trailofbits/algo
30,278 Stars·2,359 Forks·Python·AGPL-3.0·8 Aufrufeblog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works↗
Algo
Algo is a cloud VPN deployment tool and WireGuard orchestrator designed to automate the provisioning and configuration of personal VPN servers across multiple cloud infrastructure providers. It functions as a multi-cloud infrastructure provisioner and a VPN client configuration generator, creating the necessary tunnels and connection profiles for secure device connectivity.
The project distinguishes itself by integrating a network ad-blocking DNS server directly into the deployment, filtering advertisements and malicious domains for all connected clients. It further simplifies the onboarding process by generating protocol-specific configuration files and Apple configuration profiles for mobile and desktop devices.
The system covers broad capability areas including cloud infrastructure automation for providers such as DigitalOcean, Google Cloud, and Hetzner, as well as network traffic management through split tunneling and LAN passthrough. It also handles security and access control via Linux firewall configuration and cloud security group automation.
Deployment can be executed in a containerized environment or via headless mode using environment variables to bypass interactive prompts.
Features
- Personal VPN Deployments - Automates the end-to-end provisioning and configuration of private VPN servers across multiple cloud platforms.
- WireGuard VPN Orchestrators - Provides an automation system for deploying WireGuard tunnels and generating client connection profiles.
- Configuration File Generators - Produces protocol-specific configuration files and Apple configuration profiles for secure device connectivity.
- Cloud Infrastructure Automation - Automates the creation and setup of virtual servers and firewalls across various cloud providers.
- Cloud Provisioners - Acts as an abstraction layer translating configurations into API calls for multi-cloud resource management.
- Cloud Provisioning - Automates the creation of virtual machines and network security groups using cloud provider APIs.
- Multi-Cloud Orchestrators - Orchestrates the creation and configuration of VPN infrastructure across multiple cloud service providers.
- VPN Deployment Automation - Automates the provisioning and configuration of personal VPN servers across multiple cloud providers.
- DNS-Based Ad Blockers - Runs a local resolver that matches queries against blacklists to block advertisement and tracking domains.
- VPN Client Configuration Generators - Generates unique, protocol-specific configuration files and profiles for individual VPN users.
- WireGuard VPN Support - Establishes secure network tunnels on Windows using the WireGuard protocol.
- Secure Remote Access - Establishes encrypted tunnels and manages credentials to provide secure remote access to networks.
- VPN Clients - Generates connection profiles and certificates for mobile, desktop, and router devices.
- Compute Engine Provisioning - Automates the provisioning of VPN servers specifically on Google Compute Engine.
- Virtualization Boot Injection - Injects configuration scripts into virtual machine metadata to execute installation tasks during the first boot.
- Provider Abstractions - Translates high-level deployment commands into specific API requests for different cloud infrastructure vendors.
- Group Automation - Automates the opening of required ports in cloud security groups for SSH and VPN protocols.
- Profile Generators - Generates protocol-specific configuration files, QR codes, and system profiles for multiple operating systems.
- Template and Generation Engines - Produces protocol-specific configuration files and system profiles using predefined templates and user credentials.
- Cloud API Integrations - Provisions a virtual server on DigitalOcean using an API token to automate a private network gateway.
- VPN Installers - Includes automated installers for deploying the VPN server on existing Ubuntu instances via SSH.
- SSH-Based Remote Execution - Executes installation scripts and manages user certificates on remote servers via secure shell connections.
- Installation Scripts - Uses remote installation scripts to configure the VPN on running servers.
- Device Configuration Profiles - Generates configuration profiles for iOS and macOS devices to automate VPN connection settings.
- LAN Passthrough Configurations - Configures network routes that allow the server to access a local network bypassing the VPN.
- Network Traffic Controllers - Enforces connectivity rules to restrict or allow network communication between connected VPN clients.
- Split Tunneling - Implements split tunneling and routing rules to control traffic flow through the secure tunnel.
- Firewall Rule Configurations - Configures Linux kernel firewall rules to manage VPN tunnel traffic and secure server access.
- Network Access Controls - Adjusts firewall and DNS settings to permit VPN clients to access resources on a local home network.
- User Access Management - Manages VPN access by updating user certificates and credentials on existing servers.
- Initial Boot Configurations - Injects custom configuration and SSH keys into virtual machines during first boot using templated scripts.
- Linux Firewall Configurations - Configures Linux Netfilter rules for IPv4 and IPv6 to secure the server and allow VPN traffic.
- Proxy And VPN - Listed in the “Proxy And VPN” section of the Awesome Mac awesome list.
- Proxy and VPN Tools - Personal IPSEC VPN deployment in the cloud.
- Virtual Private Networks - Automated deployment scripts for personal VPN infrastructure.
- VPN and Networking - Automated setup for personal cloud-based VPNs.
- VPN and Proxy Tools - Simple IPSEC VPN setup for secure cloud connections.
