MirageVPN: an implementation of the OpenVPN protocol as MirageOS unikernels

2023-03-01

A Virtual Private Network (VPN) enables the virtual interconnection of physically separate networks. It utilizes the Internet as a transport medium and encrypts the connection. Use cases include, for example, integrating a laptop into the home network while away, facilitating collaboration across different locations, and so on. OpenVPN is a widely used VPN implementation that ensures confidentiality and integrity. In this project, we aim to develop a robust, resource-efficient OpenVPN client. This client can be deployed on any computer, regardless of the operating system. We are using the MirageOS unikernel operating system as the foundation.

In 2019, we received funding from German ministry for science and education via prototypefund to develop an OpenVPN library in OCaml as a MirageOS unikernel.

The funding amount was 48_500€. Involved were Joe and Hannes.

OpenVPN is a virtual private network protocol used widely. We worked on the protocol in 2019, and mainly developed an OpenVPN client which is in use. This proposal is three-fold: (a) extend our OpenVPN library with newer features (such as OCC and tls-crypt v2) to polish the existing unikernels, (b) develop a OpenVPN client unikernel that fits smoothly in QubesOS, and (c) develop a OpenVPN server unikernel to run on your premises (home router, server).

The importance of self-hosted VPN services is huge, since various VPN providers are not trustworthy. An OpenVPN implementation which is developed in a memory safe programming language, which is interoperable with existing other implementations, uses less resources, and is easier to maintain, is crucial for non-experts that want to setup their VPN and not spend days on it.

With our recent development of reproducible binary builds, updating a unikernel is easy, and the changes in used libraries can be explored before doing an update. We will document a OpenVPN server setup, including log facilities, monitoring, troubleshooting. All your computers, and those from your friends and family can use your OpenVPN server.

In 2023, we received funding from European Union in the Next Generation Internet project (NGI assure, via NLnet. The scope was updating to the current protocol version (tls-crypt-v2 etc.), a QubesOS client, a server implementation, and more documentation. The amount was 57_000€.

Involved in the second project were Reynir, Romain, and Hannes.

We still maintain this project, and based on our needs extend it. The most recent addition was adding a TLS-plain mode, i.e. without further integrity (hashing).