Can we make a Vpn server run on Android?

Question

Can we make a Vpn server run on Android. Can applications do this? If yes, which protocols are supported and is this a good idea to use such apps? If not, what are some issues that we may face?

Answer 1

Yes we can run VPN server on Android, but not without root. Stock Android doesn't support VPN servers, even many protocols aren't supported as client too, so you have to install third party apps. There are apps like Servers Ultimate which offer VPN server, but I haven't tested. CLI keeps life simple:

• Build openvpn static binary and copy to /system/bin.

• Create a basic server configuration file:

  ### /etc/openvpn/server.conf
  
  # basic configuration
  port 69
  proto udp
  dev tun
  mode server
  tls-server
  keepalive 10 120
  
  # dynamic IP pool
  server 10.8.0.0 255.255.255.0
  
  # send RESTART command to clients if tunnel is restarted (UDP)
  explicit-exit-notify 1
  
  # configure like a "traditional" broadcast-based network
  topology subnet
  push "topology subnet"
  
  # send all traffic from client to VPN
  push "redirect-gateway def1 bypass-dhcp"
  
  # DNS nameservers
  push "dhcp-option DNS 1.1.1.1"
  push "dhcp-option DNS 1.0.0.1"
  
  # certificates and keys to use
  ca ca.crt
  cert server.crt
  key server.key
  dh dh2048.pem
  tls-crypt tc.key
  
  # cipher algorithm to use for encryption
  cipher AES-256-CBC
  
  # log files
  log /data/media/0/openvpn.log
  status /data/media/0/openvpn-status.log
  verb 3
  
  # do not recreate TUN interface on reset (SIGUSR1)
  persist-tun
  
  # do not reread key files on reset (SIGUSR1)
  persist-key
  

• Create server keys and certificates. tc.key can be created by executing openvpn --genkey --secret tc.key.
  ca.crt, server.key, server.crt and dh2048.pem are built using EasyRSA. It can be done easily on a Linux/Windows PC, on Android it rquires some extra effort:

  ~$ easyrsa init-pki
  ~$ easyrsa build-ca
  ~$ easyrsa build-server-full server nopass
  ~$ easyrsa gen-dh
  

• Copy configuration file, certificates and keys to /etc/openvpn/ and set permissions:

  ~# chmod 0600 /etc/openvpn/{ca.crt,dh2048.pem,server.crt,server.key,tc.key}
  ~# chmod 0644 /etc/openvpn/server.conf
  ~# chmod 0755 /system/bin/openvpn
  ~# chown -R 0.0 /etc/openvpn /system/bin/openvpn
  

• In the same way build client key and certificate using EasyRSA:

  ~$ easyrsa --days=30 build-client-full client nopass
  

  Copy the contents of ca.cert, client.key, client.crt and tc.key to client configuration file. Also add public IP address of Android device if want to connect from internet or local (WiFi/hotspot) IP address:

  ### client.ovpn
  
  client
  dev tun
  auth-nocache
  verb 3
  
  remote-cert-tls server
  cipher AES-256-CBC
  
  pull
  resolv-retry infinite
  
  remote <IP_ADDRESS> 69 udp
  nobind
  connect-retry 5 5
  connect-timeout 10
  
  # only for Windows
  #block-outside-dns
  
  <ca> INSERT_HERE </ca>
  <cert> INSERT_HERE </cert>
  <key> INSERT_HERE </key>
  <tls-crypt> INSERT_HERE </tls-crypt>
  

• Android ignores main table at all, create custom rule and insert routes:

  ~# ip rule add table 5000 priority 5000
  ~# ip route add 10.8.0.0/24 dev tun0 table 5000
  ~# ip route add 192.168.43.0/24 dev wlan0 table 5000
  ~# ip route add default dev rmnet_data1 table 5000
  

  Where rmnet_data1 is the interface connecting to Mobile Data and wlan0 is WiFi or hotspot. Adjust interface names and network addresses according to your device.

  Setup forwarding and source NAT:

  ~# echo -n 1 >/proc/sys/net/ipv4/ip_forward
  ~# iptables -I FORWARD -i tun+ -j ACCEPT
  ~# iptables -I FORWARD -o tun+ -j ACCEPT
  ~# iptables -t nat -I POSTROUTING -o rmnet_data1 -j MASQUERADE
  

• Run server, but first make a minor adjustment due to difference in Android vs. Linux:

  ~# mkdir /dev/net
  ~# ln -s /dev/tun /dev/net/tun
  
  ~# openvpn --cd /etc/openvpn/ --config server.conf
  

Import the client.ovpn in any OpenVPN client app (on Android / Windows / Linux) and connect.

You can do advanced configuration on server, run it as an Android init service, or what ever you want.

---

RELATED:

• How to run SSH/SFTP server for multiple user logins with password authentication on Android?
• How to use your Android phone as a proxy server?