1

Can we make a Vpn server run on Android. Can applications do this? If yes, which protocols are supported and is this a good idea to use such apps? If not, what are some issues that we may face?

0

Yes we can run VPN server on Android, but not without root. Stock Android doesn't support VPN servers, even many protocols aren't supported as client too, so you have to install third party apps. There are apps like Servers Ultimate which offer VPN server, but I haven't tested. CLI keeps life simple:

  • Build openvpn static binary and copy to /system/bin.
  • Create a basic server configuration file:

    ### /etc/openvpn/server.conf
    
    # basic configuration
    port 69
    proto udp
    dev tun
    mode server
    tls-server
    keepalive 10 120
    
    # dynamic IP pool
    server 10.8.0.0 255.255.255.0
    
    # send RESTART command to clients if tunnel is restarted (UDP)
    explicit-exit-notify 1
    
    # configure like a "traditional" broadcast-based network
    topology subnet
    push "topology subnet"
    
    # send all traffic from client to VPN
    push "redirect-gateway def1 bypass-dhcp"
    
    # DNS nameservers
    push "dhcp-option DNS 1.1.1.1"
    push "dhcp-option DNS 1.0.0.1"
    
    # certificates and keys to use
    ca ca.crt
    cert server.crt
    key server.key
    dh dh2048.pem
    tls-crypt tc.key
    
    # cipher algorithm to use for encryption
    cipher AES-256-CBC
    
    # log files
    log /data/media/0/openvpn.log
    status /data/media/0/openvpn-status.log
    verb 3
    
    # do not recreate TUN interface on reset (SIGUSR1)
    persist-tun
    
    # do not reread key files on reset (SIGUSR1)
    persist-key
    
  • Create server keys and certificates. tc.key can be created by executing openvpn --genkey --secret tc.key.
    ca.crt, server.key, server.crt and dh2048.pem are built using EasyRSA. It can be done easily on a Linux/Windows PC, on Android it rquires some extra effort:

    ~$ easyrsa init-pki
    ~$ easyrsa build-ca
    ~$ easyrsa build-server-full server nopass
    ~$ easyrsa gen-dh
    
  • Copy configuration file, certificates and keys to /etc/openvpn/ and set permissions:

    ~# chmod 0600 /etc/openvpn/{ca.crt,dh2048.pem,server.crt,server.key,tc.key}
    ~# chmod 0644 /etc/openvpn/server.conf
    ~# chmod 0755 /system/bin/openvpn
    ~# chown -R 0.0 /etc/openvpn /system/bin/openvpn
    
  • In the same way build client key and certificate using EasyRSA:

    ~$ easyrsa --days=30 build-client-full client nopass
    

    Copy the contents of ca.cert, client.key, client.crt and tc.key to client configuration file. Also add public IP address of Android device if want to connect from internet or local (WiFi/hotspot) IP address:

    ### client.ovpn
    
    client
    dev tun
    auth-nocache
    verb 3
    
    remote-cert-tls server
    cipher AES-256-CBC
    
    pull
    resolv-retry infinite
    
    remote <IP_ADDRESS> 69 udp
    nobind
    connect-retry 5 5
    connect-timeout 10
    
    # only for Windows
    #block-outside-dns
    
    <ca> INSERT_HERE </ca>
    <cert> INSERT_HERE </cert>
    <key> INSERT_HERE </key>
    <tls-crypt> INSERT_HERE </tls-crypt>
    
  • Android ignores main table at all, create custom rule and insert routes:

    ~# ip rule add table 5000 priority 5000
    ~# ip route add 10.8.0.0/24 dev tun0 table 5000
    ~# ip route add 192.168.43.0/24 dev wlan0 table 5000
    ~# ip route add default dev rmnet_data1 table 5000
    

    Where rmnet_data1 is the interface connecting to Mobile Data and wlan0 is WiFi or hotspot. Adjust interface names and network addresses according to your device.

    Setup forwarding and source NAT:

    ~# echo -n 1 >/proc/sys/net/ipv4/ip_forward
    ~# iptables -I FORWARD -i tun+ -j ACCEPT
    ~# iptables -I FORWARD -o tun+ -j ACCEPT
    ~# iptables -t nat -I POSTROUTING -o rmnet_data1 -j MASQUERADE
    
  • Run server, but first make a minor adjustment due to difference in Android vs. Linux:

    ~# mkdir /dev/net
    ~# ln -s /dev/tun /dev/net/tun
    
    ~# openvpn --cd /etc/openvpn/ --config server.conf
    

Import the client.ovpn in any OpenVPN client app (on Android / Windows / Linux) and connect.

You can do advanced configuration on server, run it as an Android init service, or what ever you want.


RELATED:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.