hwdsl2/setup-ipsec-vpnAutomated IPsec VPN server setup with IPsec/L2TP, Cisco IPsec, and IKEv2 support. Includes helper scripts for user and certificate management, and generates profiles for iOS, macOS, Android, and Windows clients.
English | 简体中文 | 繁體中文 | 日本語 | Русский
Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2.
An IPsec VPN encrypts your network traffic, so that nobody between you and the VPN server can eavesdrop on your data as it travels via the Internet. This is especially useful when using unsecured networks, e.g. at coffee shops, airports or hotel rooms.
We will use Libreswan as the IPsec server, and xl2tpd as the L2TP provider.
Features:
Also available:
📘 Interested in self-hosted AI? The Self-Hosted AI Builder’s Guide is a practical guide to building, securing, and operating your own private AI stack.
Start with a Linux server* running a supported operating system.
Use this one-liner to set up an IPsec VPN server:
wget https://get.vpnsetup.net -O vpn.sh && sudo sh vpn.sh
Your VPN login details will be randomly generated, and displayed when finished.
Tip: Optionally install WireGuard, OpenVPN and/or Headscale on the same server.
Note: This recording is for demo purposes only. VPN credentials in this recording are NOT valid.
You may also use curl to download:
curl -fsSL https://get.vpnsetup.net -o vpn.sh && sudo sh vpn.sh
Alternative setup URLs:
https://github.com/hwdsl2/setup-ipsec-vpn/raw/master/vpnsetup.sh
https://gitlab.com/hwdsl2/setup-ipsec-vpn/-/raw/master/vpnsetup.sh
If you are unable to download, open vpnsetup.sh, then click the Raw button on the right. Press Ctrl/Cmd+A to select all, Ctrl/Cmd+C to copy, then paste into your favorite editor.
A pre-built Docker image is also available. For other options and client setup, read the sections below.
* A cloud server, virtual private server (VPS) or dedicated server.
A cloud server, virtual private server (VPS) or dedicated server, with an install of:
This also includes Linux VMs in public clouds, such as DigitalOcean, Vultr, Linode, OVH and Microsoft Azure. Public cloud users can also deploy using user data.
Quick deploy to:
» I want to run my own VPN but don't have a server for that
For servers with an external firewall (e.g. EC2/GCE), open UDP ports 500 and 4500 for the VPN.
A pre-built Docker image is also available. Advanced users can install on a Raspberry Pi. [1] [2]
[!WARNING] Run these scripts on the Linux server that will host your VPN. Do not run them on your personal PC or Mac.
First, update your server with sudo apt-get update && sudo apt-get dist-upgrade (Ubuntu/Debian) or sudo yum update and reboot. This is optional, but recommended.
To install the VPN, please choose one of the following options:
Option 1: Have the script generate random VPN credentials for you (will be displayed when finished).
wget https://get.vpnsetup.net -O vpn.sh && sudo sh vpn.sh
Option 2: Edit the script and provide your own VPN credentials.
wget https://get.vpnsetup.net -O vpn.sh
nano -w vpn.sh
[Replace with your own values: YOUR_IPSEC_PSK, YOUR_USERNAME and YOUR_PASSWORD]
sudo sh vpn.sh
[!NOTE] A secure IPsec PSK should consist of at least 20 random characters.
Option 3: Define your VPN credentials as environment variables.
# All values MUST be placed inside 'single quotes'
# DO NOT use these special characters within values: \ " '
wget https://get.vpnsetup.net -O vpn.sh
sudo VPN_IPSEC_PSK='your_ipsec_pre_shared_key' \
VPN_USER='your_vpn_username' \
VPN_PASSWORD='your_vpn_password' \
sh vpn.sh