jackh0006/openvpn-stealth-wizard

openvpn-stealth-wizard

Beautiful terminal wizard that builds a stealth OpenVPN server: VPN on TCP port 443 with a real decoy website on the same port (port-share), password / cert-only / testing no-auth login, TCP+UDP+both protocols, custom ports, Cloudflare DNS, and import-ready .ovpn with DNS-bypass fallback.

Born from a real deployment runbook. Every lesson is now code. v0.5.0 fixes the “connects but no traffic” bug (WAN auto-detect, persistent NAT, MSS on egress, block-outside-dns) and adds a smart --doctor.

Like I'm 5: pick TCP-stealth (hides as a website, port 443) or UDP-fast (quicker) or BOTH (two files, phone tries fast then stealth). Pick a login: password+file (safest), file-only (easier), or no-login testing (insecure!). Use IP now or domain later. Cloudflare MUST be grey cloud (DNS-only) for VPN — orange cloud (proxied) breaks VPN. Every screen explains why + streams live logs.

Installation (one command)

On your Ubuntu server, as root, paste this one line and press Enter:

curl -sSL https://raw.githubusercontent.com/jackh0006/openvpn-stealth-wizard/main/install.sh | sudo bash

That's it. It finds your chip (amd64/arm64), downloads the newest version, installs it as wizard, and proves it works. Then:

sudo wizard          # pretty guided setup (recommended)
wizard --help        # every command with examples

Manual way (if you don't trust pipes):

# amd64 (most VPS servers) — file inside is named `wizard`
curl -sSL -o vpn.tar.gz https://github.com/jackh0006/openvpn-stealth-wizard/releases/latest/download/openvpn-stealth-wizard_0.1.0_linux_amd64.tar.gz
# arm64 (Ampere / Pi servers): same link with _arm64.tar.gz
tar xzf vpn.tar.gz && chmod +x wizard && sudo mv wizard /usr/local/bin/
wizard --version

Verify checksums against checksums.txt from the same release page.

Prerequisites: Ubuntu 22.04/24.04, root, a public IP, and (domain mode) a DNS A record pointing at the server. If your mobile carrier blocks the domain's DNS (common!), the wizard adds a raw-IP fallback automatically — give it --fallback YOURSERVERIP.

Quick start (2 minutes to first green check)

# 1. Taste it — read-only health check, changes NOTHING (safe anywhere)
./wizard --check --mode domain --host vpn.example.com \
  --user alice --pass 'secret' --email admin@example.com
# ✔ / ✘ table + exit code: 0 = healthy, 1 = something missing

# 2. Guided install — run with no flags for the pretty TUI
sudo ./wizard
# mode → inputs (prefilled) → plan preview → live logs → health check → done card

# 3. Scripted install — same thing, no questions asked
sudo ./wizard --non-interactive --yes \
  --mode domain --host vpn.example.com --fallback 203.0.113.10 \

4. Repair later — re-applies only missing pieces

sudo ./wizard --non-interactive --yes --fix ... (same flags)

IP-only? Swap `--mode domain --host vpn.example.com` for
`--mode ip --host 203.0.113.10` (no email needed). Custom port? Change
`--port` (443 recommended: looks like a normal website).

## Manage existing servers (TUI `manage` mode or flags)