{"repo":"hwdsl2/setup-ipsec-vpn","free":true,"listed":false,"github":"https://github.com/hwdsl2/setup-ipsec-vpn","clone":"git clone https://github.com/hwdsl2/setup-ipsec-vpn.git","description":"Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. Supports Ubuntu, Debian, CentOS/RHEL, Alpine Linux and Raspberry Pi OS. Includes client config and management scripts.","language":"Shell","stars":28344,"topics":["alpine-linux","bash","cisco-ipsec","debian","encryption","ikev2","installer","ipsec","l2tp","libreswan","linux","network","privacy","raspberry-pi","security","self-hosted","ubuntu","vpn","vpn-client","vpn-server"],"license":null,"category":"network_service","readme_excerpt":"[English](README.md) | [简体中文](README-zh.md) | [繁體中文](README-zh-Hant.md) | [日本語](README-ja.md) | [Русский](README-ru.md)\n\n# IPsec VPN Server Auto Setup Scripts\n\n[](https://github.com/hwdsl2/setup-ipsec-vpn/actions/workflows/main.yml) [](https://github.com/hwdsl2/setup-ipsec-vpn/stargazers) [](https://github.com/hwdsl2/docker-ipsec-vpn-server) [](https://github.com/hwdsl2/docker-ipsec-vpn-server)\n\nSet up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2.\n\nAn IPsec VPN encrypts your network traffic, so that nobody between you and the VPN server can eavesdrop on your data as it travels via the Internet. This is especially useful when using unsecured networks, e.g. at coffee shops, airports or hotel rooms.\n\nWe will use [Libreswan](https://libreswan.org/) as the IPsec server, and [xl2tpd](https://github.com/xelerance/xl2tpd) as the L2TP provider.\n\n**Features:**\n\n- Fully automated IPsec VPN server setup, no user input needed\n- Supports IKEv2 with strong and fast ciphers (e.g. AES-GCM)\n- Generates VPN profiles to auto-configure iOS, macOS and Android devices\n- Supports Windows, macOS, iOS, Android, Chrome OS and Linux as VPN clients\n- Includes helper scripts to manage VPN users and certificates\n\n**Also available:**\n\n- Docker VPN: [IPsec VPN](https://github.com/hwdsl2/docker-ipsec-vpn-server), [WireGuard](https://github.com/hwdsl2/docker-wireguard), [OpenVPN](https://github.com/hwdsl2/docker-openvpn), [Headscale](https://github.com/hwdsl2/docker-headscale)\n- AI: [Self-Hosted AI Stack](https://github.com/hwdsl2/self-hosted-ai-stack) for local LLMs, chat, RAG, voice and AI tools\n- :books: **Books:** [The Self-Hosted AI Builder’s Guide](https://books2read.com/aiguide?store=amazon), [Privacy Tools in the Age of AI](docs/vpn-book.md)\n\n## Quick start\n\nFirst, prepare your Linux server\\* with an install of a [supported OS](#requirements).\n\nUse this one-liner to set up an IPsec VPN server:\n\n```bash\nwget https://get.vpnsetup.net -O vpn.sh && sudo sh vpn.sh\n```\n\nYour VPN login details will be randomly generated, and displayed when finished.\n\n> [!TIP]\n> Optionally install [WireGuard](https://github.com/hwdsl2/wireguard-install), [OpenVPN](https://github.com/hwdsl2/openvpn-install) and/or [Headscale](https://github.com/hwdsl2/headscale-install) on the same server.\n\n\n\nSee the script in action (terminal recording).\n
\n\n**Note:** This recording is for demo purposes only. VPN credentials in this recording are **NOT** valid.\n\n![](\"docs/images/script-demo.svg\")
\n \n\n\nClick here if you are unable to download.\n
\n\nYou may also use `curl` to download:\n\n```bash\ncurl -fsSL https://get.vpnsetup.net -o vpn.sh && sudo sh vpn.sh\n```\n\nAlternative setup URLs:\n\n```bash\nhttps://github.com/hwdsl2/setup-ipsec-vpn/raw/master/vpnsetup.sh\nhttps://gitlab.com/hwdsl2/setup-ipsec-vpn/-/raw/master/vpnsetup.sh\n```\n\nIf you are unable to download, open [vpnsetup.sh](vpnsetup.sh), then click the `Raw` button on the right. Press `Ctrl/Cmd+A` to select all, `Ctrl/Cmd+C` to copy, then paste into your favorite editor.\n \n\nA pre-built [Docker image](https://github.com/hwdsl2/docker-ipsec-vpn-server) is also available. For other options and client setup, read the sections below.\n\n\\* A cloud server, virtual private server (VPS) or dedicated server.\n\n## Community\n\n- 📬 [Subscribe for project updates](https://selfhostedstack.beehiiv.com/subscribe?utm_campaign=vpn) (1–2 emails/month) — get free VPN and AI deployment guides (PDF)\n- 💬 Join the [r/selfhostedstack](https://www.reddit.com/r/selfhostedstack/) community for discussions\n- ⭐ Star the repository if you find it useful — it helps others discover it\n\n## Requirements\n\nA cloud server, virtual private server (VPS) or dedicated server, with an install of:\n\n- Ubuntu 26.04, 24.04 or 22.04\n- Debian 13, 12 or 11\n- CentOS Stream 10 or 9\n- Rocky Linux or AlmaLinux\n- Oracle Linux\n\n\n\nOther supported Linux distributions.\n
\n\n- Raspberry Pi OS (Raspbian)\n- Kali Linux\n- Alpine Linux\n- Red Hat Enterprise Linux (RHEL)\n \n\nThis also includes Linux VMs in public clouds, such as [DigitalOcean](https://blog.ls20.com/digitalocean), [Vultr](https://blog.ls20.com/vultr), [Linode](https://blog.ls20.com/linode), [OVH](https://www.ovhcloud.com/en/vps/) and [Microsoft Azure](https://azure.microsoft.com). Public cloud users can also deploy using [user data](https://blog.ls20.com/ipsec-l2tp-vpn-auto-setup-for-ubuntu-12-04-on-amazon-ec2/#vpnsetup).\n\nQuick deploy to:\n\n[](https://cloud.linode.com/stackscripts/37239) [](azure/README.md)\n\n[**» I want to run my own VPN but don't have a server for that**](https://blog.ls20.com/ipsec-l2tp-vpn-auto-setup-for-ubuntu-12-04-on-amazon-ec2/#gettingavps)\n\nFor servers with an external firewall (e.g. [EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html)/[GCE](https://cloud.google.com/vpc/docs/firewalls)), open UDP ports 500 and 4500 for the VPN.\n\nA pre-built [Docker image](https://github.com/hwdsl2/docker-ipsec-vpn-server) is also available. Advanced users can install on a [Raspberry Pi](https://www.raspberrypi.com). [[1]](https://elasticbyte.net/posts/setting-up-a-native-cisco-ipsec-vpn-server-using-a-raspberry-pi/) [[2]](https://www.stewright.me/2018/07/create-a-raspberry-pi-vpn-server-using-l2tpipsec/)\n\n> [!WARNING]\n> **DO NOT** run these scripts on your PC or Mac! They should only be used on a server!\n\n## Installation\n\nFirst, update your server with `sudo apt-get update && sudo apt-get dist-upgrade` (Ubuntu/Debian) or `sudo yum update` and reboot. This is optional, but recommended.\n\nTo install the VPN, please choose one of the following options:\n\n**Option 1:** Have the script generate random VPN credentials for you (will be displayed when finished).\n\n```bash\nwget https://get.vpnsetup.net -O vpn.sh && sudo sh vpn.sh\n```\n\n**Option 2:** Edit the script and provide your own VPN credentials.\n\n```bash\nwget https://get.vpnsetup.net -O vpn.sh\nnano -w vpn.sh\n[Replace with your own values: YOUR_IPSEC_PSK, YOUR_USERNAME and YOUR_PASSWORD]\nsudo sh vpn.sh\n```\n\n> [!NOTE]\n> A secure IPsec PSK should consist of at least 20 random characters.\n\n**Option 3:** Define your VPN credentials as environment variables.\n\n```bash\n# All values MUST be placed inside 'single quotes'\n# DO NOT use these special characters within values: \\ \" '\nwget https://get.vpnsetup.net -O vpn.sh\nsudo VPN_IPSEC_PSK='your_ipsec_pre_shared_key' \\\nVPN_USER='your_vpn_username' \\\nVPN_PASSWORD='your_vpn_password' \\\nsh vpn.sh\n```\n\n> [!TIP]\n> Optionally install [WireGuard](https://github.com/hwdsl2/wireguard-install), [OpenVPN](https://github.com/hwdsl2/openvpn-install) and/or [Headscale](https://github.com/hwdsl2/headscale-install) on the same server. If your server runs CentOS Stream, Rocky Linux or AlmaLinux, first install OpenVPN/WireGuard, then install the IPsec VPN.\n\n\n\nClick here if you are unable to download.\n
\n\nYou may also use `curl` to download. For example:\n\n```bash\ncurl -fL https://get.vpnsetup.net -o vpn.sh\nsudo sh vpn.sh\n```\n\nAlternative setup URLs:\n\n```bash\nhttps://github.com/hwdsl2/setup-ipsec-vpn/raw/master/vpnsetup.sh\nhttps://gitlab.com/hwdsl2/setup-ipsec-vpn/-/raw/master/vpnsetup.sh\n```\n\nIf you are unable to download, open [vpnsetup.sh](vpnsetup.sh), then click the `Raw` button on the right. Press `Ctrl/Cmd+A` to select all, `Ctrl/Cmd+C` to copy, then paste into your favorite editor.\n \n\n\nI want to install the older Libreswan version 4.\n
\n\nIt is generally recommended to use the latest [Libreswan](https://libreswan.org/) version 5, which is the default version in this project. However, if you want to install the older Libreswan version 4:\n\n```bash\nwget https://get.vpnsetup.net -O vpn.sh\nsudo VPN_SWAN_VER=4.15 sh vpn.sh\n```\n\n**Note:** If Libreswan version 5 is already installed, you may need to first [Uninstall the VPN](docs/uninstall.md) before installing Libreswan version 4. Alternatively, download the [update script](#upgrade-libreswan), edit it to specify `SWAN_VER=4.15`, then run the script.\n \n\n## Customize VPN options\n\n### Use alternative DNS servers\n\nBy default, clients are set to use [Google Public DNS](https://developers.google.com/speed/public-dns/) when the VPN is active. When installing the VPN, you may optionally specify custom DNS server(s) for all VPN modes. Example:\n\n```bash\nsudo VPN_DNS_SRV1=1.1.1.1 VPN_DNS_SRV2=1.0.0.1 sh vpn.sh\n```\n\nUse `VPN_DNS_SRV1` to specify the primary DNS server, and `VPN_DNS_SRV2` to specify the secondary DNS server (optional).\n\nBelow is a list of some popular public DNS providers for your reference.\n\n| Provider | Primary DNS | Secondary DNS | Notes |\n| -------- | ----------- | ------------- | ----- |\n| [Google Public DNS](https://developers.google.com/speed/public-dns) | 8.8.8.8 | 8.8.4.4 | Default in this project |\n| [Cloudflare](https://1.1.1.1/dns/) | 1.1.1.1 | 1.0.0.1 | See also: [Cloudflare for families](https://1.1.1.1/family/) |\n| [Quad9](https://www.quad9.net) | 9.9.9.9 | 149.112.112.112 | Blocks malicious domains |\n| [OpenDNS](https://www.opendns.com/home-internet-security/) | 208.67.222.222 | 208.67.220.220 | Blocks phishing domains, configurable. |\n| [CleanBrowsing](https://cleanbrowsing.org/filters/) | 185.228.168.9 | 185.228.169.9 | [Domain filters](https://cleanbrowsing.org/filters/) available |\n| [Next","default_branch":"master","files":67,"tree":[".github/ISSUE_TEMPLATE/00-bug-report.md",".github/ISSUE_TEMPLATE/10-bug-report-zh.md",".github/ISSUE_TEMPLATE/20-enhancement-request.md",".github/ISSUE_TEMPLATE/30-enhancement-request-zh.md",".github/PULL_REQUEST_TEMPLATE.md",".github/workflows/check_urls.yml",".github/workflows/cron.yml",".github/workflows/main.yml",".github/workflows/shellcheck.yml",".github/workflows/test_set_1.yml",".github/workflows/test_set_2.yml","CONTRIBUTING.md","LICENSE.md","README-ja.md","README-ru.md","README-zh-Hant.md","README-zh.md","README.md","azure/README-zh.md","azure/README.md","azure/azuredeploy.json","azure/azuredeploy.parameters.json","azure/custom_deployment_screenshot.png","azure/install.sh","docs/advanced-usage-zh.md","docs/advanced-usage.md","docs/bbr-zh.md","docs/bbr.md","docs/clients-xauth-zh.md","docs/clients-xauth.md","docs/clients-zh.md","docs/clients.md","docs/ikev2-howto-zh.md","docs/ikev2-howto.md","docs/images/azure-deploy-button.png","docs/images/badges/docker-pulls.svg","docs/images/badges/docker-stars.svg","docs/images/badges/github-stars.svg","docs/images/linode-deploy-button.png","docs/images/routeros-get-cert.gif","docs/images/routeros-import-cert.gif","docs/images/script-demo.svg","docs/manage-users-zh.md","docs/manage-users.md","docs/uninstall-zh.md","docs/uninstall.md","docs/vpn-book-ja.md","docs/vpn-book-zh-Hant.md","docs/vpn-book-zh.md","docs/vpn-book.md","extras/add_vpn_user.sh","extras/del_vpn_user.sh","extras/ikev2changeaddr.sh","extras/ikev2onlymode.sh","extras/ikev2setup.sh","extras/update_vpn_users.sh","extras/vpnuninstall.sh","extras/vpnupgrade.sh","extras/vpnupgrade_alpine.sh","extras/vpnupgrade_amzn.sh","extras/vpnupgrade_centos.sh","extras/vpnupgrade_ubuntu.sh","vpnsetup.sh","vpnsetup_alpine.sh","vpnsetup_amzn.sh","vpnsetup_centos.sh","vpnsetup_ubuntu.sh"],"storefront":"/r/hwdsl2","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/hwdsl2/setup-ipsec-vpn/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}