FAQ

How can I report a bug or get help?

You can ask for help or report an issue at https://github.com/in4it/vpn-server.

How can I check whether the VPN works?

You can ping the VPN server using the VPN IP address. In a terminal, enter the command:

ping 10.189.184.1

How can I route specific subnets?

Use the ClientRoutes setting on the VPN settings page to specify the default route the client should use.

What is the default IP range used for the VPN?

The default IP range is 10.189.184.0/21. The VPN Server will always use the first non-network IP address in the range, which is 10.189.184.1. If you want to change this IP range, you can edit the configuration files directly. The IP range is defined in /vpn/config/vpn-config.json. We aim to make all configuration parameters available as options in the admin UI, but this is not the case yet.

When making changes to the client configuration files, make sure to restart the VPN using systemctl restart vpn-configmanager and systemctl restart vpn-rest-server.

When making changes to the server configuration, use wg-quick down vpn to first bring down the existing VPN, then run systemctl restart vpn-configmanager and systemctl restart vpn-rest-server.

Where can I make changes to the VPN Server or Client configuration file?

You can change the client and server configuration templates in the admin UI under VPN Setup → Templates. The templates are stored in /vpn/config/templates/. After editing the files directly, make sure to restart the VPN using systemctl restart vpn-configmanager and systemctl restart vpn-rest-server.

The server template supports the WireGuard® interface and peer settings (e.g. Address, ListenPort, MTU, PrivateKey). The PostUp and PostDown commands are generated by the VPN Server (the NAT rules), and other commands are not supported. See the next question if you get an error about unsupported settings.

The server template contains unsupported settings

Since v1.1.21, the server template can't contain custom PreUp, PostUp, PreDown or PostDown commands, SaveConfig, Table or DNS. Only the PostUp/PostDown NAT rules of the default template are supported. If your server template contains other commands, you'll see the error custom PreUp/PostUp/PreDown/PostDown commands are not supported in the server template when saving the template or when restarting the VPN in the admin UI. The VPN keeps running with the last working configuration until the template is fixed.

To fix it:

  1. Log in to the admin UI and go to VPN Setup → Templates.
  2. In the server template, remove the PreUp/PostUp/PreDown/PostDown lines you added, and any SaveConfig, Table or DNS lines. Keep (or restore) the NAT rules of the default template:
{{if not .DisableNAT }}
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o {{ .ExternalInterface }} -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o {{ .ExternalInterface }} -j MASQUERADE
{{end}}
  1. Save the template. The save succeeds once the template only contains supported settings.
  2. Go to VPN Setup → Restart VPN (or run systemctl restart vpn-configmanager over SSH) to apply the configuration.

If you need extra firewall rules or routes, configure them on the instance itself, for example with iptables-persistent or a systemd service, instead of in the server template. You can check the status of the VPN service with journalctl -u vpn-configmanager.

The Copy button does not work on the Authentication & Provisioning page

The copy feature only works if the VPN Server is using HTTPS, as browsers only allow clipboard access in a secure context. OpenID Connect (OIDC) callback URLs also often have to use HTTPS. If you intend to use the Authentication & Provisioning features, enable TLS (HTTPS) on the VPN setup page.