Generate Secure VPN Setup Scripts

This skill writes secure, automated VPN setup scripts for OpenVPN, WireGuard, IPSec, and L2TP across Linux distributions, covering security-first configuration (AES-256-GCM or ChaCha20-Poly1305 ciphers, certificate-based authentication, perfect forward secrecy, firewall rules and IP forwarding, secure random key generation) and cross-platform compatibility (Ubuntu, CentOS, Debian, handling apt/yum/dnf package-manager differences and systemd versus init systems).

The OpenVPN server-installation script detects the OS, installs openvpn/easy-rsa, sets up a PKI via easyrsa init-pki, build-ca, gen-dh, and build-server-full, and generates a TLS-auth key with openvpn --genkey secret pki/ta.key. The server configuration sets cipher AES-256-GCM, auth SHA256, a 10.8.0.0/24 VPN subnet, and pushed DNS/redirect-gateway options. The WireGuard server setup installs the wireguard package, generates a keypair with wg genkey | tee privatekey | wg pubkey > publickey, detects the server's public IP and interface, and writes a wg0.conf with PostUp/PostDown iptables rules for NAT masquerading. A client-generation function creates a per-client keypair, appends a [Peer] block to the server config, and writes a client configuration file:

[Interface]
PrivateKey = $CLIENT_PRIVATE_KEY
Address = $CLIENT_IP/24
DNS = 8.8.8.8

[Peer]
PublicKey = $SERVER_PUBLIC_KEY
Endpoint = $SERVER_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Firewall configuration enables IP forwarding and applies iptables rules accepting the VPN port and tunnel interface traffic, forwarding established connections, and masquerading outbound NAT traffic, saved via iptables-save or the iptables service. Certificate-management best practices call for unique per-client certificates, certificate revocation lists (CRLs), 4096-bit RSA minimum key sizes, regular rotation, and securely permissioned private keys. Performance tuning sets net.core.default_qdisc = fq and net.ipv4.tcp_congestion_control = bbr along with enlarged TCP buffer sizes. Additional operational scripts cover status monitoring (checking whether OpenVPN or WireGuard is active and reporting connected clients), automated timestamped backups of /etc/openvpn and /etc/wireguard as a tarball, and connection-testing (DNS resolution, internet connectivity via ping, and external-IP checks for leak detection).

Use it when scripting automated OpenVPN or WireGuard server setup, client provisioning, firewall/NAT configuration, or VPN monitoring and backup. It is not a manual, GUI-based VPN client setup guide - it is scoped to scripted, server-side VPN deployment and administration.

Given a target Linux server and a VPN protocol choice, it produces an OS-aware installation script, server and client configuration files, firewall/NAT rules, and monitoring, backup, and connection-testing scripts.

Targets OpenVPN (with easy-rsa PKI) and WireGuard (wg/wg-quick) on Ubuntu, CentOS, and Debian, using iptables/sysctl for networking and systemd for service management.

System administrators and infrastructure engineers automating secure VPN server deployment on Linux.