0. Preparation
0.1 Open Ports on Ubuntu
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
0.2 Remove the Firewall
apt-get purge netfilter-persistent
apt-get remove ufw
reboot
0.3 Add an A Record for the Domain and Point It to the Server IPv4 Address
Cloudflare users should mainly disable DNS proxying.
Ping your domain name. If it returns your server IP address, it is fine.
For example: a.xyz.com
1. Install Script
curl -fsSL https://raw.githubusercontent.com/TrustTunnel/TrustTunnel/refs/heads/master/scripts/install.sh | sh -s -
2. Endpoint Configuration
cd /opt/trusttunnel/
./setup_wizard -h
sudo ./setup_wizard
2.1 The address to listen on, use 0.0.0.0:443 for all interfaces on the HTTPS port, default 0.0.0.0:443
Press Enter to use the default.
2.2 Path to the credentials file, default credentials.toml
Press Enter to use the default.
2.3 Username
Enter the VPN account username.
2.4 Password
Enter the VPN password.
2.5 Add One More User? yes or no
Choose yes if you need more users. If not, choose no.
2.6 Path to the Rules File, Default rules.toml
Press Enter to use the default.
2.7 Do You Want to Configure Connection Filtering Rules? If Not, All Connections Will Be Allowed
Choose no, or press Enter to use the default.
2.8 Path to a File to Store the Library Settings, Default vpn.toml
Press Enter to use the default.
2.9 How Would You Like to Create a Certificate?
Choose Issue a Let's Encrypt certificate (requires a public domain).
2.10 Enter Your Domain Name, Which Must Be Publicly Accessible
Enter something like a.xyz.com.
2.11 Enter Your Email Address for Let’s Encrypt Notifications
Enter any certificate email address.
2.12 Select Challenge Method
Choose HTTP-01 (requires port 80 accessible from internet).
2.13 Use Let’s Encrypt Staging Environment for Testing? Recommended for First Attempt
The default is no. Press Enter directly.
2.14 Do You Want to Configure Alternative SNIs?
Choose no.
2.15 Path to a File to Store the TLS Hosts Settings, Default hosts.toml
Use the default.
2. Enable Auto-Start on Boot
cd /opt/trusttunnel/
cp trusttunnel.service.template /etc/systemd/system/trusttunnel.service
sudo systemctl daemon-reload
sudo systemctl enable --now trusttunnel
Start the Service
sudo systemctl start trusttunnel
3. Update the Server
Before updating, remember to stop the endpoint:
sudo systemctl stop trusttunnel
The installation script always installs the latest available version. Therefore, to update your installation, run the installation command again:
curl -fsSL https://raw.githubusercontent.com/TrustTunnel/TrustTunnel/refs/heads/master/scripts/install.sh | sh -s -
Restart the endpoint after updating:
sudo systemctl start trusttunnel
