VPN Enabler for Mavericks - Let a Thousand VPN Servers Bloom

I used this “enabler” app to set up a VPN Server on Mac OS X Mavericks before I went to China, so I can access Facebook, etc, from my iPhone and MacBook Air, while I was on WIFI networks in Chengdu, Sichuan. The iPhone or MacBook Air connects back to the VPN Server, which I’ll show how on the latter part of this page, and all interaction with the Internet from that point on goes through the local private network, on an encrypted channel, totally bypassing proxies and filters that may have been set up on public networks to deny access to sites like Twitter and Facebook.

As far as I can test myself, this VPN Server works well (wonderfully, if I may add :)

There is an VPN Server built into every plain Mac OS X machine, only it's not activated unless you know how to type in a lot of geeky commands and dive into a lot of configuration files. What VPN Enabler does is to do all that stuff for you in just three (OK, maybe four) steps and just one click.

Setting up the VPN Server

This is what VPN Enabler looks like. 

Step One. You only need to provide the Host Name for your VPN Server. Of course, this host name or domain name must be accessible from the Internet.

Then, look for the “Suggest IP Addresses” button. If you’re running VPN Enabler on the single machine on the local network, behind the router, that has all the Internet services loaded on it (e.g., web, mail & DNS server, all on one machine), which is quite a reasonable assumption for the user base that is running all my “enabler” apps, then when you click on that “Suggest IP Addresses” button, it’ll try to provide you with reasonable values that you can use.

These values are provided to an incoming VPN client, on joining the local private network. It'll be assigned an IP address within the range you provided, and then it’s told where to go for DNS services. Basically, the VPN Server acts like a DHCP Server for incoming VPN clients.

Step Two. Enter a Shared Secret, which is just a word you need to enter into a VPN client, like Network Preferences on a client Mac or the VPN Connection Setup in iOS Preferences for the iPhone or iPad.

Step Three. Set up at least one VPN user account on your server machine. Give it a name and a password. Both will also be given to the VPN Client.

Step Four. An Important Tech Note :

This is a bit more technical. If you’re running the VPN Server on a local network behind a router, you need to figure out how to set up the router to forward UDP ports 500, 1701 and 4500 to the local IP address of your VPN Server machine. 

This is not as difficult as it sounds. Your router (which might be bundled with a wifi base station) would have a setup page that you can access using a web browser. Look for the Port Forwarding setup page, which is probably lumped with the Firewall settings. Then use that setup page to create three port forwarding records to associate UDP ports 500, 1701, and 4500 with the local IP address of the Mac that is running your VPN Server. This way, when network traffic comes in from a VPN client, the router will know which machine to route them to for processing.

Setting up the VPN Clients

1. The Automated Way

From version 1.0.3 onwards, VPN Enabler allows you to save a mobileconfig profile that can be sent (e.g., by email) to the user of both an iOS device or the Mac, and it’ll save the user from having to know all of the following configuration steps for a VPN client. All the user has to do is to tap on the .mobileconfig file that he sees (if he’s on iOS) or to double-click on it (if he’s on a Mac), and follow through with the automated installation steps. He’ll have everything set up for him and all he has to do is to make the VPN connection (in the Settings app, on iOS) or via Network Preferences (on the Mac).

VPN Enabler gives the administrator two ways to generate a .mobileconfig file. One way generates a profile without the VPN user password, and this is available from the main VPN Enabler window. The other way is more convenient, because it includes the password, allowing the user to just focus on making the VPN connection. This other way is available when the user is either creating a new VPN user account or resetting the user account password, and it’s shown below :

On top of saving the profile, the administrator is also encouraged to sign the profile, if the server VPN Enabler is running on has the SSL cert for the domain installed (in OS X’s OpenSSL folder in /System/Library).

2. Manually Setting up VPN Clients

On the Mac client, set up your VPN configuration like this in Network Preferences, by entering the VPN Server’s host name and the VPN user account name :

Click the "Authentication Settings" button and enter the VPN User account password and the Shared Secret :

And click the Advanced… button to set the “Send all traffic over VPN connection” option:

For iOS clients, look for Settings > General > VPN. Add a VPN Configuration:

and, in the Add Configuration panel, do this:

And that’s all there is to it. Enjoy!

De-Installing VPN Enabler

You can de-install VPN Enabler by using the last menu item in the Help menu. It will shut down the VPN Server, if it is running, and remove all files installed by VPN Enabler (in /usr/local/cutedge/vpn).

Release Log

1.0 December 18th 2013. VPN Enabler for Mavericks released.

1.0.1 December 19th 2013. Added a “Suggest IP Addresses” button.

1.0.2 March 21st 2014. VPN Enabler can now save a configuration profile for each VPN user. This user.mobileconfig file can be sent to the user’s mobile device—iPhone, iPad, MacBook, etc.—and it’ll configure the user’s access to the VPN Server automatically. All the user needs to do is to enter his VPN user password, as it was set up by the VPN administrator in VPN Enabler. (He doesn’t even need to select the “Send all traffic over VPN connection” because even that is set correctly by the .mobileconfig file.)

1.0.3 March 25th 2014. VPN Enabler can now save a signed mobileconfig profile, if the server it is running on has an SSL cert for the domain. It can also save the account password into the profile, if the profile is created while the user account is being newly created or having its password reset.

Download

VPNEnabler.zip