MiVPN Server for headless Linux

Before you start

1 Install

From the MiVPN repository (recommended)

The first line adds the key we sign our packages with, the second adds the repository, and the last two install MiVPN Server. You only do this once: from then on, updates arrive with the rest of the system's.

curl -fsSL https://mivpn.net/apt/mivpn.gpg | sudo tee /usr/share/keyrings/mivpn.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/mivpn.gpg] https://mivpn.net/apt stable main" | sudo tee /etc/apt/sources.list.d/mivpn.list
sudo apt update
sudo apt install mivpn-server

Or with the .deb package

Download the package for your architecture:

Not sure of your architecture? Run dpkg --print-architecture

And install it from the folder you downloaded it to:

sudo apt install ./mivpn-server_*.deb

2 Link it to your account

Type your mivpn.net account email; it will ask for your password. The password is only used to sign in this once: it isn't stored on the computer.

sudo mivpn setup -e you@example.com

What mivpn setup does

1. Registers this computer as your account's server.
2. Creates the WireGuard server if the computer doesn't have one yet, with its network and traffic forwarding ready.
3. Checks whether your connection accepts incoming traffic: if it does, it opens the port on the router; if not, it turns on the MiVPN relay.
4. Opens the port in the computer's own firewall.
5. Sets up the clients you already have in your account.

3 Start it

Starts the VPN server and the agent that keeps it in touch with mivpn.net, and adds both to the system startup: after a reboot or a power cut, the server comes back by itself.

sudo mivpn enable

4 Check that it works

mivpn status shows the same as the desktop app. This is what a working server looks like:

$ sudo mivpn status
MiVPN Server  raspberrypi (aarch64)
  Cuenta         tu@correo.com  ·  servidor "Casa"
  Servicios      tunel activo  ·  upnp activo  ·  notify activo  ·  arranque con el sistema: si
  Servidor       en marcha
  mivpn.net      conectado (estado y ordenes)
  Red            Ethernet 1000 Mbps
  Puerto         UDP 51820  ·  abierto en el router
  IP publica     203.0.113.25  ·  local 192.168.1.40
  Clientes       1 de 2 conectados
      movil      conectado      10.8.0.2        ahora
      portatil   desconectado   10.8.0.3        hace 2 h

• Servidor“en marcha” (running) when the VPN server and the agent are working.
• mivpn.net“conectado” (connected): the mivpn.net dashboard and the app can see your server and request configurations from it.
• Puertowhere your clients come in: “abierto en el router” (open on the router) for a direct connection, or the MiVPN relay port.
• Clientesthe devices you've created, whether they're connected and when they last connected.

Commands

Everything is done with the mivpn command. Those that touch the server need sudo.

mivpn setup options

Unattended install

To install on several computers or from a script (Ansible, cloud-init…), pass the password through standard input and skip the confirmations:

printf '%s\n' "$MIVPN_PASSWORD" | sudo mivpn setup -e you@example.com --password-stdin -y
sudo mivpn enable

Moving the server to another computer

Install MiVPN Server on the new computer and link it with --replace. The old computer stops serving by itself as soon as mivpn.net tells it. Your clients will need to download their configuration again; the MiVPN app does it automatically.

sudo mivpn setup -e you@example.com --replace
sudo mivpn enable

Update

New versions arrive through the repository, like the rest of the system. When you update, the server restarts by itself with the new version.

sudo apt update && sudo apt upgrade

Uninstall

First unlink the computer from your account; then uninstall the package.

sudo mivpn unlink
sudo apt remove mivpn-server

Uninstalling stops everything and deletes the credentials, the clients and the WireGuard server MiVPN created. If you skip unlink, the computer will still appear in your account until you move the server to another one.