Oracle VPN Transcript

[Required Software]
PuTTY: https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
OpenVPN GUI: https://openvpn.net/community-downloads/
WinRAR: https://www.rarlab.com/download.htm
or
7-Zip: https://www.7-zip.org/download.html


[Create Oracle Cloud Account]
https://signup.cloud.oracle.com/


[Setup VCN]
Top Left 3 Horizontal Bars
Click Networking -> Virtual Cloud Networks
Click: Create VCN
Name: vcn1
IPv4 CIDR Blocks: 10.0.0.0/16 [press return]
IPv6 Prefixes: Select "Assign an Oracle allocated IPv6 /56 prefix."
Click: Create VCN


[Setup VCN > Subnet]
Click: Create Subnet
Name: subnet1
Subnet Type: Regional
IPv4 CIDR Block: 10.0.0.0/30
IPv6 Prefixes: Select "Assign an Oracle allocated IPv6 /64 prefix."
Oracle allocated IPv6 address: 00
Route Table Compartment: Select default
Subnet Access: Public
Dhcp Options: Select default
Security Lists: Select default
Click: Create Subnet


[Setup VCN > Gateway]
Under Resources on the left, click: Internet Gateways
Click: Create Internet Gateway
Name: gateway1
Click: Create Internet Gateway


[Setup VCN > Routes]
Under Resources on the left, click: Route Tables
Click: Default Route Table for vcn1
Click: Add Route Rules
Protocol Version: IPv4
Target Type: Internet Gateway
Destination CIDR Block: 0.0.0.0/0
Target Internet Gateway: gateway1
Click: Add Route Rules
Click: Add Route Rules
Protocol Version: IPv6
Target Type: Internet Gateway
Destination CIDR Block: ::/0
Target Internet Gateway: gateway1
Click: Add Route Rules


[Setup VCN > Firewall]
On the Navigation Path at the top, Click: vcn1
Under Resources on the left, click: Security Lists
Click: Default Security List for vcn1
Click: Add Ingress Rules
-- Allow Webmin
Source Type: CIDR
Source CIDR: 0.0.0.0/0
IP Protocol: TCP
Destination Port Range: 10000
Click: Add Ingress Rules
Click: Add Ingress Rules
-- Allow OpenVPN (IPv4)
Source Type: CIDR
Source CIDR: 0.0.0.0/0
IP Protocol: UDP
Destination Port Range: 1194
Click: Add Ingress Rules
Click: Add Ingress Rules
-- Allow OpenVPN (IPv6)
Source Type: CIDR
Source CIDR: ::/0
IP Protocol: UDP
Destination Port Range: 1194
Click: Add Ingress Rules


[Create VM]
Top Left 3 Horizontal Bars
Click Compute -> Instances
Click: Create Instance
Name: Whatever you want
Placement -> Click: Edit
-- Placement Domain
Select the domain you want (Note for AMD free instances you need domain 1)
Image and shape -> Click: Edit
Click: Change image
Select: Canonical Ubuntu
Click: Select image
Click: Change shape
Select: whatever you want, I select VM.Standard.A1.Flex [Always Free-eligible] Ampere 1xOCPU 6GB RAM
Click: Select shape
Add SSH keys
Select: Generate a key pair for me
Click: Save private key (save it in your VPS folder)
Click: Save public key (save it in your VPS folder)
Select: Specify a custom boot volume size
Boot volume size (GB): 50
Use in-transit encryption: Do not select
Click: Create
Note: You may get an error message in red at the bottom. If this happens, try again.
If it keeps happening select another placement domain and try again.



[Instance > Add IPv6 addresses]
Under Resources on the left, click: Attached VNICs
Click the name of the VNIC (same as instance name) in the table at the bottom.
Under Resources on the left, click: IPv6 Addresses
Click: Assign IPv6 Address
Prefix: Select the prefix from the drop down (should be only 1)
Select: Manually assign IPv6 addresses from prefix
IPv6 Address: Enter :1:1
Click: Assign
Click: Assign IPv6 Address
Prefix: Select the prefix from the drop down (should be only 1)
Select: Manually assign IPv6 addresses from prefix
IPv6 Address: Enter :1:2
Click: Assign
Repeat this process up to :1:f


[Create an Info File]
In your VPS folder create a new Text Document called info.txt
Edit info.txt
Enter the IPv4 Public and Private address
Enter the IPv6 Prefix
Create a secure password and Enter this too.


[Log into Instance]
Open PuTTYgen
Load an existing private key file -> Click: Load
-- Convert Private Key
Change from PuTTY Private Key Files  to  All Files
Open the .key (NOT the .key.pub) file you saved during the instance setup
Save the generated key -> Click: Save private key
Select "Yes" when prompted to save without a passphrase
Give the key a name with a .ppk extension (such as oracle.ppk)
Click: Save
-- Log into Instance
Using File Explorer Navigate to C:\Program Files\PuTTY
Locate the main PuTTY executable, right click it and select: Copy
Navigate to your VPS folder and right click in empty space, select: Paste shortcut
Rename the shortcut to whatever you want, I rename it to "SSH to Oracle VPS".
Right click the shortcut and select: Properties
In 'Target' you should see "C:\Program Files\PuTTY\putty.exe"
Change this to "C:\Program Files\PuTTY\putty.exe" ubuntu@[publicIPv4] -i oracle.ppk
In 'Start in' you should see "C:\Program Files\PuTTY"
Change this to the same folder as your VPS folder, mine is on my desktop.
Click: OK
Double click the shortcut and accept the certificate warning.
You should now be logged in.



[Set root/user passwords]
In your info.txt file copy the secure password you created to the clipboard
In the shell enter: sudo passwd
When asked for new password, right click in the window and press return
When asked to retype password, again right click in the window and press return
In the shell enter: sudo passwd ubuntu
When asked for new password, right click in the window and press return
When asked to retype password, again right click in the window and press return



[Update/Upgrade]
In the shell enter: sudo apt update
In the shell enter: sudo apt upgrade
Enter: y
pink screen, press return
press tab until <OK> is highlighted, press return


[Enable Packet Forwarding]
In the shell enter: sudo nano /etc/sysctl.conf
remove the # from the lines:

#net.ipv4.ip_forward=1
#net.ipv6.conf.all.forwarding=1

press: CNTL-X then Y then Return


[Edit main openssl config]
In the shell enter: sudo nano /etc/ssl/openssl.cnf
scroll down until you see: default_days    = 365
Change lines to the following

default_days    = 3650
default_crl_days= 3650
default_md      = sha512

press: CNTL-X then Y then Return


[Install openvpn]
In the shell enter: sudo apt install openvpn
Enter: y


[Install Webmin]
Go to: https://www.webmin.com/deb.html
Copy the wget line from the webpage and paste (right click) into PuTTY
Copy the dpkg line from the webpage
In the shell enter: sudo (put a space after sudo)
Paste (right click) the dkpg line into PuTTY
You should eventually see some dependency problems, ignore this



[Edit Webmin openssl config]
In the shell enter: sudo nano /usr/share/webmin/acl/openssl.cnf
scroll down until you see: default_days    = 365
Change lines to the following

default_days    = 3650
default_crl_days= 3650
default_md      = sha512

press: CNTL-X then Y then Return


[Install dependencies]
In the shell enter: sudo apt install -f
Enter: y


[Edit iptables file]
In the shell enter: sudo nano /etc/iptables/rules.v4
Find the line:
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
After this line add the following two lines

-A INPUT -p tcp -m state -m tcp --dport 10000 --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT

press: CNTL-X then Y then Return


[Reboot Instance]
In the shell enter: sudo reboot
Log back in after reboot.


[Log into Webmin]
In your VPS folder, right click on empty space and select: New -> Shortcut
For Location of item enter: https://[publicIPv4]:10000
Click: Next
Give the shortcut a name, anything you like. I used 'Webmin on Oracle'
Double Click the shortcut
-- Logging In
Accept the security risks (self-signed certificate)
For Username & Password use root and the password you created previously in info.txt


[Add OpenVPN Webmin Module]
On the left panel, select: Webmin -> Webmin Configuration
Click: Webmin Modules
Select: From HTTP or FTP URL
In the box enter: https://github.com/nicsure/webmin-openvpn-debian-jessie/raw/master/openvpn.wbm.gz
Click: Install Module


[Edit OpenVPN module openssl config]
In the shell enter: sudo nano /usr/share/webmin/openvpn/openvpn-ssl.cnf
scroll down until you see: default_md      = sha256
Change this to: default_md      = sha512
press: CNTL-X then Y then Return


[OpenVPN Create CA]
On the left panel, select: Server -> OpenVPN + CA
Click: Certification Authority List
Name of Certification Authority: choose whatever you like, I used 'myca'
Click: Save (this can take a while so be patient)
Click: Return to OpenVPN Administration


[Server/Client keys]
Click: Certification Authority List
Click: Keys list
Key name: server1
Key Server -> Select: server
Click: Save
Click: Return to keys list...
Key name: oracle_v4
-- IPv4 Client Key
Key Server -> Select: client
Click: Save
Click: Return to keys list...
Key name: oracle_v6
-- IPv6 Client Key
Key Server -> Select: client
Click: Save


[Create VPN]
On the left panel, select: Server -> OpenVPN + CA
Click: VPN List
Click: New VPN Server
Name: Whatever you want, I used 'oraclevpn'
proto (Protocol) -> Select: udp6
Net IP assigns (option server):10.50.0.0  Netmask:255.255.255.0
Persist/unpersist...: yes
Allow multiple clients...: yes
Encrypt packets with cipher...: AES-256-GCM...
Use fast LZO...: no
User & Group set to: root
float...: yes
Additional Configurations -> Enter the following

ifconfig-ipv6 [your_ipv6_prefix]::1:1/124 ::
ifconfig-ipv6-pool [your_ipv6_prefix]::1:2/124
auth SHA512
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dhcp"
push "route-ipv6 2000::/3"

Click: Save


[Add Client Keys]
Click: Client List
Click: New VPN Client
Name -> Select: oracle_v4
-- IPv4
remote (Remote IP): [your_public_ipv4]
Use fast LZO compression: no
Additional Configurations: auth SHA512
Click: Save
Click: New VPN Client
Name -> Select: oracle_v6
-- IPv6
remote (Remote IP): [your_ipv6_prefix]::1:1
Use fast LZO compression: no
Additional Configurations: auth SHA512
Click: Save
On both oracle_v4 & oracle_v6 Click on 'Archive' and save the files to your VPS folder


[Install Client Key Bundle]
In Windows, start OpenVPN GUI application
Right click OpenVPN GUI's notification icon and select: Settings
Under 'Configuration Files' you will see 'Folder' and a box containing a file path
To the right of this there is a button, click it. A Folder browse dialog will open.
Now open one of the the Archive files you downloaded with WinRAR or 7-Zip
A window should open with a folder in it, drag this into the browse dialog
(Note: With 7-Zip it will show a .tar file, double click this to get the folder)
Repeat for the other Archive file.
Click Cancel


[Configure iptables]
In Webmin on the left panel, select: Networking -> Linux Firewall
Under 'Forwarded packets (FORWARD)' there is one Reject rule listed
Check the box to the left of this rule and click 'Delete Selected' underneath.
Showing IPtable: Network address translation (nat)
Packets after routing (POSTROUTING): Click 'Add Rule'
Action to Take: Source NAT
IPs and ports for SNAT
Select -> IP range: [privateIPv4] to [blank] Port range: [blank] to [blank]
Source address or network -> Equals: 10.50.0.0/24
Outgoing interface -> Equals: enp0s3
Click: Create
Click: Apply Configuration


[Adjust IPv4 Client Config]
Right click OpenVPN GUI's notification icon. Select: Settings
Click Advanced Tab
Click Browse Button next to Configuration Files > Folder
Right click Oracle_v4. Select 'Open in new Window'
Right click oracle_v4.ovpn. Select: Open with > Notepad

Change: proto udp6
to: proto udp

File Menu > Save
Close Notepad


[Reboot & Test]
In the shell enter: sudo reboot
Give it a minute or so to fully restart.
In Windows, right click the OpenVPN GUI notification icon.
Move to "oracle_v4" and select "Connect" from the sub-menu that opens.
If you have IPv6 connectivity you may also use "oracle_v6" to connect via IPv6


EXTRA INFORMATION
While testing I was relying on the OS auto-removing the assigned IPv6 addresses from the VNIC interface enp0s3. This behaviour seems to have changed (possibly some update) and these addresses are no longer being auto removed and thus causing IP conflicts prevent IPv6 VPN functionality working. The reason I have to assign them at all is because Oracle's system will not route any traffic to an instance unless the destination IP is actually assigned to that instance. While testing, these IPs were being auto-removed from enp0s3 because they conflicted with the static IPs assigned to the VPN, now this does not seem to be happening anymore. I had to implement a script to purge the V6 addresses from the interface as they are added. I couldn't find any other way of doing it, disabling DHCPv6 didn't work.

Here's the procedure to follow after following the installation video.

Log into SSH
Create a script : sudo nano /usr/sbin/v6purger

#!/bin/bash
ip -6 monitor address dev enp0s3 | while read word1 word2 word3 word4 word5; do
        if [[ "$word4" == *"/"* ]]; then
                ip -6 addr del $word4 dev enp0s3 >/dev/null 2>/dev/null
        fi
done

Press: CNTL-X then Y then Return to save the script
Make the script executable : sudo chmod +x /usr/sbin/v6purger
Create a system service unit : sudo nano /lib/systemd/system/v6purger.service

[Unit]
Description=Auto IPv6 Address Purger

[Service]
Type=simple
ExecStart=/bin/bash /usr/sbin/v6purger

[Install]
WantedBy=multi-user.target

Press: CNTL-X then Y then Return to save the file
Enable the service : sudo systemctl enable v6purger.service
Start the service : sudo systemctl start v6purger.service
Reboot instance: sudo reboot