Setup my own VPN Server for Family

[mirage22]

Hi,

I pay about USD 60 for VPN access through a VPN service provider every year.

I am wondering if I can build a vpn service just for me and my family.

The vps instance need not be huge but definitely do not want an SSD VPS like most vps's today. So that i can bring down my costs.

Reasons for building my own vpn for personal use.

1) Geo-ip location change. Plus I do not want people using the service to spam and eventually the IP is branded as evil across the internet.

2) Don't want to use the IP which is branded as coming from a VPN exit node.

2) connect more than 3 or 5 clients. I have phones that don't just connect from home, laptops, and I want all my family members to use it without hassle - family would include folks in other homes.

3) Single IP at the frontend. So I can keep all kids under the OpenDNS HOME monitor to ensure that they surf safely. And so do other family members .

4) I really don't know who is at the other end managing my VPN service.

5) while we want a lot of bandwidth, we won't be using it for torrenting. so having a dedicated ip will not be a problem for us.

So here are the questions

1) Suggested vps servers. Cheap, good bandwidth (kids will be watching a lot of video) and good pipe, say 100mbps. About the same price range of USD 50-60 annually. Always up. Based in USA east coast.

2) want to configure OVPN and IKEv2 both on this VPS.

3) Can multiple clients use the same connection from different locations? Office, home 1, home 2 etc

4) Will the IP address in such a configuration be the IP address assigned by the Server provider?

5) Technical setup help for OVPN server on such an instance and for IKEv2. I saw a setup solution by digitalocean on the internet. Minimum system requirements.

6) Firewall rules to protect everybody behind the ovpn / ikev2 connection. especially on open ports like 443.

7) Can i beef up the security options like choosing AES-512-CBC for data transmission, 4096 cipher strength at handshake, SHA2 512 perhaps. obfsproxy (but not tor) or probably one of the algorithms not designed by the N. SA . and how about elliptical curve cryptography along wih TLS?

8) suggested clients to use to connect the laptops etc. i guess ovpn client should be good. for phones etc we will use IKEv2. We could also configure the ovpn client on the routers for ease of use at home.

 

[System Error Message]

Im not sure of any providers but make sure the server you rent has sufficient CPU to perform encryption though it depends on the throughput you want. If you run a normal server OS it will be quite difficult to configure properly and you might want to consider installing a good firewall software and make sure everything is configured properly. A firewall cant automatically protect software that is running so you ought to be looking at firewall and software configs that can perform similar tasks to configurable routers like pfsense, mikrotik and ubiquiti where the firewall can be configured for different networking layers. For example a firewall cannot filter VPN traffic because it has no rules for such which you need to add manually.

In a strict routerOS security example i can deny all incoming traffic on VPN (forward chain) unless however an outgoing connection is first made from the inside which adds the remote address to a whitelist temporarely. In a server OS where you have to install the VPN server and set it up this wont be possible to do through the firewall. in a regular or server OS the firewall passes control over to the software for all traffic on open ports. So if a particular software is listening on a particular port the firewall will not interfere with traffic on that port so if the software was vulnerable it could be compromised (just like many web based vulnerabilities). There may be UTM based softwares that can apply strict rules by preventing just any incoming traffic first and prevent communication between one software and another (for example preventing activeX from internet explorer to communicate with the other parts of the windows OS) but they are likely to be costly for a full OS.

When it comes to VPN all clients are on the same network. In general your VPS will also be performing NAT as well in the case you described.