How to setup your own VPN with macOS Server

Want a VPN but don't want to trust a third-party service? Roll your own with macOS Server!

If you've decided you need a virtual private network (VPN) but you don't want to pay for a third-party VPN service](/what-look-when-choosing-vpn-provider, then macOS Server can be a great alternative. It's built on the macOS you already know and love and lets you quickly and easily get your very own VPN up and running.

Set up macOS Server

If you haven't already done so, download and install macOS Server and optionally enable remote administration for easier setup.

Find your router's internet facing IP Address

Before we begin with the actual setup of the VPN service, you'll need to know your internet "co-ordinates" — your router's IP address.

It's quite easy to determine your current IP address simply by Googling: "What is my IP Address". Most home users have what's called a dynamic IP address, though. That means that your router's IP address may change every so often.

If you use a dynamic IP address to setup your VPN service, there is no guarantee that you'll have that IP address will still be yours in the future, and the remote connection will fail.

To work around this, there are a number of dynamic domain name services you can purchase. That way, you'll get an alias known as a "host name" that won't change, even if your IP address does.

Many ISP's also offer what's known as static IP address. These are typically used for business accounts but, depending on your ISP, can be available for an addition fee.

Once you have your static IP address or have a host name for your dynamic IP address, you can go on and configure your VPN service in macOS Server.

Configure the macOS Server VPN service

1. Launch the Server app from your applications.
2. Log into your macOS Server.

3. Select VPN under the Services listings.

   

4. Under VPN Host Name, enter either your static IP address or dynamic host name depending the method you used when finding out your IP address above.

5. Click Edit Permissions and select the users you want to be able to connect to your VPN.

   

6. Create a new Shared Secret. The more complicated and random the better.
7. Optionally click Client Addresses if you want to change the number of VPN clients that can simultaneously connect to your VPN server.
8. Optionally click DNS Settings if you want to change the default DNS server your VPN clients will use when connected to your VPN server.
9. Optionally click Routes if you need special networking routes you need to configure.
10. Optionally click Save Profile if you wish to create a configuration file so that clients can simply load your server's connection information for easier client setup.
11. Select your macOS Server computer name.

12. Select the Access tab.

    

13. Click the Add button (looks like +) and select VPN.
14. Select Allow Connections From only some users.
15. Enter the users you wish to have VPN access.
16. Click OK.
17. Select VPN under the Services listings.
18. Toggle the ON/OFF switch to On.

If you're on a Apple-centric network with an Airport Base Station, you'll be prompted to automatically setup your Airport Base Station to allow for connections to your macOS Server VPN service.

If you don't have an Apple Airport Base Station, you'll have to manually setup your router to allow for VPN traffic to travel through your router to your macOS Server. Here's how!

Allow VPN traffic through your router to macOS Server

Depending on who manufactured your router, you'll have to consult the documentation from the manufacturer to be able to allow VPN traffic to your internally networked macOS Server running the VPN service. The ports you need to have forwarded to your macOS Server are UDP 500, UDP 1701 and UDP 4500. Here is what it would like like on an Airport Base Station if you were to manually set up port forwarding of VPN traffic.

1. Launch Airport Utility.

2. Select your router and click Edit.

   

3. Select the Network tab at the top.
4. Under Port Settings click the +.
5. Type VPN in the Description.
6. In Public UDP Ports type in 500, 1701, 4500.
7. In Private IP Address enter the internal IP address of your macOS Server running the VPN service.

8. In Private UDP Ports type in 500, 1701, 4500.

   

9. Click Save.
10. Click Update and allow your Airport Base Station to restart.

Connect using your various clients

All you have left to do is connect with your various client devices! The VPN service on macOS Server is using L2TP over IPSec as it's authentication module so simply select that version of VPN when you setup your clients. Enter your user name and password as well as your shared key you created above.

How to configure and connect to a VPN on iPhone and iPad

Have you set up a macOS Server VPN?

The benefits of VPN access go beyond just having a secure connection to your home or office network. It allows for having encrypted traffic so that your private usage remains exactly that. Private. It offers a layer of protection from hackers trying to get access to your passwords. It deters ISPs from collecting your browsing habits.

Have you set up a macOS Server VPN? Are you planning to? Leave a comment or question below!