A short guide to setting up SigmaVPN for Android. SigmaVPN for Android requires the peer to be running SigmaVPN or QuickTun.This guide uses SigmaVPN for Android v0.27 (2013-06-05) and SigmaVPN commit c05cccfa2277a6c186e62e6cb85bd9fedcf3bbcd on 2014-06-18.
TUN/TAP interface provides a a virtual TUNnel for IP packets, or a virtual network TAP for ethernet frames.SigmaVPN for Android supports only the TUN interface.
A TUN device needs to be configured with a network range. SigmaVPN requires a separate TUN device for each peer Android device.Since it is a point-to-point arrangement, we will create a /30 network for each peer Android device. Let's use the private range 172.30.172.0/30 for the first TUN device. We'll assign 172.30.172.1 to the TUN device on the SigmaVPN host, and 172.30.172.2 to the TUN device created by SigmaVPN for Android.
Bare-bone Setup
SigmaVPN host setup:# Generate keys for the SigmaVPN host. $ naclkeypair PRIVATE KEY: 55467491bb51b6166add9c22c560a6a0ce0ca8836aab29db5d6fd3abd56eec2b PUBLIC KEY: fce78ab3177a6541713ab826e735521f2764a450dc168b7a0c30107a3e04f45b # Creates the tun device. $ ip tuntap add dev tun0 mode tun $ ip addr add 172.30.172.1/30 dev tun0 # Let's not introduce unnecessary fragmentation. $ ip link set dev tun0 mtu 1400 # Activate the interface. $ ip link set dev tun0 up $cat > /etc/sigmavpn.conf << 'EOF' # Comments are allowed [firstandroiddevicename] # Don't use nacl0 which is not secure. proto = nacltai # Remote's public key, get this from SigmaVPN for Android side. proto_publickey = 8fa2b21bc9b7188067b75255232d571de254cba2dc7a960312db754842f4c72a # Local's private key, this will be the PRIVATE KEY from the earlier naclkeypair invocation. proto_privatekey = 55467491bb51b6166add9c22c560a6a0ce0ca8836aab29db5d6fd3abd56eec2b local = tuntap local_interface = tun0 # Tell SigmaVPN that tun0 is a tun device since in Linux the TUN device can be named anything. local_tunmode = 1 # SigmaVPN for Android requires protocol info to be disabled. local_protocolinfo = 0 peer = udp # The address of SigmaVPN for Android device will be changing constantly. peer_remotefloat = 1 # Where SigmaVPN should be listening for UDP. Typically this will be the address of the Internet-bound network interface. peer_localaddr = 10.0.0.1 # Choose whatever port, SigmaVPN does not have a default port number. peer_localport = 5678 EOF $ sigmavpn -c /etc/sigmavpn.conf SigmaVPN. Copyright (c) 2011 Neil Alexander T. All rights reserved. Using configuration file '/etc/sigmavpn.conf' firstandroiddevicename: Session active Remote endpoint is now 1.2.3.4:5977
SigmaVPN for Android setup:
- Tunnel/Remote Address & Port: the Internet address of the SigmaVPN host.
- Tunnel/Remote Public Key: the SigmaVPN's host public key for this device.
- Tunnel/Use TAI64 nonce: always enable this.
- Network/Tunnel Address Prefix: 172.30.172.2/30
- Network/Static Route: what ranges should be routed through the VPN. If not specified, only 172.30.172.0/30 will be.
- Network/DNS Servers: if not specified, will use the DNS server
Internet Access for the Android Device
There are additional setup if you want the Android device to access the Internet through the SigmaVPN host.On the SigmaVPN host (assuming a Linux):
# Enable IP forwarding. sysctl -w net.ipv4.ip_forward=1 # Masquerade traffic from VPN to the Internet, assuming eth0 is the Internet-bound network interface. iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # Allow established traffic to be forwarded. iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # Allow traffic initiated from VPN to access the world. iptables -A FORWARD -i tun0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT
SigmaVPN for Android setup:
- Network/Static Route: 0.0.0.0/0
- Network/DNS Servers: get it from /etc/resolv.conf on the SigmaVPN host
A Second Android Device
- New keys for the Sigma VPN host. You can use the same one but if you lose an Android device, you'll have to change the keys for all the others.
- A new TUN device with a different range, let's say 172.30.172.4/30.
- The TUN address on the SigmaVPN host is 172.30.172.5/30.
- SigmaVPN on the host must listen on a different port.
- SigmaVPN for Android's Network/Tunnel Address Prefix: 172.30.172.6/30.
- If you want the second Android device to access Internet:
iptables -A FORWARD -i tun1 -o eth0 -m conntrack --ctstate NEW -j ACCEPT
