A recent survey has discovered that two out of three millennials use ad blocker software when browsing the internet on their desktop or 

Ad Blocker software brings benefits such as blocking intrusive adverts on web pages, stopping videos cutting to adverts and reducing popups

Ad blockers are available as an add-on on most browsers and are often a completely free piece of software.

 report asked 2,700 US based young people aged 18 to 24 about their web habits.

The results contrast sharply with the rest of the population, where only 15% of people in the US use ad blocker software. The report, therefore, suggested that ad blocking has become an ‘established social norm’ among young millennials.

When asked why they used ad blockers, the main reason given was to improve their user experience when online.

43% of those surveyed said they used an ad blocker to avoid intrusive ads and 21% said they wanted to speed up their browsing. On the other hand, only 17% said they used ad blockers to protect their online privacy.

Specifically, the survey found that millennials really hated video advertisements, such as those played before and during 

Of course, while it seems like using an ad blocker is a harmless pursuit, it does pose a challenge to many blogs and websites who rely on adverts to keep themselves afloat.

UK phone network Three was banned from providing a network-wide ad blocking service

. This service would have automatically blocked adverts from appearing on sites accessed by users of Three’s network.

With the continued refusal of many web users to pay for online material, websites often rely on adverts to keep themselves going.

The results of this survey and the seeming acceptance of ad blocking software will certainly be worrying for these websites.

Ad Blocker use soaring amongst millennials

If you’ve recently found some public proxies or even paid proxies you may want to test to see if they’re working correctly.

The quickest and easiest way to do this is with using the cURL cli binary on OSX (or any linux distro).

HTTP, HTTPS, SOCKS4, SOCKS4a & SOCKS5 proxy protocols using just a few commands.

In this tutorial I will assume you have access to a

Copy all of your proxies into a file, in this case we will paste them all into a file called “usa.txt”

209.205.211.251:2000
209.205.211.251:2001
209.205.211.251:2002
209.205.211.251:2003
209.205.211.251:2004
209.205.211.251:2005
209.205.211.251:2006
209.205.211.251:2007
209.205.211.251:2008
209.205.211.251:2009
209.205.211.251:2010
209.205.211.251:2011
209.205.211.251:2012
209.205.211.251:2013
209.205.211.251:2014
209.205.211.251:2015
209.205.211.251:2016
209.205.211.251:2017
209.205.211.251:2018
209.205.211.251:2019

Using your favourite text editor (vim/nano/etc) create your shell script file in this case we will call it test_usa.sh

Here are the seperate scripts for each protocol

for proxy in `cat usa.txt`
do 
   (curl -s --max-time 10 -x $proxy -U YOURUSER:YOURPASS ip-api.com/json;echo) & 
done | grep country | wc -l

for proxy in `cat usa.txt`
do 
   (curl -s --max-time 10 -x https://$proxy -U YOURUSER:YOURPASS ip-api.com/json;echo) & 
done | grep country | wc -l

for proxy in `cat usa.txt`
do 
   (curl -s --max-time 10 --socks4 $proxy ip-api.com/json;echo) & 
done | grep country | wc -l

for proxy in `cat usa.txt`
do 
   (curl -s --max-time 10 --socks4a $proxy -U YOURUSER:YOURPASS ip-api.com/json;echo) & 
done | grep country | wc -l

for proxy in `cat usa.txt`
do 
   (curl -s --max-time 10 --socks5 $proxy -U YOURUSER:YOURPASS ip-api.com/json;echo) & 
done | grep country | wc -l

There is a max execution time of 10 seconds to prevent the proxy from never timing out.

Once it is completed it will output a number into your console and this is the number of successful requests it was able to complete

It wouldn’t be hard to create a much more advanced script that takes parameters and all that jazz but this is a simple, easy solution that most people can understand more importantly simply copy + paste to get going.

How it works (if you’re new to bash shell scripting)

This is a for loop and every new line it reads it stores it in the variable $proxy

? This command reads a file and outputs it into your terminal

This is the syntax we need to create the for loop (bash is really quite like reading english)

command line with our $proxy (the line we just read)

Parameter is setting silent mode otherwise we get a bunch of ambigious text on our screen from the multi-threaded approach

This sets the max time for our request to load the page ip-api.com/json

symbol sends our command into the background and moves onto the next part of the loop, thus creating our async / multi-threaded approach

   (curl -s --max-time 10 -x $proxy -U YOURUSER:YOURPASS ip-api.com/json;echo) & 


then echos/prints only if we find the text string “country” from the page we loaded (only successful page loads would be counted)

This command counts how many of these instances we find of the above

This is probably not the most in depth explanation you’ll find on these single commands but hopefully it gives you a better understanding. If you genuinely want a further explanation of these commands or want to ask me a question just write below in the comments and I’ll see how I can assist 🙂

How to test proxies using bash and cURL with multi-threaded async requests

In this tutorial I am going to show you how to setup a Double OpenVPN which is essentially the process chaining VPN servers to create a different exit point / IP address than the original connection.

This is a relatively easy process but there’s very little information out there on how to achieve this or it’s overly complicated. We will do this in the simplest and easiest way that I know possible.

*This tutorial will assume you already know how to setup a basic

I may do a more in depth tutorial later but I feel that people who want to create a Double OpenVPN tunnel have already passed basic training on

Why would we want to create a Double OpenVPN configuration?

Every one has their own reasons but my reason for creating this configuration is that I want to have an exit IP in the USA but my ping is too high and the routing to the USA isn’t too good so I create a first hop in Tokyo or Singapore which then connects to my USA server.

I will assume you already have setup a OpenVPN server and have root access.

The second OpenVPN server we do not require access to 😉

If we look at our ifconfig we can see that tun0 (our local OpenVPN server) has internal IP address of 108.61.168.1

root@test-vpn-double:/etc/openvpn# ifconfig
ens3      Link encap:Ethernet  HWaddr 56:00:00:32:7b:2b  
          inet addr:108.61.168.153  Bcast:255.255.254.0  Mask:255.255.254.0
          inet6 addr: fe80::5400:ff:fe32:7b2b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:122189 errors:0 dropped:0 overruns:0 frame:0
          TX packets:134190 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:88730666 (88.7 MB)  TX bytes:21559674 (21.5 MB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:10 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:500 (500.0 B)  TX bytes:500 (500.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:108.61.168.1  P-t-P:108.61.168.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)



Now instead of normally adding the IP table MASQUERADING rule we want to add an IP routing rule instead.

ip route add default via 108.61.168.1 dev ens3 table 102

Now let’s add the following 3 iptables rules:

iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun1 -j MASQUERADE
iptables -t mangle -A OUTPUT -p udp -m udp --sport 80 -j MARK --set-mark 0x2

Port 80 is our local port OpenVPN is listening on

ip rule add fwmark 0x2/0x2 lookup 102
ip rule add from 108.61.168.153 table 102

Now we need to connect to our second OpenVPN server, in this case we will use the program screen

Now assuming our second OpenVPN servers connection config is called “second.ovpn” we will connect to it here

You can then disconnect from your screen session by pressing

If everything went correctly you should just be able to connect to your OpenVPN server and all traffic will be routed over a second hop (server).

How to setup a Double OpenVPN configuration

So you have purchased a paid or found a free SOCKS server but your software requires a HTTPS proxy, here is how you can convert it to work with HTTP & HTTPS proxy protocols.

In this quick tutorial we will be using the free software available on http://www.delegate.org/delegate/

DeleGate is a general purpose proxy server that supports HTTP, HTTPS, SOCKS4, SOCKS4a and SOCKS5 protocols.

You can do much more than just host a “proxy server” with DeleGate, you can also relay other proxies and convert protocols with full ACL (access control list) support.

A full list of supported functionality can be found here: http://www.delegate.org/delegate/Manual.shtml

To convert your SOCKS proxy into a HTTP(S) proxy do the following:

Choose your binary (already compiled) distribution from this URL:

http://delegate.hpcc.jp/anonftp/DeleGate/download.html

We will be installing it on an Ubuntu server so we will choose the

wget "http://delegate.hpcc.jp/anonftp/DeleGate/bin/linux/latest/linux2.6-dg9_9_13.tar.gz"

--2016-09-21 01:50:19--  http://delegate.hpcc.jp/anonftp/DeleGate/bin/linux/latest/linux2.6-dg9_9_13.tar.gz
Resolving delegate.hpcc.jp (delegate.hpcc.jp)... 163.220.3.3
Connecting to delegate.hpcc.jp (delegate.hpcc.jp)|163.220.3.3|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3018925 (2.9M) [application/octet-stream]
Saving to: ‘linux2.6-dg9_9_13.tar.gz’
linux2.6-dg9_9_13.tar.gz                100%[============================================================================>]   2.88M  4.20MB/s    in 0.7s    
2016-09-21 01:50:20 (4.20 MB/s) - ‘linux2.6-dg9_9_13.tar.gz’ saved [3018925/3018925]

Now the folder dg9_9_13 will be available in the same directory

root@vpn-tutorial:~/tutorial# ls
dg9_9_13  linux2.6-dg9_9_13.tar.gz

Great, now the binary file that we want to use is located in 

You can make this more accessible by placing this in /usr/local/bin/ by executing the following command:

sudo mv ./dg9_9_13/DGROOT/bin/dg9_9_13 /usr/local/bin/delegate

Now the quickest and simplest way to convert your SOCKS4 or SOCKS5 proxy to a HTTP(S) proxy is by executing this command:

delegate ADMIN="contact@localhost" -Plocalhost:2000 SERVER=https SOCKS=PROXYIP:PORT RELAY=proxy PERMIT="*:*:localhost.localdomain" -v

Running this command will give you a bunch of output and if there were any errors that it cannot handle it will simply exit

Now using another terminal window you can test the proxy and if you kept localhost permit directive then make sure you’re executing this command from the same server.

curl -x localhost:2000 ip-api.com/json -v

*   Trying ::1...
* connect to ::1 port 2000 failed: Connection refused
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 2000 (#0)
> GET http://ip-api.com/json HTTP/1.1
> Host: ip-api.com
> User-Agent: curl/7.47.0
> Accept: */*
> Proxy-Connection: Keep-Alive
> 
< HTTP/1.1 200 OK
< DeleGate-Ver: 9.9.13 (delay=11)
< Access-Control-Allow-Origin: *
< Content-Type: application/json; charset=utf-8
< Date: Wed, 21 Sep 2016 02:22:41 GMT
< Via: 1.1 - (DeleGate/9.9.13)
< Proxy-Connection: keep-alive, timeout=60, maxreq=60
< Content-Length: 320
< 
* Connection #0 to host localhost left intact
{"as":"AS20473 Choopa, LLC","city":"Singapore","country":"Singapore","countryCode":"SG","isp":"Choopa, LLC","lat":1.2931,"lon":103.8558,"org":"Vultr Holdings, LLC","query":"45.32.109.73","region":"01","regionName":"Central Singapore Community Development Council","status":"success","timezone":"Asia/Singapore","zip":""}


That’s all I’ll be covering in this quick tutorial, there’s genuinely a whole heap of stuff you can do with DeleGate and I would encourage you to checkout their online Manual. If you have any issues following this tutorial then feel free to comment below and I’ll try to trouble shoot it with you.

How to Convert SOCKS Proxy to HTTPS Proxy using DeleGate

OpenVPN is pretty much the most secure protocol available that is easy to setup and wildly supported across all major devices. Unlike other protocols such as IKEv2 you’ll find that

These guys are competitors to DigitalOcean and provide slightly higher specifications with their cloud instances. I will write another article showing the main differences between the two.

This guide can be used on any Ubuntu platform but I’ll specifically be talking about setting up on Vultr.com (competitor to DigitalOcean).

I will be using Ubuntu 16.04 x64 on the $5 per month plan which includes 768mb ram and 1TB bandwidth per month which is more than enough for a personal VPN.

Since this is a brand new server it’s always a good habit to update your repositories and make sure your packages are the latest versions available to minimize any security risks or outdated software.

sudo apt-get -y update && sudo apt-get -y upgrade

Now let’s install OpenVPN and the certification generator

sudo apt-get -y install openvpn bind9 easy-rsa

Step 3 – Configure OpenVPN /etc/openvpn/server.conf

Paste everything below into the file /etc/openvpn/server.conf

In the next step we will replace the text IP_ADDRESS

server IP_ADDRESS 255.255.255.0
port 443
proto udp
dev tun
ca      easy-rsa/keys/ca.crt
cert    easy-rsa/keys/server.crt
key     easy-rsa/keys/server.key
dh      dh2048.pem
keepalive 10 30
comp-lzo
persist-key
persist-tun
status openvpn-status.log 20
status-version 2
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

# Username and Password authentication.
client-cert-not-required
username-as-common-name
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login
verb 4
log-append /var/log/openvpn.log

Now replace the part at the top that says IP_ADDRESS with your primary devices IP and change the last subnet to .0

You can do this in a single command like below:

ip route get 8.8.8.8 | awk '{print $NF; exit}' | sed 's/\.[0-9]*$/.0/'

Let’s copy across the easy-rsa generation files

 but this is not required and since we are wanting to set this up as quickly as possible we will skip this

openssl dhparam -out /etc/openvpn/dh2048.pem 2048

This will take some time and will output numerous dots and + signs.

You will be asked to enter a bunch of variables, you can just keep pressing enter and use the default values

root@vpn-tutorial:/etc/openvpn/easy-rsa# ./build-ca
Generating a 2048 bit RSA private key
............................+++
..........+++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:
State or Province Name (full name) [CA]:
Locality Name (eg, city) [SanFrancisco]:
Organization Name (eg, company) [Fort-Funston]:
Organizational Unit Name (eg, section) [MyOrganizationalUnit]:
Common Name (eg, your name or your server's hostname) [Fort-Funston CA]:
Name [EasyRSA]:
Email Address [me@myhost.mydomain]:

Next let’s generate the server.key file

Just like above, you can keep pressing ENTER and use the default variables the only additional thing it will bring up is the certification request, you can use the default values for this too.

root@vpn-tutorial:/etc/openvpn/easy-rsa# ./build-key-server server
Generating a 2048 bit RSA private key
....................................................+++
........+++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:
State or Province Name (full name) [CA]:
Locality Name (eg, city) [SanFrancisco]:
Organization Name (eg, company) [Fort-Funston]:
Organizational Unit Name (eg, section) [MyOrganizationalUnit]:
Common Name (eg, your name or your server's hostname) [server]:
Name [EasyRSA]:
Email Address [me@myhost.mydomain]:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'US'
stateOrProvinceName   :PRINTABLE:'CA'
localityName          :PRINTABLE:'SanFrancisco'
organizationName      :PRINTABLE:'Fort-Funston'
organizationalUnitName:PRINTABLE:'MyOrganizationalUnit'
commonName            :PRINTABLE:'server'
name                  :PRINTABLE:'EasyRSA'
emailAddress          :IA5STRING:'me@myhost.mydomain'
Certificate is to be certified until Sep 18 06:16:20 2026 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated


1 out of 1 certificate requests certified, commit? [y/n]

We need to enter one iptables with your primary network interface.

You will need to know what your interface name is which you can get from ifconfig or alternatively use this command:

iptables -t nat -A POSTROUTING -o `ip route get 8.8.8.8 | awk '{ print $5; exit }'` -j MASQUERADE

Now we have to enable IP forwarding by executing the following command:

Now we simply need to add a user to our server, since we are authenticating with PAM (the linux user system) we can just use the inbuilt user management system.

Enter the password twice for confirmation

root@vpn-tutorial:/etc/openvpn# passwd vpnuseruser
Enter new UNIX password: 
Retype new UNIX password: 
passwd: password updated successfully

You can get a full list of commands by typing the same as here:

root@vpn-tutorial:/etc/openvpn# service openvpn
Usage: /etc/init.d/openvpn {start|stop|reload|restart|force-reload|cond-restart|soft-restart|status}

Install OpenVPN on OSX and create our configuration file

We are going to use Homebrew for Mac OSX, if you don’t have this you can install it with one command by visiting

Now that you have it installed simply install the openvpn package by typing

You won’t need to answer any prompts but this will take some time to complete

Once this has been completed, or while it is running (if you want to save time) we will need to create our .ovpn configuration file.

This is a simple file with some parameters that openvpn will read to connect to our server.

Copy this to a local file on your Desktop and name it “myconnection.ovpn” (or whatever you want)

client
dev tun
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
route-method exe
route-delay 2
pull
auth-user-pass
setenv opt block-outside-dns
remote YOUR_IP_ADDRESS 443
<ca>
YOUR_CERTIFICATE
</ca>

Now you just need to replace two variables inside this file

with the servers IP address (your vultr instance IP).

You can get this by typing the following command on your server

root@vpn-tutorial:~# cat /etc/openvpn/easy-rsa/keys/ca.crt
-----BEGIN CERTIFICATE-----
MIIFEjCCA/qgAwIBAgIJAJZj4+fW7xL3MA0GCSqGSIb3DQEBCwUAMIG2MQswCQYD
VQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5jaXNjbzEVMBMG
A1UEChMMRm9ydC1GdW5zdG9uMR0wGwYDVQQLExRNeU9yZ2FuaXphdGlvbmFsVW5p
dDEYMBYGA1UEAxMPRm9ydC1GdW5zdG9uIENBMRAwDgYDVQQpEwdFYXN5UlNBMSEw
HwYJKoZIhvcNAQkBFhJtZUBteWhvc3QubXlkb21haW4wHhcNMTYwOTIwMDYxMzM1
WhcNMjYwOTE4MDYxMzM1WjCBtjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRUw
EwYDVQQHEwxTYW5GcmFuY2lzY28xFTATBgNVBAoTDEZvcnQtRnVuc3RvbjEdMBsG
A1UECxMUTXlPcmdhbml6YXRpb25hbFVuaXQxGDAWBgNVBAMTD0ZvcnQtRnVuc3Rv
biBDQTEQMA4GA1UEKRMHRWFzeVJTQTEhMB8GCSqGSIb3DQEJARYSbWVAbXlob3N0
Lm15ZG9tYWluMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvMITXeTp
ediiQpPjHMRPiKO9t9ZnWn1uSZA+y3lmQvz2NstHAJLsi+5JtvehvHDWDE3HMumr
cuRvoAzNPymytBWtQAq5eIXQ1XOGaWWEyNx4phHnVWJVdPwPn+o/GQWv8tXDa58C
XWWxGuq2yQVAklnAQlitdvE6LEZ3NL+xbUDT6UdhINksLHjgr6IwO7DgOh6ZN1lI
Mqr47O3XRnFtBp3MkK7b8mrnzpOTKsV9NLhHBpeiOtTTjYfdDBFJdP4oHBaAL5WH
sw5F+l2ACnS/Zu4Bm/drKQjznKdZmqF9K2v7/vwa5RupuLgZcIpY0YIeIdyGtzng
Glu1haSuSY3yxQIDAQABo4IBHzCCARswHQYDVR0OBBYEFPFBeY4LRhqNgqbPnfF2
wrISluyRMIHrBgNVHSMEgeMwgeCAFPFBeY4LRhqNgqbPnfF2wrISluyRoYG8pIG5
MIG2MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5j
aXNjbzEVMBMGA1UEChMMRm9ydC1GdW5zdG9uMR0wGwYDVQQLExRNeU9yZ2FuaXph
dGlvbmFsVW5pdDEYMBYGA1UEAxMPRm9ydC1GdW5zdG9uIENBMRAwDgYDVQQpEwdF
YXN5UlNBMSEwHwYJKoZIhvcNAQkBFhJtZUBteWhvc3QubXlkb21haW6CCQCWY+Pn
1u8S9zAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAJDgA9b1Axxum8
j/bSdHuh/HP+drTUIUqMdOEwlrexs7Z8nEptmCvpTI/fIMqsFD95tYwZ9KTrjR0c
XfKHskV4BHQXu/uVr5H2AuJjtv0c9AP9zaiHejiiMW471p7iJrYI9Y1MaY5IAAnm
rChD2QvCTluJ0kcYj5FgEpYs0vYJHQbLngDhHIkrMFrSD8/QNZjYprw8JDuqPXx1
xg07pW6Bp6Qst6oJBs/OJrle4o7HgsQlGUIura1C9/9ENAxPwsIJ0Zvv+hz6IJv4
W6+/EYWa6sXy1LSeG7G5QPBTJGMSh4FqYHVdxMszrCK1rQTJJJ0mS9AClFnbzUl0
QvWY7SAB
-----END CERTIFICATE-----

Great, assuming that everything has gone to plan we’re not ready to connect to our personal OpenVPN server.

On our local computer you can initiate the connection by typing:

sudo openvpn –config ~/Desktop/myconnection.ovpn

You will probably be first prompted for your password since we are executing using sudo, enter your local OSX password here.

Then you will be prompted to enter your username and password in our case it was

and whatever password you chose previously.

sbook:~ scross$ sudo openvpn --config ~/Desktop/myconnection.ovpn 
Tue Sep 20 16:07:39 2016 Unrecognized option or missing parameter(s) in myconnection.ovpn:14: block-outside-dns (2.3.10)
Tue Sep 20 16:07:39 2016 OpenVPN 2.3.10 x86_64-apple-darwin15.2.0 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Jan  6 2016
Tue Sep 20 16:07:39 2016 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.09
Enter Auth Username:vpnusername
Enter Auth Password:

There will then be a bunch of more messages, some will look like errors such as:

How to Install OpenVPN in 15 minutes on Vultr.com and Connect using OSX

Internet Key Exchange (IKEv2) is basically the next generation type of VPN encryption and is slowly being adopted by companies such as Apple &

/ cell phone users who may have frequent dropouts and not the most stable internet. It is also very, very secure compared to other protocols previously used and a lot of people consider it on par with the strength of OpenVPN protocol.

The only con that I can find through my research is that it’s not highly adopted yet, meaning that a tonne of devices don’t support but in saying that, it’s slowly becoming more popular.

So now that we know it’s a great VPN protocol for

users we want to set it up on a server for us to use.

We’re going to set up IKEv2 Strongswan Server on Ubuntu 16.04 x64 with user + pass authentication

If you don’t have a server to use I would highly suggest creating an account with https://vultr.com for only $5 per month you can get a cloud instance with 768mb ram, 15gb SSD and 1TB bandwidth from 14 locations, basically the best deal available at the moment and a great alternative to DigitalOcean.

In the following tutorial we will be configuring the server to only use user+pass authentication without any certificates.

Add wheezy backports to your apt repo so you can download the required packages.

You may also be missing the GPG keys so this just requests them and adds them as well (in case you have any issues).

sudo echo "deb http://ftp.debian.org/debian wheezy-backports main" > /etc/apt/sources.list.d/wheezy-backports.list
sudo gpg --keyserver pgpkeys.mit.edu --recv-key  8B48AD6246925553
sudo gpg -a --export 8B48AD6246925553 | sudo apt-key add -
sudo gpg --keyserver pgpkeys.mit.edu --recv-key 7638D0442B90D010
sudo gpg -a --export 7638D0442B90D010 | sudo apt-key add -


Don’t forget to update your repos and upgrade any old packages:

sudo apt-get -y update && sudo apt-get upgrade -y

Simply use the apt package manager for a quick install

sudo apt-get -y install strongswan strongswan-plugin-openssl strongswan-plugin-eap-mschapv2

This install the main strongswan package as well as the minimum we require for the rest of this tutrial.

charon {
	load_modular = yes
  dns1 = 8.8.8.8
  dns2 = 8.8.4.4
	plugins {
		include strongswan.d/charon/*.conf
	}
}

include strongswan.d/*.conf

You can replace the DNS servers if you wish, these are just Googles public DNS IPs

you can once again truncate the file quickly using this command

and paste everything below, you can replace the 

 with whatever you want but for first timers, I would suggest just copying every thing exactly so you can see how it works before customizing it.

config setup
 strictcrlpolicy=no
 uniqueids = no

conn %default
 mobike=yes
 dpdaction=clear
 dpddelay=35s
 dpdtimeout=200s
 fragmentation=yes

conn iOS-IKEV2
 auto=add
 keyexchange=ikev2
 eap_identity=%any
 left=%any
 leftsubnet=0.0.0.0/0
 rightsubnet=10.99.1.0/24
 leftauth=psk
 leftid=%any
 right=%any
 rightsourceip=10.99.1.0/24
 rightauth=eap-mschapv2
 rightid=%any

Step 4 – Edit ipsec.secrets (your users login & passwords)

Here is where we will store our users logins and passwords in plaintext so it’s very easy to edit

Once again, let’s truncate the existing file by executing the following command:

Now you can replace it with the following text:

include /var/lib/strongswan/ipsec.secrets.inc

# logins
 : PSK "SEXapPAm5x5OXktAzes9nxE3NvilpmIH1orpE2cIzgfWRZgQDYZ1Wm3thlfXXwn"
myusername : EAP "hSyeI1H8Wsybb5qDk5abBrJ7LCu3bPbJrax9aFG77FiiJZu3eUepLwvg9pjjEL3"

is an acronym for Pre Shared Key and will basically exist in all of the configs that we will generate for our users in the upcoming step.

You can type out an awesomely long sequence of characters there or for those of you who don’t enjoy aimlessly smashing the keyboard, you can use a generator like this to create one:

You need to get your main interface name, it’s usually

but not always, if you’re unsure what it is type in your console:

The output will then show you a name, in this case it’s

root@vpnserver:~# ifconfig

ens3      Link encap:Ethernet  HWaddr 56:00:00:36:06:27 
          inet addr:45.76.100.206  Bcast:255.255.254.0  Mask:255.255.254.0
          inet6 addr: fe80::5400:ff:fe36:627/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:22471 errors:0 dropped:0 overruns:0 frame:0
          TX packets:19986 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:141559184 (141.5 MB)  TX bytes:2090717 (2.0 MB)

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Now that we have the interface name you just need to enter these two simple rules, replacing it with your interface name:

sudo iptables -t nat -A POSTROUTING -s 10.99.1.0/24 -o ens3 -j MASQUERADE
sudo iptables -A FORWARD -s 10.99.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 500 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 4500 -j ACCEPT


The 10.99.1.0/24 is the subnet from the file /etc/ipsec.conf you can change this but just make it’s reflected in the config and also to update your iptables.

Now we need to enable IP forwarding, you can quickly do this by using the following command:

Alternatively to prevent yourself from doing this every time you restart your server

you can do a permanent approach by adding it into your

Step 6 – Create your mobile config file

This is the very last thing we have to do before we can start connecting from our iPhone.

Basically the iOS device does allow you to manually add connections however it’s very basic and doesn’t allow you to add some of the parameters required for our basic setup.

I have listed a few parts here that we need to change

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
 <dict>
 <key>PayloadContent</key>
 <array>
 <dict>
 <key>IKEv2</key>
 <dict>
 <key>AuthName</key>
 <string>myusername</string>
 <key>AuthPassword</key>
 <string>@@Replace with your password from /etc/ipsec.secrets@@</string>
 <key>AuthenticationMethod</key>
 <string>SharedSecret</string>
 <key>ChildSecurityAssociationParameters</key>
 <dict>
 <key>DiffieHellmanGroup</key>
 <integer>2</integer>
 <key>EncryptionAlgorithm</key>
 <string>3DES</string>
 <key>IntegrityAlgorithm</key>
 <string>SHA1-96</string>
 <key>LifeTimeInMinutes</key>
 <integer>1440</integer>
 </dict>
 <key>DeadPeerDetectionRate</key>
 <string>Medium</string>
 <key>DisableMOBIKE</key>
 <integer>0</integer>
 <key>DisableRedirect</key>
 <integer>0</integer>
 <key>EnableCertificateRevocationCheck</key>
 <integer>0</integer>
 <key>EnablePFS</key>
 <integer>0</integer>
 <key>ExtendedAuthEnabled</key>
 <true/>
 <key>IKESecurityAssociationParameters</key>
 <dict>
 <key>DiffieHellmanGroup</key>
 <integer>2</integer>
 <key>EncryptionAlgorithm</key>
 <string>3DES</string>
 <key>IntegrityAlgorithm</key>
 <string>SHA1-96</string>
 <key>LifeTimeInMinutes</key>
 <integer>1440</integer>
 </dict>
 <key>LocalIdentifier</key>
 <string>myserver.com.client</string>
 <key>RemoteAddress</key>
 <string>@@Replace with your server IP address@@</string>
 <key>RemoteIdentifier</key>
 <string>myserver.com.server</string>
 <key>SharedSecret</key>
 <string>@@Replace with the PSK from /etc/ipsec.secrets@@</string>
 <key>UseConfigurationAttributeInternalIPSubnet</key>
 <integer>0</integer>
 </dict>
 <key>IPv4</key>
 <dict>
 <key>OverridePrimary</key>
 <integer>1</integer>
 </dict>
 <key>PayloadDescription</key>
 <string>Configures VPN settings for iphone</string>
 <key>PayloadDisplayName</key>
 <string>TutorialVPN</string>
 <key>PayloadIdentifier</key>
 <string>com.apple.vpn.managed.@@Replace with output from uuidgen@@</string>
 <key>PayloadType</key>
 <string>com.apple.vpn.managed</string>
 <key>PayloadUUID</key>
 <string>@@Replace with output from uuidgen@@</string>
 <key>PayloadVersion</key>
 <real>1</real>
 <key>Proxies</key>
 <dict>
 <key>HTTPEnable</key>
 <integer>0</integer>
 <key>HTTPSEnable</key>
 <integer>0</integer>
 <key>ProxyAutoConfigEnable</key>
 <integer>0</integer>
 <key>ProxyAutoDiscoveryEnable</key>
 <integer>0</integer>
 </dict>
 <key>UserDefinedName</key>
 <string>@@My VPN Connection Name@@</string>
 <key>VPNType</key>
 <string>IKEv2</string>
 <key>VendorConfig</key>
 <dict/>
 </dict>
 </array>
 <key>PayloadDisplayName</key>
 <string>IKEv2</string>
 <key>PayloadIdentifier</key>
 <string>@@Replace with output from uuidgen@@</string>
 <key>PayloadRemovalDisallowed</key>
 <false/>
 <key>PayloadType</key>
 <string>Configuration</string>
 <key>PayloadUUID</key>
 <string>@@Replace with output from command uuidgen@@</string>
 <key>PayloadVersion</key>
 <integer>1</integer>
 </dict>
</plist>

Now that you have created the mobileconfig file, simply save it as “whateveryouwant.mobileconfig” and upload it to a public website address.

Now on your iPhone you need to navigate to the URL it is hosted on with safari and you’ll be presented with a screen like this:

Simply follow the prompts on your iPhone and install the VPN connection profile

Once this is done it will appear as already checked (ticked) in your VPN settings.

You can then just tap the connection slider next to “Not Connected”

I hope you were able to setup your own IKEv2 server for iOS / iPhone by now.

If you have any questions or are having difficulty leave a comment below and I’ll try to help you.

How To Setup IKEV2 Strongswan VPN Server on Ubuntu For iOS / iPhone

If you’ve been having database issues and tried using the MySQL CLI client to look around your database, you may have found this error when trying to query some of your tables:

MySQL Table 'table_name' is marked as crashed and last (automatic?) repair failed


This can be caused by a number of reasons such as a hard reset on your server, zero disk space available or your MySQL process crashing for some reason.

You can stop the MySQL daemon/service by running the command:

Your MySQL directory is usually located in /var/lib/mysql

Then simply run the myisamchk command by executing: