Table of Contents

PPPoSSH server

This article relies on the following:

Introduction

Goals

  • Encrypt your internet connection to enforce security and privacy.
    • Prevent traffic leaks and spoofing on the client side.
  • Bypass regional restrictions using commercial providers.
    • Escape client side content filters and internet censorship.
  • Access your LAN services remotely without port forwarding.

Command-line instructions

1. Preparation

Specify configuration parameters for VPN server. 

# Configuration parameters
VPN_PORT="22"

2. Key management

Generate and exchange keys between server and client. Set up key-based authentication. 

# Server private key
VPN_KEY="/etc/dropbear/dropbear_ed25519_host_key"
 
# Generate server public key
dropbearkey -y -f ${VPN_KEY} \
| sed -n -e "/^ssh-\S*\s/p" > sshserver.pub
 
# Client public key
VPN_PUB="$(cat sshclient.pub)"
 
# Configure PKI
cat << EOF >> /etc/dropbear/authorized_keys
${VPN_PUB}
EOF

3. Firewall

Consider VPN network as private. Assign VPN interface to LAN zone to minimize firewall setup. Allow access to VPN server from WAN zone. 

# Configure firewall
uci rename firewall.@zone[0]="lan"
uci rename firewall.@zone[1]="wan"
uci del_list firewall.lan.device="ppp+"
uci add_list firewall.lan.device="ppp+"
uci -q delete firewall.pppossh
uci set firewall.pppossh="rule"
uci set firewall.pppossh.name="Allow-PPPoSSH"
uci set firewall.pppossh.src="wan"
uci set firewall.pppossh.dest_port="${VPN_PORT}"
uci set firewall.pppossh.proto="tcp"
uci set firewall.pppossh.target="ACCEPT"
uci commit firewall
service firewall restart

4. VPN service

Configure VPN service. Disable password authentication. 

# Configure VPN service
uci set dropbear.@dropbear[0].Port="${VPN_PORT}"
uci set dropbear.@dropbear[0].PasswordAuth="0"
uci set dropbear.@dropbear[0].RootPasswordAuth="0"
uci commit dropbear
service dropbear restart

Testing

Establish the VPN connection. Verify your routing with traceroute and traceroute6. 

traceroute openwrt.org
traceroute6 openwrt.org

Check your IP and DNS provider.

On router:

  • Go to LuCI > Status > Wireguard and look for peer device connected with an IPv4 or IPv6 address and with a recent handshake time
  • Go to LuCI > Network > Diagnostics and ipv4 ping client device IP eg. 10.0.0.10

On client device depending on wireguard software:

  • Check transfer traffic for tx & rx
  • Ping router internal lan IP
  • Check public IP address in a browser – https://whatsmyip.com – should see public IP address of ISP for the router

Troubleshooting

Collect and analyze the following information. 

# Restart services
service log restart; service dropbear restart; sleep 10
 
# Log and status
logread -e dropbear; netstat -l -n -p | grep -e dropbear
 
# Runtime configuration
pgrep -f -a dropbear; pgrep -f -a pppd
ip address show; ip route show table all
ip rule show; ip -6 rule show; nft list ruleset
 
# Persistent configuration
uci show network; uci show firewall; uci show dropbear