{"id":18521828,"url":"https://github.com/gjbae1212/grpc-vpn","last_synced_at":"2025-04-09T09:33:33.366Z","repository":{"id":50587853,"uuid":"256373243","full_name":"gjbae1212/grpc-vpn","owner":"gjbae1212","description":":mushroom: VPN supporting authentication such as Google OpenID Connect or AWS IAM ..., over GRPC. :shipit:","archived":false,"fork":false,"pushed_at":"2020-06-06T03:40:06.000Z","size":57812,"stargazers_count":62,"open_issues_count":1,"forks_count":6,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-03-24T04:50:53.682Z","etag":null,"topics":["aws-iam","go","golang","google","google-openid-connect","grpc","grpc-vpn","vpn"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gjbae1212.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-04-17T01:44:46.000Z","updated_at":"2025-02-28T03:34:52.000Z","dependencies_parsed_at":"2022-09-09T22:22:17.403Z","dependency_job_id":null,"html_url":"https://github.com/gjbae1212/grpc-vpn","commit_stats":null,"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gjbae1212%2Fgrpc-vpn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gjbae1212%2Fgrpc-vpn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gjbae1212%2Fgrpc-vpn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gjbae1212%2Fgrpc-vpn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gjbae1212","download_url":"https://codeload.github.com/gjbae1212/grpc-vpn/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248012867,"owners_count":21033255,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws-iam","go","golang","google","google-openid-connect","grpc","grpc-vpn","vpn"],"created_at":"2024-11-06T17:27:47.324Z","updated_at":"2025-04-09T09:33:28.355Z","avatar_url":"https://github.com/gjbae1212.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# grpc-vpn\n\n\u003cp align=\"left\"\u003e\n\u003ca href=\"https://circleci.com/gh/gjbae1212/grpc-vpn\"\u003e\u003cimg src=\"https://circleci.com/gh/gjbae1212/grpc-vpn.svg?style=svg\"\u003e\u003c/a\u003e\n\u003ca href=\"https://hits.seeyoufarm.com\"/\u003e\u003cimg src=\"https://hits.seeyoufarm.com/api/count/incr/badge.svg?url=https%3A%2F%2Fgithub.com%2Fgjbae1212%2Fgrpc-vpn\"/\u003e\u003c/a\u003e \n\u003ca href=\"https://img.shields.io/badge/language-golang-blue\"\u003e\u003cimg src=\"https://img.shields.io/badge/language-golang-blue\" alt=\"language\" /\u003e\u003c/a\u003e\n\u003ca href=\"/LICENSE\"\u003e\u003cimg src=\"https://img.shields.io/badge/license-MIT-GREEN.svg\" alt=\"license\" /\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n**GRPC-VPN** is the **VPN** server and client which supports authentications such as Google OpenId Connect or AWS IAM, using GRPC.  \n  \nOther authentications(LDAP, ...) will be to apply it, if you will implement custom [ServerAuthMethod](https://github.com/gjbae1212/grpc-vpn/tree/master/auth) for VPN server and [ClientAuthMethod](https://github.com/gjbae1212/grpc-vpn/tree/master/auth) for VPN client.\n\n\u003cbr/\u003e\n\n**Motivation**  \nOf course, the well-made VPN is already around us.  \n\nBut many VPN aren't to support multiple authentications. (Generally support to LDAP, configuration file having shared key)  \n  \nI want to apply multiple authentications by circumstances, so protocol for authentication should organize the plugin which implements it.  \n\n\u003cbr/\u003e\n\n**GRPC-VPN**\n- It's composed of server and client.    \n- It's implemented using **Golang**.\n- Communicates via **GRPC**.\n- Use Tun device.\n- Server on VPN can only run on **Linux**, and Client on VPN can run on **Linux** or **Mac**.\n- Supports to inject **custom authentication function**.\n- Issued JWT is expired after 1.day. (later it will support to change mannually.)\n  \n## Why GRPC?\nFor multiple authentications will support, authentication flow and connection flow should definitely distinguish.  \n  \nAuthentication flow needs to a little unification protocol for applying various case.  \n  \nConnection flow should have the unitary policy regardless of authentications.  \nSo I was to use JWT authentication and GRPC.   \n\nUsing GRPC can implement the unification authentication flow, also using JWT and GRPC stream can connect VPN regardless of authentications.   \n    \n\u003cbr/\u003e\n\u003cp align=\"center\"\u003e\n\u003cimg src=\"https://storage.googleapis.com/gjbae1212-asset/grpc-vpn/main.png\"/\u003e\n\u003c/p\u003e\n\u003cbr/\u003e\n\n## Getting Started\n- It's possible to be used both a third-party library and standalone application.\n- **Server on VPN can only run on Linux, and Client on VPN can run on Linux or Mac.**\n- It **must run** with **sudo**, becausue it's included network setting that can change on kernel mode.\n  \n  \n### 1. Be used Third-Party Library.\n\u003e You can write code and run, if you utilize it on circumstances.   \n\n**1. Non Authentication**\n```go\n# -------------------------------------------------\n# SERVER\n# -------------------------------------------------\n\nimport (\n    \"github.com/gjbae1212/grpc-vpn/server\"    \n)\n\ns, _ = server.NewVpnServer(\n            server.WithVpnSubNet(\"ex) 192.168.0.100/24\"),\n      \t\tserver.WithGrpcPort(\"ex) 443\"),\n      \t\tserver.WithVpnJwtSalt(\"ex) jwt salt\"),\n      \t\tserver.WithVpnJwtExpiration(24*time.Hour),\n      \t\tserver.WithGrpcTlsCertification(\"ex) tls cert\"),\n      \t\tserver.WithGrpcTlsPem(\"ex) tls pem\"),       \n)\ns.Run()\n\n# ------------------------------------------------- \n# CLIENT \n# -------------------------------------------------\n\nimport (\n    \"github.com/gjbae1212/grpc-vpn/client\"\n        \"github.com/gjbae1212/grpc-vpn/auth\"\n)\n\nc, _ := client.NewVpnClient(\n            client.WithServerAddr(\"ex) server addr\"),\n     \t\tclient.WithServerPort(\"ex) server port\"),\n     \t\tclient.WithSelfSignedCertification(\"ex) server tls cert\"),     \n)\nc.Run()\n```\n\u003cbr/\u003e\n\n**2. Authentication [Google OpenID Connect](https://developers.google.com/identity/protocols/oauth2/native-app)**\n```go\n# -------------------------------------------------\n# SERVER\n# -------------------------------------------------\n\nimport (\n    \"github.com/gjbae1212/grpc-vpn/server\"\n    \"github.com/gjbae1212/grpc-vpn/auth\"\n)\n\nauthGoogle, _ := auth.NewServerManagerForGoogleOpenID(\n\t\t\"ex) google openid connect client_id\",\n\t\t\"ex) google openid connect client_secret\",\n\t\t\"ex) if your GSUITE is using, it's domain name to allow\",\n\t\t[]string{\"gjbae1212@gmail.com\", \"blahblah\"},\n\t)\nauthMethod, _ := authGoogle.ServerAuth()\n\ns, _ := server.NewVpnServer(\n    server.WithVpnSubNet(\"ex) 192.168.0.100/24\"),\n    server.WithGrpcPort(\"ex) 443\"),\n    server.WithVpnJwtSalt(\"ex) jwt salt\"),\n    server.WithVpnJwtExpiration(24*time.Hour),\n    server.WithGrpcTlsCertification(\"ex) tls cert\"),\n    server.WithGrpcTlsPem(\"ex) tls pem\"),\n    server.WithAuthMethods([]auth.ServerAuthMethod{authMethod}), // authentication\n)\ns.Run()\n\n# ------------------------------------------------- \n# CLIENT \n# -------------------------------------------------\n\nimport (\n    \"github.com/gjbae1212/grpc-vpn/client\"\n    \"github.com/gjbae1212/grpc-vpn/auth\"\n)\n\nauthGoogle, _ := auth.NewClientManagerForGoogleOpenID(\n\t\t\"ex) google openid connect client_id\",\n\t\t\"ex) google openid connect client_secret\",\n\t)\n\t\nauthMethod, _ := authGoogle.ClientAuth()\nc, _ := client.NewVpnClient(\n    client.WithServerAddr(\"ex) server addr\"),\n    client.WithServerPort(\"ex) server port\"),\n    client.WithSelfSignedCertification(\"ex) server tls cert\"),\n    client.WithAuthMethod(authMethod), // authentication\n)\nc.Run()\n\n```\n\u003cbr/\u003e\n\n**3. Authentication(AWS IAM)**\n```go\n# -------------------------------------------------\n# SERVER\n# -------------------------------------------------\n\nimport (\n    \"github.com/gjbae1212/grpc-vpn/server\"\n    \"github.com/gjbae1212/grpc-vpn/auth\"\n)\n\nauthAws, _ := auth.NewServerManagerForAwsIAM(\n\t\t\"ex) allow aws account id\",\n\t\t[]string{\"gjbae1212@gmail.com\", \"blahblah\"},\n\t)\nauthMethod, _ := authAws.ServerAuth()\n\ns, _ := server.NewVpnServer(\n    server.WithVpnSubNet(\"ex) 192.168.0.100/24\"),\n    server.WithGrpcPort(\"ex) 443\"),\n    server.WithVpnJwtSalt(\"ex) jwt salt\"),\n    server.WithVpnJwtExpiration(24*time.Hour),\n    server.WithGrpcTlsCertification(\"ex) tls cert\"),\n    server.WithGrpcTlsPem(\"ex) tls pem\"),\n    server.WithAuthMethods([]auth.ServerAuthMethod{authMethod}), // authentication\n)\ns.Run()\n\n# ------------------------------------------------- \n# CLIENT \n# -------------------------------------------------\n\nimport (\n    \"github.com/gjbae1212/grpc-vpn/client\"\n    \"github.com/gjbae1212/grpc-vpn/auth\"\n)\n\nauthAws, _ := auth.NewClientManagerForAwsIAM(\n\t\t\"ex) aws key\",\n\t\t\"ex) aws secret access key\",\n\t)\nauthMethod, _ := authAws.ClientAuth()\n\nc, _ := client.NewVpnClient(\n    client.WithServerAddr(\"ex) server addr\"),\n    client.WithServerPort(\"ex) server port\"),\n    client.WithSelfSignedCertification(\"ex) server tls cert\"),\n    client.WithAuthMethod(authMethod), // authentication\n)\nc.Run()\n```\n\n### 2. Be used Standalone Application.\n\u003e You can run an application which already built.\n\n**1. Download or build**\n```bash\n$ git clone https://github.com/gjbae1212/grpc-vpn.git\n$ cd grpc-vpn\n$ bash script/make.sh build_vpn_server # make an application to dist directory.\n$ bash script/make.sh build_vpn_client # make an application to dist directory.\n```\n\u003cbr/\u003e\n\n**2. Run Server**\nserver config(config.yaml)\n```yaml\n# Template\nvpn:\n  port: \"\" # Required(vpn port)\n  subnet: \"\" # Required(vpn subnet(private ip range), ex) 192.168.0.100/24)\n  log_path: \"\" # Required(log path)\n  jwt_salt: \"\" # Required(random string)\n  jwt_expiration: \"\" # Required(expire-time in JWT), ex) 100ms, 10m, 2h30m, ...  \n  tls_certification: \"\" # Required(tls cert)\n  tls_pem: \"\" # Required(tls pem)\n\nauth: # Optional \n  google_openid: # Optional(if you want to google openid connect authentication)\n    client_id: \"\" # Google client id\n    client_secret: \"\" # Google client secret\n    hd: \"\" # If you are using GSuite, domain name for allowing.\n    allow_emails: # Allow emails\n      - \"\"\n  aws_iam: # Optional(if you want to aws iam authentication)\n    account_id: \"\" # Allow AWS Account ID \n    allow_users: # Allow users\n      - \"\"\n\n----------------------------------------------------------------------\n\n# 1. Example Non Authentication\nvpn:\n  port: \"8080\" \n  subnet: \"192.168.0.100/24\" \n  log_path: \"\" \n  jwt_salt: \"hello-world\" \n  jwt_expiration: \"2h10m\" \n  tls_certification: \"blahblah\" \n  tls_pem: \"blahblah\" \n\n# 2. Example Google OpenId Connect (Reference https://developers.google.com/identity/protocols/oauth2/native-app)\nvpn:\n  port: \"8080\" \n  subnet: \"192.168.0.100/24\" \n  log_path: \"\" \n  jwt_salt: \"hello-world\" \n  jwt_expiration: \"1h10m\"\n  tls_certification: \"blahblah\" \n  tls_pem: \"blahblah\"\nauth:  \n  google_openid: \n    client_id: \"google client id\" \n    client_secret: \"google client secret\" \n    hd: \"\" \n    allow_emails: \n      - \"blahblah@gmail.com\"\n\n# 3. Example Aws IAM\nvpn:\n  port: \"8080\" \n  subnet: \"192.168.0.100/24\" \n  log_path: \"\" \n  jwt_salt: \"hello-world\"\n  jwt_expiration: \"3h\"\n  tls_certification: \"blahblah\" \n  tls_pem: \"blahblah\"\nauth:    \n  aws_iam: \n    account_id: \"aws accoount id\"  \n    allow_users: \n      - \"blahblah\"\n\n```\nRun\n```bash\n$ cd grpc-vpn/dist\n$ sudo vpn-server-linux run -c \"config.yaml path\" \n```\n\u003cbr/\u003e\n\n**3. Run Client**\nclient config(config.yaml)\n```yaml\n# Template\nvpn:\n  addr: \"\" # Required(vpn server addr)\n  port: \"\" # Required(vpn server port)\n  insecure: true or false # Required (true is to disable tls, false is to enable tls)\n  self_signed_certification: \"\" # Optional(If you are using self-signed certification, you must insert it.)\nauth: # Optional\n  google_openid: # Optional(if your vpn-server support to google openid connect authentication)\n    client_id: \"\"\n    client_secret: \"\"\n  aws_iam:  # Optional(if your vpn-server support to aws iam authentication)\n    access_key: \"\"\n    secret_access_key: \"\"\n\n---------------------------------------------------------------\n\n# 1. Example Non Authentication\nvpn:\n  addr: \"localhost\" \n  port: \"8080\"\n  insecure: false \n  self_signed_certification: \"\"   \n\n# 2. Example Google OpenId Connect (Reference https://developers.google.com/identity/protocols/oauth2/native-app)\nvpn:\n  addr: \"localhost\" \n  port: \"8080\"\n  insecure: false\n  self_signed_certification: \"\"   \nauth: \n  google_openid: \n    client_id: \"gogole client id\"\n    client_secret: \"google client secret\"\n\n# 3. Example Aws IAM\nvpn:\n  addr: \"localhost\" \n  port: \"8080\"\n  insecure: false\n  self_signed_certification: \"\"  \nauth: \n  aws_iam:  # Optional(if your vpn-server support to aws iam authentication)\n    access_key: \"aws access key\"\n    secret_access_key: \"aws secret key\"  \nRun\n```bash\n$ cd grpc-vpn/dist\n\n# MAC\n$ sudo vpn-client-darwin run -c \"config.yaml path\"\n\n# LINUX \n$ sudo vpn-client-linux run -c \"config.yaml path\" \n```\n\n## License\nThis project is following The MIT.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgjbae1212%2Fgrpc-vpn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgjbae1212%2Fgrpc-vpn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgjbae1212%2Fgrpc-vpn/lists"}