Which VPN Server Software is Best for Running Virtualmin Behind a VPN?

Virtualmin
1
SYSTEM INFORMATION
Usermin Version 2.102
Virtualmin Version 7.20.2 Pro
Theme Version 21.20.7
Nginx Version 1.22.1

I hate having to change IP addresses if my ISP goes down for too long and I need to switch internet connections. Because of this, I used to run my server behind a (open)VPN(server), I have a VPS hosted by a third party, so I can put anything I want on it.

My question:
What is the most compatible solution with Virtualmin where I can just install, add details, or upload a config file in Virtualmin and be done with it?

2

Are you saying you want to add VPN software to your Virtualmin server?

I see this:

image
image350Ɨ245 11.8 KB

When clicked on:
image
image1048Ɨ195 12.1 KB

But:
image
image473Ɨ157 7.57 KB

3

Not quite. Iā€™m more asking about whatā€™s the best setup for the VPS. Should I stick with OpenVPN and just install the client on Virtualmin via CLI?

4

Virtualmin has nothing to do with VPNs or lower-level network details. You can run whatever VPN you want and you can configure networking however you like, Virtualmin doesnā€™t have any opinion on the matter (though if youā€™re using Virtualmin to manage DNS, it needs to know the public IP for records, and if the IP of the interface on the Virtualmin server will change sometimes, youā€™ll need to use * for VirtualHosts or do something about automatically updating the IP in Apache when the IP changes).

5

Jeet, not everyone uses Apacheā€¦ :wink: Iā€™ve told you this before, but of course, you canā€™t remember anything, haha!

Yes, I use BIND DNS, but what exactly do you mean? Hereā€™s what Iā€™m thinking:

  1. Set up an OpenVPN client on the Virtualmin server.
  2. On the VPN server, configure port forwarding to route necessary traffic (e.g., HTTP, HTTPS, SSH) from the VPNā€™s WAN IP to the Virtualmin server.
  3. Assign the static VPN IP as the nameserver (NS) value for the domains in OpenProvider.

This way, thereā€™s no more IP changeā€”no matter what happens with the ISP, the VPN IP becomes the serverā€™s consistent WAN IP address.

Does this approach make sense?

6

So I have setup my vpn server to portforward every necessary port, also connected the vpn using the right profile so it gets the right local ip towards the vpn server. Howeverā€¦ if I go to the vpn ip x.x.x.x.x:1000 or whatever port it still shows as closed, virtual min. sees the correct ā€˜outsideā€™ ip adres.

7

If you have a ā€˜stockā€™ Virtualmin install, port 10000 should be open on the machine.

root@main:~# netstat -ap |grep webmin
tcp        0      0 0.0.0.0:webmin          0.0.0.0:*               LISTEN      1854/perl           
tcp        0      0 somedomain.com:webmin syn-173-091-209-0:35996 ESTABLISHED 1032176/perl        
tcp6       0      0 [::]:webmin             [::]:*                  LISTEN      1854/perl           
root@main:~# grep webmin /etc/services 
webmin          10000/tcp
8

I think virtualmin is designed more to be public facing.

I use wireguard on my router.

if you have a VPS you can run virtualmin natively public facing and then install wireguard to have a VPN on it.

There are also several admin web-uis on github. or wg-easy.

My hope is that one day we get a Webmin module for wireguard VPN.

wireguard is simpler and much faster in establishing a connection compared to openvpn.

9

Virtualmin has a ā€œDynamic IP Updateā€ feature under ā€œAddresses and Networking,ā€ but itā€™s not that reliable. PureVPN offers static IPs with port forwarding. But, the easiest option is to ask your ISP for a dedicated IP address, which typically costs around $5 per month.

10

lol, not in the US. My cable internet provider doesnā€™t offer a static address on anything less than an enterprise plan that is several hundred dollars a month.

1 Like
11

Yeah, I should have mentioned ā€œif the ISP supports itā€ in the first place.

13

Same situation here. I do have a static IP, but the issue is that thereā€™s downtime with my main connection, so Iā€™m currently relying on my 4G modem. I need the quickest and easiest way to connect my VPN server to any protocol, as long as I can easily forward the ports and get back online. Iā€™ve tried using the swan stuff, but it refuses to port forward via iptables. I hate that stuffā€”setting it up is such a pain, but once itā€™s runningā€¦ Does anyone have suggestions or a solution I can simply copy and paste? Please send me a small tutorial, Iā€™m running out of hair to pull out of my head.

14

CG-NAT is terrible these days.

Thats why the sooner we move to IPV6 the better. No more NATing and no shortages of IPs.

Luckily my local power company is my FTTH ISP and up until the large network expansion for new development buildings recently, it always felt more like a side gig in a good way.

They gave me a free static IPv4 and IPv6 /56, and allowed me to have reverse DNS PTR record for mail.

I was also allowed to be unlocked from the supplied modem and can run any router directly off the wall outlet, DHCP and good to go.

The great thing about virtualmin is also that it detects local IP but automagically sets the correct DNS for the public IP.

But anyway, I think I would just get a data center VPS for reasonable budget and not have to deal with all that mess if I were on dynamic ip or CG NAT.

There are so many good KVM offers these days where you dont get any quota errors in virtualmin or need TUN/TAP for VPN.

15

is what Im going forā€¦ On indeed my datacenter vpsā€¦ any setup suggestions?

16

i have installed wg easy now how to port forward? ip tables or what do you suggest?

17

You donā€™t have to open any port for Wireguard on Virtualmin machine if you want.
Have a Wireguard setup on your home router and open 13231 (default)
Have the Wireguard from Virtualmin machine connect to the Wireguard at your home.
Now, if you have a road-warrior like a laptop, connect that to your home router also via Wireguard and from there, you can access the Virtualmin machine also.

18

What you are referring to is a VPN in the local office. However, what I have here is an external VPS server running VPN software. On that VPN software, I need to open ports to access the 10.x.x.x IP range. I have tried multiple VPN servers and configurations with iptables , but I havenā€™t had any success so far

19

If this is a stock virtualmin install firewalld will be handling the firewall so all changes should be made to firewalld, I like you could not get the vpn server to work untill I disabled firewalld and set the rules up directly in the iptables module

20

Thatā€™s not useful since if you forward the ports on the vpn server it should also be picked up by firewalld since it is the same portā€¦

21

Dunno why but it did not work until firewalld was disabled so it was useful for me

1 Like