Some days ago I started using Hulu, the new video star online, but, like many, I found the restriction imposed to users outside the United States, I live in Peru, rather annoying.

I started looking for solutions and found a few which I tested during one week. In this article I'll tell you about each and will guide you on setting up the one I think is the most convenient: your own VPN setup running on Ubuntu.

Your Options To Get Hulu Outside The US

Google quickly told me that using a virtual private network (VPN) with a server in the US would fit the bill for this problem. My connection would go thru the VPN and Hulu will see me as coming from a US based IP.

Hotspot Shield is perhaps the most known free VPN application for doing this these days, I tried it and it worked. Quite easy setup and I was using Hulu in just a couple of minutes.

The bad news? Hotspot Shield has a bandwidth limit per month, some say it's 10 Gb., shows ads and does not work in Linux. I really hate having to boot a Windows box just for using one application (World of Warcraft and iTunes are very special exceptions).

So, Hotspot Shield is option 1.

After a little more searching I found two paid services that offered Linux support: HotSpotVPN (afiliado) and WiTopia (both affiliate links). I tried HotSpotVPN, US$ 8.88 for one month of service, in Windows XP and it worked as advertised but they never replied to my email asking for instructions on setting up my Ubuntu laptop.

WiTopia has a US$ 39.99 per year plan, that's a really good price, but I didn't have enough funds in Paypal at the time and couldn't try. However I've read really good feedback about it.

That's option 2.

But a VPN is not good only for accessing limited-to-US-residents services like Hulu or Pandora (yeah, I missed that one too), it's much more. We'll learn about it while we review option 3: building our own VPN setup.

Ok, so let's see how to install OpenVPN on Ubuntu Gutsy.

What's a VPN

A virtual private network is a communications network tunneled through another network. In our case that other network is Internet. Setting up a VPN that uses a public network eliminates the costs of hiring dedicated private links.

But we all know that Internet is not a secure network and that's why a VPN must use authentication and content encryption to avoid packet sniffers (software or hardware that can intercept our traffic) getting in our way.

Maybe this VPS thing sounds like too much paranoia but with the increasing number of WiFi hotspots, most of them insecure, all over the world, I'm sure that many won't want their data to travel naked online.

We'll use OpenVPN, an open source application for running a VPN, on Ubuntu 7.10. These are the steps I followed to setup two of my computers in Lima, a laptop and a desktop, to one of my servers in New York and then navigate using the server's US based IP.

Even if I have more than a decade working with many kinds of networks I'm not a TCP/IP and securiy expert and can't provide support; however, I'm sure we'll have many readers aboard who will be able to help in the comments.

Install OpenVPN on Ubuntu Step by Step

Ok, we'll install OpenVPN on a client and a server, both running Ubuntu 7.10. I imagine the process is quite the same for other Linux distributions. Thanks to my buddies Javier Albarracín, Bruno Kamiche and César Villegas for the tips.

First let's make a few things clear:

• Server: the PC accepting connections of clients thru the VPN. For my examples the server will use the public IP x.y.z.w (replace with your own public IP) and will be named servo.
• Client: the PC connecting to the server thru the VPN. We'll call it cliento.
• Private network: it's the network we'll create for our VPN, we'll use 10.8.0.0 and our IP's will be like 10.8.0.1, 10.8.0.2, etc.
• All commands must be run under root or using sudo.
• What you must type appears in bold letters.
• To comment a line in your openvpn.conf file use # to start the line.

First let's install OpenVPN:

sudo apt-get install openvpn

OpenVPN must be installed in both client and server, the configuration file used for starting the service will define the role of each PC.

Comment all lines in /etc/default/openvpn and add:

AUTOSTART="openvpn"

This line tells OpenVPN which configuration file it should use by default when starting. Configuration files are in /etc/openvpn and use the .conf extension so the setting above points to /etc/openvpn/openvpn.conf, a file that still does not exist and we'll create.

Now we can start, stop or restart OpenVPN as usual, let's see:

Start OpenVPN:

/etc/init.d/openvpn start

Stop OpenVPN:
/etc/init.d/openvpn stop

Restart OpenVPN:
/etc/init.d/openvpn restart

Every time you change settings in /etc/openvpn/openvpn.conf you need to restart OpenVPN.

Create Keys and Certificates

Now we need to create security certificates and keys. We'll do all this in the server as root:

cd /etc/openvpn/

Copy the directory easy-rsa to /etc/openvpn:

cp -r /usr/share/doc/openvpn/examples/easy-rsa/ .

Remember we're still inside the /etc/openvpn directory. Now let's edit the file vars with our favorite editor (replace vi with yours):

vi easy-rsa/vars

Kaiman reported a change for this part after June 2008:

vi easy-rsa/2.0/vars

Comment this line:

#export D=`pwd`

Add this one:
export D=/etc/openvpn/easy-rsa

And modify as below:

export KEY_COUNTRY=PE
export KEY_PROVINCE=LI
export KEY_CITY=Lima
export KEY_ORG="Nombre-OpenVPN"
export KEY_EMAIL="tu-nombre@example.com"

Save and quit.

Now run:

. ./vars

Important: that's a period, a space and another period followed by /vars. This is a common confusion in many setups.

Now:
./clean-all

The next command creates your certificate authority (CA) using the parameters you just set, you should just add Common Name, I used OpenVPN-CA. For this step you'll need OpenSSL; if you don't have it in your server install it by running:

sudo apt-get install openssl

Ok, now we're ready:

./build-ca

Now let's create the keys, first the server:

./build-key-server server

This is important. When build-key-server asks for Common Name write server, the same parameter you provided to the command.

Also you'll need to answer yes to these two questions: Sign the certificate? [y/n] and 1 out of 1 certificate requests certified, commit? [y/n].

Now the key for the client:

./build-key client1

Use client1 as Common Name, the same parameter you used above for build-key.

You can repeat this step if you want to have more clients, just replace the parameter with client2, client3, etc.

Now let's create Diffie Hellman parameters:

./build-dh

There you are! Now you should have a new directory with your certificates and keys: /etc/openvpn/easy-rsa/keys. To configure your first client copy these files from servo to cliento:

ca.crt
client1.crt
client1.key

Ideally you should use a secure channel, I use scp with RSA authentication (topic for another article):

scp alexis@servo:ca.crt .
scp alexis@servo:client1.crt .
scp alexis@servo:client1.key .

These commands assume you've copied the files to the home of user alexis on the server and assigned read permissions. Then move the files to /etc/openvpn on the client.

The Configuration Files: openvpn.conf

Now go to your client and create openvpn.conf in /etc/openvpn. Write this inside:

dev tun
client
proto tcp
remote x.y.z.w 1194
resolv-retry infinite
nobind
user nobody
group nogroup

# Try to preserve some state across restarts.
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
comp-lzo

# Set log file verbosity.
verb 3

Replace x.y.z.w with your server's public IP.

Now in the server: create openvpn.conf in /etc/openvpn and put this:

dev tun
proto tcp
port 1194

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem

user nobody
group nogroup
server 10.8.0.0 255.255.255.0

persist-key
persist-tun

#status openvpn-status.log
#verb 3
client-to-client

push "redirect-gateway def1"

#log-append /var/log/openvpn
comp-lzo

My first connections were a little slow so I disabled compression with this:

#comp-lzo

Finally, configure IP forwarding and IPTables for doing NAT on the server:

echo 1 > /proc/sys/net/ipv4/ip_forward

sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

You can verify the rule was written correctly with:

sudo iptables -L -t nat

If you have a firewall you should make sure your VPN traffic can be routed.

If you made a mistake and want to remove all rules from IPTables:

sudo iptables -F -t nat

Now restart OpenVPN in both client and server and you should be set.

Running ifconfig and route -n you should see a new interface, tun0, in both PC's.

Confirm you can connect with a ping to your new tun0 interfaces, for example:

ping 10.8.0.1

Now your client is connected to your server using OpenVPN, you can navigate secure using your server's IP and say hi to Hulu and Pandora.

Good luck!

Additional Resources

• OpenVPN QuickStart
• Help for OpenVPN on Ubuntu
• Help for IPTables on Ubuntu

Trackback URL for this post:

http://ventanazul.com/webzine/trackback/100