The author developed a personal VPN infrastructure using OpenVPN on virtual servers. The system evolved from a single server with four profiles to a multi-node setup incorporating Telegram-based management for profile creation, distribution, and revocation.
The architecture utilizes a Telegram bot to handle user access. Profiles are generated using Easy-RSA, with specific configurations for different devices. The system ensures unique identification for each profile by using the Common Name (CN) field within the certificates.
To manage distribution securely, the author implemented a two-step verification process. A temporary 24-hour invitation link is generated, requiring the owner to confirm the recipient's Telegram ID before the .ovpn file is sent via a private chat session.
The infrastructure includes diagnostic tools and session logging stored in an SQLite database. The author addressed security risks by avoiding shell execution for diagnostic commands and implementing transaction-based logic for token validation to prevent unauthorized access.
The setup supports multiple entry points, including a Windows-based TCP handler that routes traffic to OpenVPN instances. This allows for flexible routing while maintaining centralized control over profile lifecycle management through the Telegram bot.
