hello everyone Zaid from Zed security
here and in today's video I'm going to
show you how to create your own VPN
server and configure it for maximum
security and privacy
show us some love by Smashing that like
button subscribe to the channel if you
haven't done so already and use the
timestamps below to skip through the
video if you are impatient
using a VPN basically allows us to
access the internet from a different
location therefore it allows us to
bypass censorship access content that is
only restricted to that location protect
our privacy and prevents man in the
middle attacks because all the traffic
going through the VPN is encrypted let
me briefly explain to you how vpns work
before we create our own VPN server VPN
stands for virtual private network and
to understand how it works let's first
have a look on a normal scenario where
we have a user trying to access
google.com usually this traffic is sent
unencrypted unless Google or the website
they're trying to access user's
encryption this traffic passes through a
number of routers it passes through your
internet service provider and so on and
all of these tops can see the data that
you're sending and manipulate it profile
you gather information about you and so
on
now if you use a VPN you will first
connect to the VPN server which you can
think of as a computer that exists on
the internet on the cloud and what
happens is you create an encrypted
tunnel an encrypted connection with this
computer
so whenever you want to access anything
on the internet you send that first to
this computer but the request is sent
encrypted hence I used a green arrow in
here to indicate that the data sent is
encrypted so whenever you want to access
something both you and the VPN server
will be able to read this data and
understand it but if anybody intercepts
this data whether it's your internet
service provider whether it's your
network admin whether it's a hacker they
will not be able to read this data or
manipulate it or profile you because
this data will be encrypted it'll be
gibberish
then once the VPN receives the data once
it sees for example you want to go to
google.com it'll simply forward that
request to Google and then the response
will follow a similar path
again keep in mind traffic leaving the
VPN will be unencrypted it'll only be
encrypted if the service that you're
connecting to uses encryption hence I
used a red arrow in this case
now this architecture of first creating
a secure tunnel and connecting to a
server and then go to the Internet or to
the tour Network or to whatever service
is really really useful because first of
all it adds an extra layer of encryption
this means that it's going to improve
our privacy and anonymity because it
will prevent anybody that intercepts
this connection that intercepts this
flow of data in here from seeing what
data you're sending or receiving again
whether it's your network admin whether
it's your internet provider whether it's
a government it doesn't really matter
your data in here is going to be
encrypted therefore it'll be useless to
any entity that intercepts it it will
also help us bypass censorship and using
a VPN protect us from hackers because it
is very easy for anyone connected to the
same network as you to intercept your
data to redirect the flow of data so
that it flows through their computer I
actually covered this in my network
hacking and in my ethical hacking
courses
so whether you're connected to a public
network such as an airport Network or a
hotel or a college network or even at
your own home network anybody connected
to that Network can redirect the flow of
data so that it flows through their
computer and once they do this they'll
be able to see all the websites you
visit all the usernames and passwords
you send they'll even be able to modify
data on the Fly and backdoor files you
download and in many cases even gainful
control over your computer
now if a VPN is used the hacker will
still be able to redirect the flow of
data and they will still be able to
intercept your data but this data again
will be encrypted hence the use of the
green arrows so they won't be able to
see the usernames or the passwords or
anything and even if they try to modify
this data they wouldn't be able to do it
because it will be simply gibberish and
they wouldn't be able to analyze it or
do anything with it that's why using a
VPN is a really good solution to prevent
man in the middle attacks
with that being said there is a number
of things that you need to keep in mind
when using a VPN
first of all we are introducing a man in
the middle and here so if we go back to
the previous diagram we can see that our
connection was going directly to the
internet but when we're using a VPN
we're literally adding an extra node to
our connection so the data is encrypted
between the user and the VPN provider
but the VPN provider is able to see this
data therefore you want to make sure
that you pick a reputable VPN provider
and avoid free providers because a lot
of them keep logs and analyze you
you also want to make sure that you use
a provider that keeps no logs and use
https everywhere this really solves the
problem of having a VPN here even if you
trust them even if you think this
company will never do anything bad will
never keep logs and analyze your traffic
when you use https everywhere you're
adding another layer of encryption so
your connection between you and the VPN
provider will be secured by two layers
of encryption first the encryption used
by the VPN and the encryption enforced
by https everywhere which is TLS
and then when traffic leaves the VPN
provider you will have TLS encryption up
to whatever destination you're going to
therefore even the VPN provider in this
case will not be able to see your data
because it'll be encrypted with TLS
which is a very very secure encryption
if you find it hard to trust anybody
then it's probably a good idea to create
your own VPN server and manually
configure it for maximum security and
privacy and configure it to store no
logs this way you won't have to take
anybody's word for it you've done it
yourself and configured it yourself and
it's actually not that hard as you're
gonna see in the rest of the video
you'll still have to pick a cloud
provider to use their servers as the VPN
server now there is a lot of companies
out there that you can choose to install
your VPN server on it you should do your
own research and find a company that
you're happy with I'm going to be using
the node the node is sponsoring this
video but I actually you trust them
myself and they have really good
reputation on the internet
they also have servers in a large number
of locations across the globe therefore
you'll be able to change your location
to any of these locations and finally
they're giving you guys a hundred
dollars free credit if you sign up using
the links in the description therefore
you'll be using a paid service for free
do your own research to see whatever
cloud provider you want to go with but
for the rest of the video I'm gonna be
using the node but you can apply the
same steps regardless of what cloud
provider you choose to go with once you
sign up you're gonna see this dashboard
right here which you can use to create
new servers they call their servers the
nodes so we're just going to click on
create the node in here
you can just create a bear server with
an operating system and manually install
all the applications that you want or
you can click on the marketplace and
deploy a server with a pre-installed
application for example you can deploy a
server with WordPress pre-installed on
it cpanel Docker you have a large number
of applications that you can deploy
within your server and have them
pre-installed in our case we want to use
the server as a VPN server therefore
we're going to deploy our server with
openvpn installed on it
so we're going to click on that and
we're going to scroll down to set up the
rest of the server configuration
the first thing it's asking us for is
the VPN password this is not the
password that you will use to SSH or
login into the server this is the VPN
password so make sure you set this to
something that you will easily remember
next it's asking you for the image or
for the operating system that will be
installed on the server so you can use
this drop down menu to select whatever
operating system you want to install I'm
just going to keep it on Debian 10. next
it's asking us for the region now this
is very very important this is the
region that your server will be running
from so when you connect to this VPN
server and access the internet you will
appear like you're accessing the
internet from that region so if you're
trying to bypass censorship or access
content that is only available for a
specific region then make sure you
select that country later on when I
connect to this VPN and access the
internet I will appear like I'm browsing
the internet from Atlanta so if my
internet service provider or my country
sensors content and prevents me from
using certain applications or Services
I'll be able to use them because I'll
appear like I'm accessing the internet
from Atlanta also if there are services
that are only available to the United
States or to Atlanta I'll be able to use
them because again I'll appear like I'm
using the internet from there
so select a region that makes sense in
your scenario we're going to set it to
Atlanta for this example and next we're
going to select the server type now
we're going with a shared CPU server
that's fine we don't really need a very
powerful server for this so we're
selecting the smallest one and this will
only cost you five dollars per month now
as I said if you sign up with the link
in the description you're gonna get a
hundred dollars credit so you'll
basically be able to use this server for
20 months for free
we're gonna scroll down and we're going
to set the node label or the name of the
server now I like using meaningful names
so we're just going to call this us
Atlanta VPN
we're going to leave the tag and we're
going to set the root password now root
is the user with the highest privileges
on the server that we're creating this
is the password that you're going to use
to remotely control your server so make
sure you use a different password in
here than the VPN password and make sure
that you'll be able to remember it or
store it in your password manager
you can also set up some optional
options in here but we don't need any of
that we're ready to go so we're simply
going to click on create the node to
create This Server now you're going to
need to give it some time to create the
server with the selected operating
system and then even when it boots even
when it starts saying running in here
you want to give it an extra four or
five minutes because we said that we
want openvpn to be installed on the
server therefore you need to give it a
little bit extra time to install the
openvpn server so once you see that it's
saying it's running in here and after
you give it a few minutes let's go ahead
and access the admin page of the openvpn
server we're gonna copy the IP of the
server in here this is the IP of our
server we're going to open up a new tab
we're going to go to https
the IP of the server followed by colon
943
so we're basically going to the IP of
our server colon 943 because 943 is the
port that the web server of openvpn runs
on
we're gonna go forward slash admin
because we want to access the admin
panel where we can edit the
configuration of our openvpn server so
we're going to hit enter
and you're going to get this warning in
here because the server uses a
self-signed certificate so we're gonna
have to click on Advanced and accept the
risk and as you can see we have the
admin page of the openvpn server now at
the stage if the page is loading that
means everything got installed properly
and you can actually skip to the part
where I show you how to connect to the
VPN server the server is ready to use at
the moment what I'm going to show you
now is simply a number of steps to
improve the security and privacy of the
server and then I'm going to show you
how to configure it to keep no logs
which is very important in my opinion
but basically now the server is actually
ready to use
so we're going to log in with the
username which is openvpn
and the password that we set up when we
created the account make sure you put
the VPN password not the root password
we're going to hit enter
and we're going to accept the agreement
and now we're logged into the admin page
of the openvpn server you should
actually spend some time familiarizing
yourself with the options in here and
maybe even take a look on the
documentation there is so much stuff
that you can set up in here the main
thing is that I want to change is first
of all going to the TLs settings
and setting it to use TLS 1.3 TLS 1.3
uses a faster handshake and is more
secure so we're going to click on save
settings
next we're going to go to the VPN
settings
and I'm gonna modify the DNS settings
you don't have to do this like I said
you don't really have to do any of the
settings that I'm doing right now but if
you're serious about protecting your
privacy then you should consider using a
more private DNS server you should do
your own research and see the best DNS
servers in terms of privacy I'm going to
be using the cloudflare DNS server which
is
1.1.1.1 and then the secondary one is
1.0.0.1 both of which are owned by
cloudflare which have a good reputation
when it comes to privacy and speed we're
going to save these settings as well and
we're actually going to need to set the
routing to no and save and last but not
least we're going to go to the advanced
VPN and we're going to set the TLs
script to TLS script 2. again it's a
little bit more secure because it uses a
unique key per user profile we're gonna
save this as well
and we're going to click on update
Running server to restart the server
with the changes that we made
so so far so good These are nice options
to have to improve the security and the
encryption used on the server the main
thing that I want to do though is to
disable logs so the server keeps no logs
even though that we control it even
though it's our own server it's a really
good idea to disable the logs so it
literally keeps no logs of what happens
whenever the server is used to do that
we're going to have to SSH into the
server and manually change the
configurations
so we're going to go back to the admin
page and you can see that we already
have the SSH command that we need to use
now if you're not familiar with SSH ssh
is a program that can be used to
remotely log in into a computer and run
system commands on that computer
so we're going to copy this command
we're going to go to my terminal and I'm
going to paste it in here and the
command is actually very very simple all
we're doing is we're using SSH to
remotely log in as the root user which
is the admin to this specific computer
to the computer that has this IP address
we're gonna hit enter
and it's asking us if we want to trust
this we're going to say yes and then
it's asking us for the password now here
you need to use the root password that
you set when you created the server so
I'm going to type it in here you're not
going to see anything being displayed on
screen that's normal we're going to hit
enter and now I'm inside my node server
so I can remotely run commands on that
server
now the logs are stored in two locations
within the system the first one is the
log database which is specified in the
configuration file of the VPN server and
the second one is the logs file which is
specified when the actual openvpn
process is executed so we'll have to
modify both of these paths and set them
to nothing so that the logs are not
stored anywhere so let's open up the
configuration file where this log file
is specified first so we're going to use
Nano which is a terminal based Text
Editor to open the configuration file of
openvpn which is stored in USR local
openvpnas
Etc as.com very simple command Nano is
the name of the text editor the terminal
based text editor and we're saying that
we want to edit a file that is stored in
this location and this is the location
of the config file for openvpn we're
going to hit enter and as you can see
you'll see a normal text file we're
going to use the arrows to scroll down
and what we want to modify is the log so
as you can see in here it's saying the
log DB is stored in this path
so all we have to do is basically remove
this path
and set it to Dev null which is nothing
so we're basically saying the log
database is stored nowhere so store the
logs nowhere now to save this file we're
going to have to press Ctrl X
it's asking us do we want to save the
file we're going to say yes so we're
going to press y
and it's asking us where to write this
file I'm just going to hit enter to
overwrite the existing file
and that's it now we modified the
configuration of our VPN server so right
now we set this path to nothing
therefore there will be nothing stored
in this location
now the next thing that we need to
modify is the other place where the logs
are stored and like I said this is
specified when the actual openvpn
process is executed so we'll need to
modify that using the systemctl command
we're going to say that we want to edit
a process called open vpnas
so systemctl is an application used to
control other services that run on the
system we're saying that we want to edit
a specific service that is called
openvpnas
we're going to hit enter and again
you're going to see a text file open up
and if you scroll down again using the
arrows you'll see that in here you'll
see the command that is used to run this
process and you can see that the log
file is specified as wire log open
vpnas.log so we want this to point to
nothing so again we're going to use the
arrows to navigate to that location
we're gonna delete everything and we're
gonna set this path to Dev null so we're
setting it to nothing
again exactly as before control X to
exit y to save and enter to overwrite
and that's it now we're done so we
basically set both of these paths to
nothing and the last thing that we need
to do is restart the server for these
changes to take effect so again we're
going to use systemctl to restart
a service called open
vpnas hit enter
if you see no errors that means the
service was restarted with no issues at
all and now the openvpn server is
running with the configurations that we
just set storing no logs on the server
to confirm this first of all I'm going
to read the existing log files because
it's already stored logs they've asked
us because we slightly use the server so
if we use the cat command to read the
first path you'll see that it has a lot
of logs about us and we can also read
the second file in here so again we can
just do cut for the second file and
again it's full of logs about us so
let's clear these logs and then use the
VPN and see if it's actually going to
store any information about us
so I'm gonna type clear to clear the
terminal and then to clear the logs in
the first file we're basically just
gonna write nothing to it so we're gonna
say Echo nothing to this file and we'll
do the same with the second file
so we're going to do Echo nothing to
this file and now if we read any of
these files using the cat command you'll
see that they're both empty so that's
perfect my logs are now empty and we
configured the VPN to store nothing in
there so it should be storing no logs
so the final step now is to actually go
ahead and connect to this VPN that we've
been configuring for so long and
remember that you don't need to do any
of the configuration steps that I've
done so far you could have Simply
Connected To it straight away after
creating the server in here I just
wanted to show you how to improve the
security of the server and configure it
to store no logs to improve your privacy
so to connect to the server we're gonna
first of all need to go back to where we
were so we're going to the IP of the
server colon 943 which is the part where
the web server runs instead of doing
forward slash admin we're gonna just
remove everything and just go to the
base location
again it's going to ask you to log in so
we're going to log in with openvpn as
the user and the password that you set
and as soon as you log in it's going to
give you a list of all of the clients
that you can download to connect to this
VPN server and as you can see you can
connect from Mac Windows Linux Android
iOS doesn't really matter everything is
pretty much supported in here I'm using
a Mac so I'm going to click on the Mac
icon in here
and we're going to save this file to my
disk
once the download is complete we're
going to run the installer and install
on the client is very simple it's
usually a matter of a double click and
then just going through the wizard so
we're just gonna click and continue
continue agree install put your password
and that's it we're done so we're gonna
close this we're gonna move it to bin
this is just the installer and I'm gonna
go to all of my applications and run the
openvpn client so this is the program
that we're going to use to connect to
the server now as you can see the client
comes with our own profile so with the
right settings to connect to the server
that we created so all you have to do is
simply click on this button right here
and put the VPN password and it'll
connect you to it and perfect that's it
now we're connected to our VPN server
and all of our traffic should be going
through this VPN server which is
actually in the United States therefore
any website that I load will think that
I am loading it from the United States
therefore I'll be able to bypass
whatever censorship that my internet
service provider enforces and I should
also be able to access content that is
only available for the United States not
only that but all of my traffic is going
to be encrypted going through our VPN
server and no logs should be stored in
that server because we manually
configured it to do so
so let's go ahead and actually verify
that this is working as expected so I'm
going to go to ipleak.net
and as you can see it thinks that I am
browsing this website from the United
States and even my DNS is not leaking
any information about me so it seems
like I am coming from the United States
now to also verify that cloudflare's DNS
servers are being used instead of my
internet service provider servers I'm
going to open up a new terminal window
and we're simply going to type nslookup
followed by any domain for example
google.com
and you'll see that the server is used
to process the DNS requests is
1.1.1.1 which is the cloudflare server
that we actually configured our VPN to
use