAN will be built by a VPN Server running on the proxy server).
• OpenVPN Support. I do not know if it's for just TCP or if it also supports UDP.
• UDP support which uses RegEx so maybe we can get L2TP/IPsec working as well which would be a nice touch but it's not a priority. I am not technical enough in the realm of IPSec so a developer may want to look into it after I get a working setup.
• Available in most Linux distribution's repositories. Also has simple dependencies for compiling from source. Seems to be very stable and simple compared to the other proxies/multiplexers out there.

PHASE I- Prototype & POC
As soon as my VPS gets spun up, I will try to get the following done-

• SSLH properly configured.
• Apache Webserver with demo page behind SSLH.
• SoftEtherVPN Server (Latest code) as the VPN server where the remote servers will connect to.
• Transparent Proxy configurations set as needed.
• Client VPN Server at home to test. (My current home VPN server is port forwarded. I will set up a second server for this)
• Documentation of the completed work and guide on how to implement it (Ubuntu 20.04 focused as of now)
• Test results and screenshots of the completed project.

(Btw, I am testing this on a SUPER cheap VPS that costs $2/mo. It's KVM but besides that it's very bare-bones. Which will mean two things. One, this works well with multiple clients on the cheap VPS and is a huge success. Or Two, where it works on the cheap VPS but performance is sub-optimal. Which just means a more powerful VPS or Dedicated server will be better for many clients. I usually get around 80 Mbps up/down on this provider's VPS so speeds should be good. I mostly concerned about latency, processing time, and dropped packets.)

With all of that, you guys can test, review, and propose improvements and ideas on how to bring this to a more productive level. That will be for PHASE II.

[chipitsine]

@andrewfer000 , your documentation talent is very notable. Can we have wiki page (in this repo) descibing working PoC (once it is done) ?

[andrewfer000]

Absolutely. That's where I plan to put it anyway.

[andrewfer000]

PHASE II PRE-
I am setting up Phase II stuff because I can already see a lot of things the developers and others with lots of SoftEther knowledge can help with. Although Phase I is not complete yet (I'm almost done) there are these things I would like others to start looking into.

1. The VPN Clients on the Proxy Server's SoftEtherVPN Server talk to the Reverse Proxy software via a TAP Device. We need to ensure that the TAP device gets the same IP when the server is rebooted or SoftEther is restarted.
2. When the server reboots, the dhclient needs to be run for the TAP Device to get an IP.
3. When clients connect, they will get an IP address from SoftEther's DHCP Server. SoftEther must ensure that client gets the same IP forever or else it will break the reverse proxy.
4. On the client side, there must be an automated way to start the SoftEtherVPN Client so the user automatically connects to the reverse proxy server without having to do anything manually.

This is it so far, so if anyone wants to try and work these things, feel free! This is all related to the SoftEtherVPN Server, Possibly using something like WireGuard standalone can fix these issues. However I love SoftEtherVPN and would prefer it and these issues are totally fixable.

PHASE I CHECKLIST

• SSLH Properly configured
• Apache Webserver with test page behind SSLH
• SoftEtherVPN Server (Latest code) as the VPN server where the remote servers will connect to.
• Transparent Proxy configurations set as needed on Server
• Client VPN Server at home to test.
• Transparent Proxy configurations set as needed on Client
• Does everything Work?
• Documentation of the completed work and guide on how to implement it (Ubuntu 20.04 focused as of now)
• Test results and screenshots of the completed project.

[andrewfer000]

So I ran into a serious roadblock. I need to experiment to see if this is a SoftEther issue or a SSLH issue but the proxy is unable to interact with the remote VPN server (aka the client) SSLH spits out this

Sep 02 18:13:06 mydomain.xyz sslh[39032]: forward to tls failed:connect: Connection timed out
Sep 02 18:13:06 mydomain.xyz sslh[39032]: sslh-fork.c:115:connect: Connection timed out
Sep 02 18:13:06 mydomain.xyz sslh[39032]: forward to tls failed:connect: Connection timed out

When I run nc -zv 192.168.30.11 5555 (The Clients IP with SE's port) iy works. however, the proxy server can reach it. Also clients that connect to the proxy's VPN server can talk to the other clients just fine.

I am going to try using WireGuard standalone. If that works I will try messing with SoftEther as the server again but we'll see.

[andrewfer000]

1. I'm trying to use a VPS as a reverse proxy for a VPN server running at home. Like a self-hosted VPN Azure service. SoftEther (or WireGuard) runs on the proxy server so the home server can talk to the proxy.

2. 192.168.30.0/24 is routable because I created a tap device on the server.

[chipitsine]

VPN Azure is multitenant, while on your own VPS you make one to one reverse proxying (not one to many). UDP may work in one to one scenario

[andrewfer000]

VPN Azure is multitenant, while on your own VPS you make one to one reverse proxying (not one to many). UDP may work in one to one scenario

My goal is multitenant using a TCP proxy and SNI hostnames. Even if I use a UDP vpn such as WireGuard to create a tunnel between the home server and proxy server does not mean the protocol being tunneled is UDP.

The protocols I want working for my devices connecting are SoftEther, SSTP, or OpenVPN TCP. I do not care about UDP protocols for this project.

In my second diagram you'll get the idea I am aiming for.

That being said, I cannot even get a 1:1 service working atm and I have no idea why and it's driving me crazy!

[nord21]

is it risk-free to use nordvpn mod apk ?

[andrewfer000]

is it risk-free to use nordvpn mod apk?

No. This is likley malware. Please do not share potentially harmful software.

[andrewfer000]

Welp WireGuard does not work so SSLH is likely a false hope. While it works for local stuff it will not work for clients connected from a VPN. There could be a way but honestly idk.

I might try again with HAProxy later.

[chipitsine]

UDP is only reverse proxy by dedicated software, for example, DNS server or .... Wireguard running as reverse proxy (if that's possible). No generic proxy works for UDP

[andrewfer000]

I don't want to proxy WG itself. WG is just used to create a peer-to-peer connection with the proxy sever so it can talk to the server behind it.

[andrewfer000]

HAProxy works. Now I just need to get transparent proxying to work.

[andrewfer000]

HAProxy decided to not work right anymore... Ugh this is a pain in the ass.

When i mean work right. I'm talking about the sni hostnames AND the Transparent Proxy.

[andrewfer000]

Honestly I'm doing too much too fast. I'm going to take a break from this. What I learned is that Proxying is unnecessarily difficult for what it is and SSLH is good for local proxying and multiplexing.

[andrewfer000]

Well I found the issue on SSLH...

It was the Transparent part that's the issue. Which in a way is good because it's not necessarily a network limitation. However this limits the abilty to get the real IP. I am looking into Iptables stuff to maybe fix this but idk.

[andrewfer000]

With transparent proxying off using SSLH, Here's the notes.

• Server does not get real client IP.
• Tested using SSTP on Android (VPN Client Pro) and SoftEtherVPN Client on Linux.

I plan to make documentation for two things.

1. How to run SoftEtherVPN and a HTTPS webserver on the same port using SSLH (Transparent Proxy)

2. How to setup your own VPN Azure service with SSLH (Transparent Proxy Disabled), WIP.

[andrewfer000]

Some 4G mobile networks in Russia blocks wireguard completely. Maybe it is good idea to adopt VPN software to work when 10% traffic is dropped for whatever reason

I'm not using WG anymore. I'm using SoftEther for everything.

Also I made documentation for sharing port 443 already so please take a look at that and leave feedback.

[chipitsine]

I understand. I just meant that ISP may affect VPN traffic

[chipitsine]

Where's documentation?

[andrewfer000]

Where's documentation?

In the Wiki. It's one above the bottom.

Not the HAProxy one

[chipitsine]

nice, I did not realize that anyone can edit wiki. It's good.

as for documentation, the more people use it, the more feedback will come.

I will keep in mind and redirect people to it when appropriate (if they will not find it themselves)

[chipitsine]

Yep, documentation is really wanted

[andrewfer000]

Screenshot from Android on public wifi, Phone connects to proxy on VPS which connects me to my home VPN.

Im kinda disappointed that transparent proxy does not work. So atm the server sees the user's IP as 192.168.30.12. However there could be a way to fix.

[andrewfer000]

Hello Everyone,

I just wanted to let you know I am still working on this and have recently made many major breakthroughs in getting this working! While it's not perfect it works and is (in my opinion) much more functional and secure compared to VPNAzure/DynamicDNS especially since you can choose the location of the server and not be forced to use far away Japan servers. I will be preparing a guide in the WikI as well as a list of possible improvements that can be made to the SoftEtherVPN software itself to better support this method (such as writing scripts for automated configuration/maintenance). I'm still testing a few features and cleaning things up. Expect an article in the Wiki soon. I absolutely need people to (stress) test this so let me know if you guys are still interested.

Currently I am using my Home VPN server as the "client vpn server" and a Single Core 1GB RAM VPS (Canada) as the server. So far it works well and the only major issue is latency. But that is likely caused by the server's weak specs and far distance since I'm from the New York area.

[andrewfer000]

So far so good! This is me on my school WiFi connected to to my home VPN server through the hosted server in the cloud. the latency isn't fabulous but the speeds are perfect (maxes out my home ISP upload speed of 40 Mbps). I just need to polish out the processes and make a presentable documentation and it'll be in the Wiki

[andrewfer000]

It was a long journey, but its complete! PLEASE test this and help me improve it
Link to Article