Home VPN

Travel VPN Reference

Every connection in this setup has two directions. A request goes out, and its reply has to come back the same way with every change reversed. The diagrams show both directions.

Request Reply

A web request, there and back

Your devices don't run a VPN app. The phone encrypts their traffic, the home server decrypts it, and websites see your home IP.

PUBLIC INTERNET ENCRYPTED TUNNEL Your devices laptop, tablet no VPN app Wi-Fi client Phone router Sailfish phone router.py wlan1 ⇄ tun0 SSID travel_router Home router port forwards 1194/udp 8443/tcp 203.0.113.47 Server q Docker · openvpn-as decrypts requests encrypts replies 192.168.1.10 Websites see your home IP request UDP 1194 · TCP 8443 fallback forward request reply encrypted reply return reply WI-FI LAN HOME IP
The phone tries UDP 1194 first and falls back to TCP 8443 on networks that block UDP. Traffic crossing the public internet is always encrypted.

How the phone finds home

Your ISP can change the home IP at any time. The server keeps Dynu's DNS record up to date, and the phone looks up the name before it connects. The two ends never contact each other directly; Dynu sits between them.

Phone before dialing, looks up the name home.ovpn Dynu DNS A home-vpn.example.net → 203.0.113.47 was 198.51.100.23 Server q watches its public IP dynu-updater.service lookup name 203.0.113.47 IP update accepted PULLS PUSHES
OpenVPN AS also uses home-vpn.example.net as its host.name, so profiles you download from it point there.

Port forwarding, hop by hop

On the way in, each hop rewrites the destination address. On the way out, each hop undoes its own rewrite, so the phone gets the reply from the same address it dialed. If one rewrite goes missing, requests stop reaching the server.

PHONE DIALS HOME ROUTER DOCKER ON q AS FIREWALL → DAEMON 203.0.113.47:1194 192.168.1.10:1194 172.17.0.2:1194 172.17.0.2:918–921 forward map DNAT from 203.0.113.47:1194 from 192.168.1.10:1194 from 172.17.0.2:1194 from :918–921 undo undo undo chain AS0_DPFWD_UDP
The 09-23 outage happened at the last hop: after a reboot the AS0_DPFWD_UDP DNAT rule was missing, so UDP requests were refused at Docker's end.

Reference

Addresses and names on this page are examples.

Server q

OS
Ubuntu
Address
LAN 192.168.1.10
Runs
openvpn-as in Docker, Dynu updater

OpenVPN Access Server

Image
openvpn/openvpn-as, restart=unless-stopped
User
vpnuser: one session at a time
License
2 concurrent connections
Web UI
port 943
Config
sacli ConfigQuery
sacli --key K --value V ConfigPut
History
/openvpn/etc/db/log.db, table log

Phone & router.py

Device
Sony Xperia running Sailfish OS
Profile
~/Desktop/home.ovpn
Logs
/tmp/travelrouter/. openvpn.log is root-only.