Building a Cascading Multi-Hop VPN with WireGuard and OpenVPN

A cascading multi-hop VPN setup involves routing your internet traffic through multiple VPN servers in a sequential manner. This increases privacy and security, as your data is encrypted multiple times across different nodes. In this tutorial, we will use WireGuard and OpenVPN to create a robust multi-hop VPN network. We will configure both protocols and ensure they work seamlessly together, creating a stronger layer of anonymity and a better overall VPN solution.

Why Use WireGuard and OpenVPN Together?

WireGuard is a modern VPN protocol known for its simplicity, security, and speed, while OpenVPN is widely trusted for its flexibility and security. By combining the two, we benefit from the performance of WireGuard and the configurability of OpenVPN, allowing us to set up a multi-hop VPN that is both efficient and highly customizable.

Setting Up WireGuard as the First VPN Hop

We will start by configuring WireGuard as the first hop in our multi-hop VPN chain. WireGuard’s simple configuration makes it a great choice for our first VPN server.

# Install WireGuard on the server
sudo apt update
sudo apt install wireguard

# Generate WireGuard key pair
wg genkey | tee privatekey | wg pubkey > publickey

# Configure WireGuard server
sudo nano /etc/wireguard/wg0.conf

In the wg0.conf file, add the following configuration:

[Interface]
Address = 10.0.0.1/24
PrivateKey = 
ListenPort = 51820

[Peer]
PublicKey = 
AllowedIPs = 10.0.0.2/32

This configuration sets up WireGuard with a private key, a specific subnet for the VPN, and a peer that will connect to this server.

Configuring OpenVPN as the Second VPN Hop

Next, we will configure OpenVPN to serve as the second hop in our multi-hop chain. OpenVPN will act as the intermediary server between the first WireGuard node and the final exit node.

# Install OpenVPN
sudo apt update
sudo apt install openvpn easy-rsa

# Set up the OpenVPN server
cd /etc/openvpn
sudo make-cadir /etc/openvpn/easy-rsa
cd /etc/openvpn/easy-rsa

# Build the CA and server certificates
./easyrsa init-pki
./easyrsa build-ca
./easyrsa gen-req server nopass
./easyrsa sign-req server server

Next, configure the OpenVPN server by editing the server.conf file:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"

This configuration sets up OpenVPN to use UDP and redirects all traffic to pass through the VPN tunnel, routing it via the WireGuard server.

Connecting the Multi-Hop VPN

To link the WireGuard and OpenVPN tunnels, we will first set up the client for the WireGuard server and then connect to the OpenVPN server from the WireGuard client.

WireGuard Client Configuration

On the client device, create a WireGuard configuration:

[Interface]
PrivateKey = 
Address = 10.0.0.2/24

[Peer]
PublicKey = 
Endpoint = :51820
AllowedIPs = 10.8.0.0/24

This configuration sets up the WireGuard client to connect to the WireGuard server and route traffic through the OpenVPN network.

OpenVPN Client Configuration

Now, configure the OpenVPN client to connect to the OpenVPN server:

client
dev tun
proto udp
remote  1194
ca ca.crt
cert client.crt
key client.key

This OpenVPN client configuration will connect to the OpenVPN server after the WireGuard client connection is established, enabling the cascading VPN setup.

Testing the Cascading Multi-Hop VPN

Once both WireGuard and OpenVPN configurations are complete, we can test the cascading VPN setup by tracing the route from the client to the final destination. Use the traceroute command to ensure that the traffic passes through the WireGuard server first, followed by the OpenVPN server:

traceroute 8.8.8.8

The output should display two hops: first through the WireGuard server, and then through the OpenVPN server before reaching the internet.