Choosing the Right VPN Solution for NethServer

NethServer is an RPM-based, CentOS-derived distribution tailored to small offices and home offices. It uses yum (or dnf on version 8 ) for package management, and is typically managed through its Cockpit-powered web interface rather than a traditional desktop environment. Server administrators working with NethServer expect a modular approach: you install “modules” for mail, DNS, web proxy and indeed VPN. With that in mind, the best VPN solutions for NethServer are those that can be deployed as modules or easily integrated via the command line, leverage EPEL when necessary, and play nicely with systemd and Cockpit.

The usual audience for NethServer tends to be sysadmins who prefer minimal GUI dependencies (no GNOME or KDE by default) and rely heavily on SSH, Cockpit, and the config engine (NethServer’s in-house wrapper around nethserver-install and yum). Any VPN you choose should respect this ecosystem, integrate with the existing firewall template engine, and be easy to back up via NethServer’s built-in backup tool.

Top VPN Solutions for NethServer

• OpenVPN (NethServer Module)
  – Official module, tightly integrated with Cockpit, automatic firewall rules, certificate management via web UI.
• StrongSwan (IPsec)
  – Industrial-grade IPsec, available via EPEL, systemd unit integration, site-to-site and road-warrior support.
• WireGuard
  – Lightweight, kernel-level performance, packaged in EPEL for CentOS 8 (Rocky 8), requires manual config for CentOS 7 but fully functional on NethServer 8.
• SoftEther VPN
  – Multi-protocol support (SSL-VPN, L2TP, OpenVPN cloning), but no official NethServer module so requires manual RPM or tarball installation.

Comparative Overview

Deep Dive: Installation Configuration

1. OpenVPN (NethServer Module)

The built-in module is by far the quickest way to get road-warriors connected. It handles certificates, firewall, and routing automatically.

1. Enable the VPN module:

   yum install nethserver-openvpn
   config set vpn.OpenVPNEnabled true
   signal-event nethserver‐openvpn-update
         

2. Generate server certificates via Cockpit’s VPN section and create user profiles. The module will drop .ovpn files into /etc/e-smith/openvpn.
3. Distribute .ovpn files to clients they connect with any OpenVPN client:

   sudo openvpn --config client-profile.ovpn
         

2. StrongSwan (IPsec)

For sites requiring IPsec tunnels or IKEv2 road-warriors, StrongSwan is rock solid.

1. Install from EPEL and enable the service:

   yum install epel-release
   yum install strongswan
   systemctl enable --now strongswan
         

2. Edit /etc/strongswan/ipsec.conf:

   config setup
     uniqueids=never
   
   conn roadwarrior
     keyexchange=ikev2
     left=%any
     leftcert=serverCert.pem
     leftsendcert=always
     leftsubnet=0.0.0.0/0
     right=%any
     rightauth=eap-mschapv2
     rightsourceip=10.10.10.0/24
     rightsendcert=never
     eap_identity=%identity
         

3. Add credentials in /etc/strongswan/ipsec.secrets:

   : RSA serverKey.pem
   user1 : EAP password123
         

4. Reload configuration:

   systemctl reload strongswan
         

3. WireGuard

On NethServer 8 (Rocky 8 base), WireGuard is available in EPEL. It gives you super-efficient tunnels.

1. Enable EPEL and install:

   yum install epel-release
   yum install kmod-wireguard wireguard-tools
         

2. Generate server keys:

   wg genkey  tee /etc/wireguard/server.private  wg pubkey > /etc/wireguard/server.public
         

3. Create /etc/wireguard/wg0.conf:

   [Interface]
   Address = 10.200.200.1/24
   ListenPort = 51820
   PrivateKey = 
   
   [Peer]
   PublicKey = 
   AllowedIPs = 10.200.200.2/32
         

4. Bring up the interface:

   systemctl enable --now wg-quick@wg0
         

Each of these solutions taps into NethServer’s robust RPM-based OS, integrates with systemd, and can be backed up using the native backup-data tool. OpenVPN is unbeatable for a quick, user-friendly setup StrongSwan excels in enterprise-grade IPsec and WireGuard offers low-latency, kernel-driven performance when running on NethServer 8. Choose the one that best fits your network topology and client compatibility requirements.