How to Set Up a VPN

1. General Overview

To set up a VPN, you need three components:

• A server — a VPS or dedicated machine with a public IP address (Ubuntu 22.04 recommended).
• Server software — depends on the protocol you choose.
• A client configuration — a file, link, or QR code that contains your credentials.

After you obtain the client configuration, add it to VanishVPN via Add → From config file, Scan QR code, or Subscription URL.

2. AmneziaWG

How it works

AmneziaWG adds randomization to the handshake packets: magic headers (H1–H4), junk packets (Jc, Jmin, Jmax), and padding (S1, S2). This makes traffic look like random UDP noise to a DPI system, preventing it from being detected as WireGuard.

Server setup

1. 1Install AmneziaWG on your VPS (Ubuntu 22.04+):

   sudo apt update
   sudo apt install -y software-properties-common
   sudo add-apt-repository ppa:amnezia/ppa
   sudo apt update
   sudo apt install -y amneziawg

2. 2Generate server keys:

   awg genkey | tee server.key | awg pubkey > server.pub
   chmod 600 server.key

3. 3Create /etc/amnezia/amneziawg/awg0.conf:

   [Interface]
   Address = 10.8.1.1/24
   ListenPort = 51820
   PrivateKey = <server-private-key>
   
   # Obfuscation parameters
   Jc = 5
   Jmin = 10
   Jmax = 50
   S1 = 53
   S2 = 97
   H1 = 760520328-1745917663
   H2 = 2058660966-2082732542
   H3 = 2145125143-2146405471
   H4 = 2147071696-2147080632
   
   [Peer]
   PublicKey = <client-public-key>
   PresharedKey = <psk>
   AllowedIPs = 10.8.1.2/32

4. 4Start the service:

   sudo systemctl enable --now awg-quick@awg0
   sudo systemctl status awg-quick@awg0

5. 5Open UDP port in firewall:

   sudo ufw allow 51820/udp

Client configuration

A typical .conf file for the client:

[Interface]
PrivateKey = <client-private-key>
Address = 10.8.1.2/32
DNS = 1.1.1.1, 1.0.0.1

Jc = 5
Jmin = 10
Jmax = 50
S1 = 53
S2 = 97
H1 = 760520328-1745917663
H2 = 2058660966-2082732542
H3 = 2145125143-2146405471
H4 = 2147071696-2147080632

[Peer]
PublicKey = <server-public-key>
PresharedKey = <psk>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = your.server.com:51820
PersistentKeepalive = 25

Import into VanishVPN

Save the file as my-server.conf and use Add → From config file. Or paste the entire contents into Add → From text.

3. WireGuard

Server setup

1. 1Install WireGuard:

   sudo apt update
   sudo apt install -y wireguard wireguard-tools

2. 2Generate server keys:

   wg genkey | tee server.key | wg pubkey > server.pub
   chmod 600 server.key

3. 3Create /etc/wireguard/wg0.conf:

   [Interface]
   Address = 10.8.0.1/24
   ListenPort = 51820
   PrivateKey = <server-private-key>
   PostUp   = iptables -A FORWARD -i wg0 -j ACCEPT
   PostUp   = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
   PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
   PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
   
   [Peer]
   PublicKey = <client-public-key>
   PresharedKey = <psk>
   AllowedIPs = 10.8.0.2/32

4. 4Enable IP forwarding:

   echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
   sudo sysctl -p

5. 5Start:

   sudo systemctl enable --now wg-quick@wg0

Client configuration

[Interface]
PrivateKey = <client-private-key>
Address = 10.8.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <server-public-key>
PresharedKey = <psk>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = your.server.com:51820
PersistentKeepalive = 25

Generate client keys

wg genkey | tee client.key | wg pubkey > client.pub
wg genpsk > client.psk

4. OpenVPN

Server setup (using openvpn-install script)

1. 1Download and run the installer:

   curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
   chmod +x openvpn-install.sh
   sudo ./openvpn-install.sh

2. 2Follow the interactive prompts:
   • IP address: default detected
   • Public IP: default
   • Protocol: UDP (faster) or TCP (if UDP is blocked)
   • Port: 1194
   • DNS: 1.1.1.1 or 8.8.8.8
3. 3The script generates /root/my-phone.ovpn. Download it:

   scp root@your-server:/root/my-phone.ovpn .

Client configuration (.ovpn)

client
dev tun
proto udp
remote your.server.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA512
key-direction 1
verb 3

<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>

5. IPSec / IKEv2

Server setup (using Algo)

1. 1Algo is the easiest way to deploy IKEv2:

   git clone https://github.com/trailofbits/algo.git
   cd algo
   python3 -m venv .env
   source .env/bin/activate
   pip install -r requirements.txt

2. 2Edit config.cfg: set server name, users, and VPN mode.
3. 3Run:

   ./algo

4. 4After deployment, find the generated .mobileconfig and .p12 files in configs/<server-ip>/.

Client configuration

IKEv2 uses certificates or PSK. You need:

• Server address: your.server.com
• Username / password (or certificate)
• Pre-shared key (PSK) — for mutual authentication
• CA certificate — to verify the server

Android setup

Android has IKEv2 support built in. Go to Settings → Network → VPN → Add VPN → IKEv2/IPSec MSCHAPv2 and enter the details. Alternatively, import a .mobileconfig profile.

6. XRay Core

Server setup (X-UI panel)

1. 1Install X-UI:

   bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)

2. 2Access the panel at http://your-server:2053 (login: admin, password: admin).
3. 3Change the admin password and the panel port immediately.
4. 4Create an inbound and copy the generated share link (vless://, vmess://, etc.) or QR code.

Client configuration

XRay clients receive a URL that encodes everything. Paste it directly into VanishVPN — the parser handles it automatically.

7. VLESS

Share link format

vless://<uuid>@<host>:<port>?encryption=none&security=tls&sni=<sni>&type=ws&path=/ws&host=<host>#<name>

Key parameters

Example links

VLESS + WebSocket + TLS:

vless://d47ef72b-5f5b-4b56-9d4f-8e1b6c7a2f3e@example.com:443?encryption=none&security=tls&sni=example.com&type=ws&path=/ws&host=example.com#My-VLESS-WS

VLESS + Reality:

vless://d47ef72b-5f5b-4b56-9d4f-8e1b6c7a2f3e@example.com:443?encryption=none&security=reality&sni=www.google.com&fp=chrome&pbk=abcdef123456&sid=12ab34&spx=%2F&type=tcp&flow=xtls-rprx-vision#My-VLESS-Reality

8. VMess

Share link format

VMess links are base64-encoded JSON:

vmess://<base64>

JSON structure

{
  "v": "2",
  "ps": "My Server",
  "add": "example.com",
  "port": "443",
  "id": "d47ef72b-5f5b-4b56-9d4f-8e1b6c7a2f3e",
  "aid": "0",
  "net": "ws",
  "type": "none",
  "host": "example.com",
  "path": "/ws",
  "tls": "tls",
  "sni": "example.com"
}

Key fields

9. Hysteria / Hysteria2

Server setup

1. 1Download Hysteria:

   bash <(curl -fsSL https://get.hy2.sh/)

2. 2Generate a self-signed TLS certificate:

   openssl req -x509 -nodes -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
     -keyout /etc/hysteria/server.key \
     -out /etc/hysteria/server.crt \
     -subj "/CN=your.server.com" -days 3650

3. 3Create /etc/hysteria/config.yaml:

   tls:
     cert: /etc/hysteria/server.crt
     key: /etc/hysteria/server.key
   
   auth:
     type: password
     password: your-secret-password
   
   obfs:
     type: salamander
     salamander:
       password: obfs-secret

4. 4Start the service and open UDP port 443.

Share link format

hysteria2://<password>@<host>:<port>?sni=<sni>&obfs=salamander&obfs-password=<obfs-pass>&insecure=0#<name>

Example link

hysteria2://my-password@example.com:443?sni=example.com&obfs=salamander&obfs-password=obfs-secret#My-Hysteria2

10. Trojan

Server setup

1. 1Install Trojan-Go:

   bash -c "$(curl -fsSL https://raw.githubusercontent.com/trojan-gfw/trojan/master/install.sh)"

2. 2Obtain a TLS certificate with Let’s Encrypt:

   apt install certbot
   certbot certonly --standalone -d example.com

3. 3Create /etc/trojan/config.json:

   {
     "run_type": "server",
     "local_addr": "0.0.0.0",
     "local_port": 443,
     "password": ["your-password"],
     "ssl": {
       "cert": "/etc/letsencrypt/live/example.com/fullchain.pem",
       "key": "/etc/letsencrypt/live/example.com/privkey.pem"
     }
   }

4. 4Start:

   systemctl enable --now trojan

Share link format

trojan://<password>@<host>:<port>?security=tls&sni=<sni>&type=tcp#<name>

Example link

trojan://your-password@example.com:443?security=tls&sni=example.com&type=tcp#My-Trojan

11. Protocol Comparison

12. Import into VanishVPN

All the protocols above can be added to VanishVPN in one of three ways:

1. From config file — pick a .conf, .ovpn, .vpn, or JSON file.
2. Scan QR code — point your camera at a QR generated by your provider or X-UI panel.
3. Subscription URL — paste an https:// link; the app downloads and parses all configs automatically.

Once imported, tap the config to select it, then press Connect. The app will request VPN permission on the first run.