# How to create a VPN server with Google Cloud

## Introduction <a href="#introduction" id="introduction"></a>

Building your own VPN server can be an empowering experience because it puts you in control of your online privacy and promotes your digital autonomy.

While it's possible to set up a VPN server on your own hardware, using a cloud platform offers certain benefits. First, it gives you access to a wide range of server locations, which can be helpful if you're looking to access content that is restricted by geographic location. Plus, cloud platforms allow you to easily adjust your server resources as needed to ensure that your VPN server always runs smoothly.

Google Cloud is another reliable cloud provider for creating virtual machines (VM), joining the ranks of such established platforms as [AWS](https://meshnet.nordvpn.com/~/changes/1En9yEoSh1cmyjIBsnEk/how-to/traffic-routing/vpn-server-with-aws), [Microsoft Azure](https://meshnet.nordvpn.com/~/changes/1En9yEoSh1cmyjIBsnEk/how-to/traffic-routing/vpn-server-with-azure), and [Digital Ocean.](https://meshnet.nordvpn.com/~/changes/1En9yEoSh1cmyjIBsnEk/how-to/traffic-routing/set-up-your-own-vpn-server) Though Google Cloud hosting isn't entirely free, the provider does offer limited resources at no cost.

The article details setting up a VPN server using the capabilities of GCP and the power of Meshnet. Meshnet provides secure connectivity and advanced traffic routing features, enabling seamless access to your VPN server from any location and device.

{% hint style="info" %}
**Note**

While setting up your own VPN server enhances your online privacy, it may not provide the same level of protection as connecting to a standard VPN server offered by NordVPN. NordVPN follows a [strict no-logs policy](https://nordvpn.com/features/strict-no-logs-policy/), which is crucial for ensuring your online activities remain confidential.
{% endhint %}

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

Before you begin, make sure you have a Google Cloud account with billing activated. As a new customer, you are eligible to receive free credits.

<details>

<summary>To sign up for Google Cloud</summary>

1. Go to the [Google Cloud](https://cloud.google.com/) page and select the **Get started for free** button.
2. Sign in with your Google Account if prompted.
3. Specify the required information, accept the terms of service, and select **Continue**.
4. Fill in your billing details and select **Start my free trial**.

</details>

## Create a VM instance on Google Cloud <a href="#create-a-vm-instance-on-google-cloud" id="create-a-vm-instance-on-google-cloud"></a>

This section will guide you through the process of setting up and launching a VM instance using the Compute Engine service offered by Google Cloud.

{% hint style="info" %}
**Note**

Although the guide focuses on setting up an Ubuntu-based VM, the steps below are applicable to other operating system (OS) images available on Compute Engine, such as Windows Server or various Linux distributions.
{% endhint %}

To get started with VM instances on Google Cloud:

1. Sign in to your Google Cloud account.
2. In the Google Cloud console, navigate to the [VM instances](https://console.cloud.google.com/compute/instances) page.
3. If necessary, activate **Compute Engine** by selecting the **Enable** button.

To configure and launch a VM instance:

1. Select **Create instance**.

2. Specify a name for your VM, adhering to the [naming convention](https://cloud.google.com/compute/docs/naming-resources#resource-name-format) for Compute Engine resources.<br>

   <figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FDImayJ1UYjJmBGgLGNdu%2Fgc_vm_name.png?alt=media&#x26;token=1f527682-b15e-4146-bf32-95edac76573c" alt="Entering a name for the virtual machine."><figcaption></figcaption></figure>

3. Select the appropriate region, zone, and machine configuration for your VM instance.

4. Under **Boot disk**, select **Change**, then choose an operating system for your VM, such as Ubuntu, and the latest LTS version.

5. In the **Firewall** section, select **Allow HTTPS traffic** to permit secure web connections to your VM.<br>

   <figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FELjEuLi8hIHurrVfYp3f%2Fgc_vm_https_allow.png?alt=media&#x26;token=7a20a7d2-6656-4e06-88ac-dfac62bb7e82" alt="Allowing HTTPS traffic through the virtual machine&#x27;s firewall."><figcaption></figcaption></figure>

6. Keep the default settings for other configurations.

7. Select **Create** to start the VM.

Your VM instance may require some time to initialize. A green check mark in the **Status** column signifies that the VM is up and running.

## Connect to your instance <a href="#connect-to-your-instance" id="connect-to-your-instance"></a>

You can now access your VM instance from the Google Cloud console by clicking [**SSH**](https://nordvpn.com/cybersecurity/glossary/secure-shell/) in the row of the instance or connecting from your local machine using an SSH client. This guide will concentrate on the latter approach.

### Generate an SSH key pair  <a href="#generate-an-ssh-key-pair" id="generate-an-ssh-key-pair"></a>

To connect to the VM instance from a local machine using SSH, it is necessary to have a public-private key pair for authentication. To create a new SSH key pair:

1. Open the terminal on your local machine.
2. Enter the following command, replacing `</path/key-filename>` with the desired path and filename for the key pair and `<username>` with the username associated with your VM instance:<br>

   <pre class="language-bash" data-overflow="wrap"><code class="lang-bash">ssh-keygen -t rsa -f &#x3C;/path/key-filename> -C &#x3C;username>
   </code></pre>

   \
   **Example**

   <pre class="language-bash" data-overflow="wrap"><code class="lang-bash">ssh-keygen -t rsa -f /Users/MeshnetUser/Desktop/keys/ssh_key_meshnet -C meshnet_user
   </code></pre>

   \
   This command generates a private key (`key-filename`) and a public key (`key-filename.pub`) at the specified path.

{% hint style="info" %}
**Note**

If you are using a Windows machine, specify the custom path using the Windows format, such as `C:\path\key_filename`.
{% endhint %}

### Set permissions for the private key <a href="#set-permissions-for-the-private-key" id="set-permissions-for-the-private-key"></a>

To protect your private key, make sure that only you have read access to it by setting the appropriate permissions.

{% tabs %}
{% tab title="From Windows" %}

1. Right-click the private key.
2. Select **Properties**, choose the **Security** tab, and click **Advanced**.
3. Click **Disable inheritance** > **Convert inherited permissions into explicit permission on this object.**
4. Back in the **Advanced security settings** window, remove access for all users except your own account by selecting a permission entry and clicking **Remove**.<br>

   <figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FzZ8jla6dyPkpQG7Qajsr%2Fgc_key_permissions_win.png?alt=media&#x26;token=89c448ec-da3a-423c-a95d-aa6ef198a863" alt="Removing permissions for other users."><figcaption></figcaption></figure>

{% endtab %}

{% tab title="From macOS or Linux" %}

1. Open the terminal.
2. Enter the `chmod 400` command followed by the path to the generated private key:<br>

   <pre class="language-bash" data-overflow="wrap"><code class="lang-bash">chmod 400 &#x3C;/path/private-key-filename>
   </code></pre>

   \
   **Example**

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2Fx3xli28mHSQhm3dXUw6r%2Fgc_key_permissions_unix.png?alt=media&#x26;token=e1031be0-9cd0-441e-b9c8-e1838483c1d4" alt="Running the &#x27;chmod 400&#x27; command in the terminal."><figcaption></figcaption></figure></div>

{% endtab %}
{% endtabs %}

### Add the public key to instance metadata <a href="#add-the-public-key-to-instance-metadata" id="add-the-public-key-to-instance-metadata"></a>

To associate the public key with your VM instance, add it to the instance metadata, as follows:

1. On your local computer, open the terminal (**PowerShell** on Windows).

2. Display the contents of the public SSH key file by entering the `cat` command followed by the path to the file.<br>

   <pre class="language-bash" data-overflow="wrap"><code class="lang-bash">cat &#x3C;/path/public-key-filename>
   </code></pre>

   \
   **Example**

   <pre class="language-bash" data-overflow="wrap"><code class="lang-bash">cat /Users/MeshnetUser/Desktop/keys/ssh_key_meshnet.pub
   </code></pre>

   &#x20;

3. The contents of your SSH key will be displayed in the terminal. Select and copy the output.<br>

   <figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2Fb6pSHKhk0yjMi6w7LDe8%2Fgc_key_content.png?alt=media&#x26;token=ee373fb6-bcd6-4aa1-ae40-3086db83642e" alt="Content of the SSH key displayed in the terminal window."><figcaption></figcaption></figure>

4. Navigate to the [VM instances](https://console.cloud.google.com/compute/instances) page and click the name of your VM.

5. Click **Edit** at the top of the page.<br>

   <figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FLAOMkxRzOT6ARdev3WIO%2Fgc_edit_instance.png?alt=media&#x26;token=3bfd77ea-6556-4a6a-bed9-059163407fce" alt="Clicking &#x27;Edit&#x27;."><figcaption></figcaption></figure>

6. Scroll down to the **Security and access** section, and under **SSH Keys**, click **Add item**.

7. Paste the public key you copied earlier into the text box and click **Save**.

### Access the VM via SSH <a href="#access-the-vm-via-ssh" id="access-the-vm-via-ssh"></a>

{% hint style="info" %}
**Note**

By default, Compute Engine VMs created from public images do not permit root login with a password over SSH.
{% endhint %}

To establish an SSH connection to your VM instance:

1. Locate the external IP address of your VM instance on the **VM instances** page of the Google Cloud console.\
   &#x20;

   <figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FufFn7Jp6FnhqtMhjNxHZ%2Fgc_external_ip.png?alt=media&#x26;token=531681b1-31d6-471b-a24f-224932c51e5c" alt="External IP address of the Google Cloud instance."><figcaption></figcaption></figure>

2. Open the terminal on your local machine.

3. Enter the command below, replacing the placeholders with the appropriate values for your VM instance, where:
   * `</path/private-key-file>` is the path to your private SSH key file.
   * `<username>` is the username you specified when generating the key pair.
   * `<external-ip-address>` is the external IP address of your VM instance.<br>

     <pre class="language-bash" data-overflow="wrap"><code class="lang-bash">ssh -i &#x3C;/path/private-key-file> &#x3C;username>@&#x3C;external-ip-address>
     </code></pre>

     &#x20;

     **Example**

     <pre class="language-bash" data-overflow="wrap"><code class="lang-bash">ssh -i /Users/MeshnetUser/Desktop/keys/ssh_key_meshnet meshnet_user@34.29.223.197
     </code></pre>

     &#x20;

4. When establishing a connection to the server for the first time, the SSH client asks you to review and confirm the host key's fingerprint. To proceed with the connection, type `yes` in response to the prompt.

You should now be successfully connected to your VM instance.

## Install NordVPN on the instance <a href="#install-nordvpn-on-the-instance" id="install-nordvpn-on-the-instance"></a>

To set up NordVPN on your instance, follow these steps:

1. Download and install the NordVPN Linux client by entering this command in the instance terminal:<br>

   ```bash
   sh <(wget -qO - https://downloads.nordcdn.com/apps/linux/install.sh)
   ```

2. Log in to your NordVPN account.

### Log in to NordVPN <a href="#log-in-to-nordvpn" id="log-in-to-nordvpn"></a>

You can log in to your NordVPN account without the use of a graphical user interface (GUI) in two ways:

* By running the `nordvpn login` command with the `--token` flag
* By running the `nordvpn login` command with the `--callback` flag

Instructions for both methods are outlined below.

{% tabs %}
{% tab title="Log in using a token" %}

1. On any device, log in to your [Nord Account](https://my.ndaccount.com/) dashboard and, under **NordVPN Meshnet free**, select **View details**.<br>

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2Fsn49VgeZ6NMI13J7Ki1N%2Ftoken_generate0.png?alt=media&#x26;token=a773ba2c-27a9-4e88-b7bf-c4fe60cd2d42" alt="Clicking the &#x27;View details&#x27; button under NordVPN Meshnet free." width="563"><figcaption></figcaption></figure></div>

2. Scroll down until you see **Manual setup**, and select **Set up NordVPN manually**.<br>

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FxwVDJGsloM478lIwWmfG%2Fucp_setup_manualy.png?alt=media&#x26;token=601786ee-711d-46a1-8466-d946e7acd57b" alt="Clicking the &#x27;Set up NordVPN manually&#x27; button." width="563"><figcaption></figcaption></figure></div>

3. Enter the verification code sent to your email address.

4. Under **Access token**, select **Generate new token**.<br>

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2F4PoIcgMGswTyRI8d8b0i%2Ftoken_generate.png?alt=media&#x26;token=c0502a41-fdea-4212-bb19-5e1eb19638ba" alt="Clicking &#x27;Generate new token&#x27;" width="563"><figcaption></figcaption></figure></div>

5. In the dialog that appears, choose either a token that expires in 30 days or one that never expires, and then select **Generate token**.<br>

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2Fw2MaEvL5cIVshJPYkTbG%2Ftoken_generate2.png?alt=media&#x26;token=82907065-348b-4f0b-bee2-9ea49245a74a" alt="Selecting the token expiration date." width="563"><figcaption></figcaption></figure></div>

6. Select **Copy and close**.

7. On your VM, enter the `nordvpn login --token` command along with the copied token:<br>

   ```bash
   nordvpn login --token <your_token>
   ```

   \
   **Example**

   <pre class="language-bash" data-overflow="wrap"><code class="lang-bash">nordvpn login --token 3fe460cefb8dcf1478c92e45908cec9f9bdbadf7a456a6dfb35dc2c58ee39d5b
   </code></pre>

You should now see a welcome message.

{% hint style="success" %}
**Tip**

To preserve your token when logging out of the NordVPN app, use the `nordvpn logout --persist-token` command. Otherwise, your token will be revoked.&#x20;
{% endhint %}
{% endtab %}

{% tab title="Log in using a URL" %}

1. Run the following command:<br>

   ```bash
   nordvpn login
   ```

2. Open the provided link on any device in your browser.

3. Complete the login procedure.

4. Right-click the **Continue** button and select **Copy link address**.

5. Run the following command, replacing `<URL>` with the previously copied link address:<br>

   ```bash
   nordvpn login --callback "<URL>"
   ```

   \
   **Example**

   <pre class="language-bash" data-overflow="wrap"><code class="lang-bash">nordvpn login --callback "nordvpn://login?action=login&#x26;exchange_token=MGFlY2E1NmE4YjM2NDM4NjUzN2VjOWIzYWM3ZTU3ZDliNDdiNzRjZTMwMjE5YjkzZTNhNTI3ZWZlOTIwMGJlOQ%3D%3D&#x26;status=done"
   </code></pre>

You should now see a welcome message.
{% endtab %}
{% endtabs %}

{% hint style="info" %}
**Note**

If you encounter the error message “Whoops! Permission denied accessing /run/nordvpn/nordvpnd.sock,” enter `sudo usermod -aG nordvpn $USER`. Then, exit and log back in to your instance.
{% endhint %}

## Enable Meshnet <a href="#enable-meshnet" id="enable-meshnet"></a>

On your instance, [enable Meshnet](https://meshnet.nordvpn.com/~/changes/1En9yEoSh1cmyjIBsnEk/getting-started/how-to-start-using-meshnet/using-meshnet-on-linux) by typing this command:

```bash
nordvpn set meshnet on
```

To view the Nord name and Meshnet IP address of your instance, enter the following command.

```bash
nordvpn meshnet peer list
```

Additionally, you will see all the devices connected to your network. Depending on the [permissions](https://meshnet.nordvpn.com/~/changes/1En9yEoSh1cmyjIBsnEk/features/explaining-permissions/traffic-routing-permissions) granted to each device, they will have access to this server via Meshnet.

## Route traffic through your server <a href="#route-traffic-through-your-server" id="route-traffic-through-your-server"></a>

To begin using your instance as a VPN server, you need to route traffic from a client device through the instance. Follow these steps:

1. On your client device, open **NordVPN** and log in to your account.
2. Start routing traffic through the linked host device you set up.\
   \
   **Example**

   <div align="left"><figure><img src="https://3559400189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0cTezbT2vN0lurEio8Z5%2Fuploads%2FVenaqZQqblqGSVlLhDNy%2Fgc_start_routing.png?alt=media&#x26;token=5f4f769f-5097-449f-9875-ef0485d350f1" alt="Clicking &#x27;Route all traffic&#x27; on the Windows NordVPN application."><figcaption></figcaption></figure></div>

   \
   For detailed guidance on enabling traffic routing, refer to [Routing traffic in Meshnet](https://meshnet.nordvpn.com/~/changes/1En9yEoSh1cmyjIBsnEk/features/routing-traffic-in-meshnet#see-also).

[Your device's IP address](https://nordvpn.com/what-is-my-ip/) should now match the public IP address of your instance. This way, your real IP address remains secure, and the websites you visit will detect the location of your VPN server instead of your actual device.
