A Dead Simple VPN.
DSVPN is a Dead Simple VPN, designed to address the most common use case for using a VPN:
[client device] ---- (untrusted/restricted network) ---- [vpn server] ---- [the Internet]
On Raspberry Pi 3 and 4, use the following command instead to enable NEON optimizations:
env OPTFLAGS=-mfpu=neon make
Alternatively, if you have zig installed, it can be used to compile DSVPN:
On macOS, DSVPN can be installed using Homebrew:
brew install dsvpn.
DSVPN uses a shared secret. Create it with the following command:
dd if=/dev/urandom of=vpn.key count=1 bs=32
And copy it on the server and the client.
If required, keys can be exported and imported in printable form:
base64 < vpn.key echo 'HK940OkWcFqSmZXnCQ1w6jhQMZm0fZoEhQOOpzJ/l3w=' | base64 --decode > vpn.key
sudo ./dsvpn server vpn.key auto 1959
Here, I use port
1959. Everything else is set to the default values. If you want to use the default port (
443), it doesn't even have to be specified, so the parameters can just be
sudo ./dsvpn client vpn.key 220.127.116.11 1959
This is a macOS client, connecting to the VPN server
1959. The port number is optional here as well. And the IP can be replaced by a host name.
You are connected. Just hit
Evaggelos Balaskas wrote a great blog post walking through the whole procedure: A Dead Simple VPN.
He also maintains systemd service files for DSVPN. Thank you Evaggelos!
If you were previously using a DNS resolver only accessible from the local network, it won't be accessible through the VPN. That might be the only thing you may have to change. Use a public resolver, a local resolver, or DNSCrypt.
Or send a pull request implementing the required commands to change and revert the DNS settings, or redirect DNS queries to another resolver, for all supported operating systems.
dsvpn "server" |"auto" |"auto" |"auto" |"auto" "auto" |"auto"
dsvpn "client" |"auto" |"auto" |"auto" |"auto" |"auto"
serveron the server, and
192.168.192.254for the server, and
192.168.192.1for the client. These values will be used if you put
autofor the local and remote tunnel IPs.
netstat -rnwill tell you (
If all the remaining parameters of a command would be
auto, they don't have to be specified.
I needed a VPN that works in an environment where only TCP/80 and TCP/443 are open.
WireGuard doesn't work over TCP.
GloryTun is excellent, but requires post-configuration and the maintained branch uses UDP.
I forgot about VTUN-libsodium. But it would have been too much complexity and attack surface for a simple use case.
OpenVPN is horribly difficult to set up.
Sshuttle is very nice and I've been using it a lot in the past, but it's not a VPN. It doesn't tunnel non-TCP traffic. It also requires a full Python install, which I'd rather avoid on my router.
Everything else I looked at was either too difficult to use, slow, bloated, didn't work on macOS, didn't work on small devices, was complicated to cross-compile due to dependencies, wasn't maintained, or didn't feel secure.
TCP-over-TCP is not as bad as some documents describe. It works surprisingly well in practice, especially with modern congestion control algorithms (BBR). For traditional algorithms that rely on packet loss, DSVPN couples the inner and outer congestion controllers by lowering
TCP_NOTSENT_LOWATand dropping packets when congestion is detected at the outer layer.
The cryptographic primitives used in DSVPN are available as a standalone project: Charm.
This is not intended to be a replacement for GloryTun or WireGuard. This is what I use, because it solves a problem I had. Extending it to solve different problems is not planned, but feel free to fork it and tailor it to your needs!