--- title: "Configuring Veltar VPN Server" slug: "configuring-veltar-vpn-server" updated: 2025-09-23T09:11:45Z published: 2025-09-23T09:11:45Z canonical: "help.scalefusion.com/configuring-veltar-vpn-server" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt > Use this file to discover all available pages before exploring further. # Configuring Veltar VPN Server The first step to allow managed devices to access internal resources is to set up a VPN server. To setup VPN server, 1. On Scalefusion Dashboard, navigate to **Veltar > VPN Tunnel** and click on **Setup VPN Server** ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-PEISY1D4.png) 2. In the next window, perform the following steps 1. Download and install the Veltar VPN server and its dependencies 2. Install Veltar VPN server 3. Configure the Veltar VPN API server that is bundled in the solution and generate the required API keys 4. Complete setup and make it available on a public IP. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-WBQ3IHI8.png) ## Prerequisites ### Hardware & Software 1. A server running a compatible Linux distribution (e.g., Ubuntu 20.04 LTS or later) with the following configuration, 1. CPU: 4vCPU 2. RAM: 4GB+ 3. Storage: 100GB+ 4. Network: 10Gbps connection 5. Concurrent Users: Up to 500 6. Traffic: 10 TB+/month 2. Administrator (root) access to the the server machine ### Network Requirements 1. Static Public IP Address 2. Registered domain name (optional) ### SSL Certificate Requirements 1. Domain Certificate 2. Intermediate Certificate 3. Private Key ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-47Q2BSR3.png) ## Install Dependencies Open a terminal on your server and run the following commands to install required tools: ```plaintext sudo apt-get update sudo apt-get install wireguard wireguard-tools ``` Example output: ```plaintext Reading package lists... Done Building dependency tree       Reading state information... Done wireguard-tools is already the newest version (1.0.20200513-1~18.04.1). 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. ``` ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-E2NGDXQ5.png) ## Install Veltar VPN Server ### Download Veltar VPN Server Click on the **Download** button to download the Veltar VPN package to your server. The file name will look like `veltar-vpn_X.X.X_amd64.deb`, where X.X.X is the version number. ### Run command to Install Veltar VPN server In the terminal, navigate to the directory where you downloaded the package and run the following command: Note: Currently, the installation process is manual. Automated installation via dashboard script (similar to Tux Agent) will be available soon. ```plaintext sudo dpkg -i veltar-vpn_X.X.X_amd64.deb ``` Replace X.X.X with the actual version number of your downloaded package. Example output: ```plaintext Selecting previously unselected package veltar-vpn. (Reading database ... 72591 files and directories currently installed.) Preparing to unpack veltar-vpn_1.2.3_amd64.deb ... Unpacking veltar-vpn (1.2.3) ... Setting up veltar-vpn (1.2.3) ... ``` ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-FI1PFHJ9.png) ## Configuring Veltar VPN for Scalefusion MDM Integration To configure Veltar VPN for integration with Scalefusion MDM, use the following command: ```plaintext sudo veltar-vpn-ctl setup ``` This command will guide you through the configuration process. See the detailed Setup Instructions below: ### Running the Setup Script To begin the setup process, run: ```plaintext sudo veltar-vpn-ctl setup ``` ### Step-by-Step Configuration Process 1. **Domain/IP Configuration** - Enter the domain or public IP for integrating Veltar VPN with Scalefusion MDM. - Example: `Enter the domain or Public IP for integrating Veltar VPN with Scalefusion MDM: example.com` 2. **Protocol Selection** ```plaintext Which schema would you like to use? 1. HTTP (not recommended for production) 2. HTTPS Enter your choice (1 or 2): ``` - Choose between HTTP and HTTPS (HTTPS is strongly recommended for production). 3. **Port Configuration** a. For HTTP: b. For HTTPS: - Enter the internal port number: `Enter the internal port number for Veltar VPN:` - Enter the external port number: `Enter the external port number (or press Enter if same as internal):` - Enter the HTTPS port number: `Enter the HTTPS port number:` 4. **SSL Certificate Configuration (HTTPS only)** - Choose how to provide certificates: ```plaintext How would you like to provide the certificates and key? Enter 'F' to provide file paths, or 'P' to paste the content directly: ``` - Provide the Domain SSL Certificate, Intermediate SSL Certificate (optional), and SSL Private Key. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-3TARSSK3.png) ## Complete Setup ### Display the API Bearer Token (for Scalefusion MDM integration): Run the following command to get the API Token: ```plaintext sudo veltar-vpn-ctl api-token-display ``` Example output: ```plaintext API Bearer Token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... Keep this token safe and do not share it! ``` ### Network Architecture Considerations 1. **Direct Internet Connection** - Use the public IP or domain name of your server. - Ensure configured ports are open and accessible from the internet. 2. **Behind a NAT/Firewall** - Use the public IP or domain name that points to your NAT/Firewall. - Configure port forwarding on your NAT/Firewall. 3. **Load Balanced Environment** - Use the domain name that points to your load balancer. - Configure load balancer to forward traffic to Veltar VPN server(s). - Enable session persistence if running multiple instances. 4. **Reverse Proxy Setup** - Use the domain name that points to your reverse proxy. - Configure reverse proxy to forward requests to the Veltar VPN server. - Ensure proper SSL termination if using HTTPS. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-DKDA9T9O.png) Now that you have completed the VPN server setup, please proceed to configure a VPN Tunnel that will allow access to the resources via this VPN server. ## Basic Usage After installation, you can use the following commands to manage Veltar VPN: ### Check Veltar VPN status: ```plaintext sudo veltar-vpn-ctl status ``` Example output: ```plaintext run: haproxy: (pid 12345) 134s; run: log: (pid 12346) 134s run: postgresql: (pid 12347) 134s; run: log: (pid 12348) 134s run: veltar-vpn: (pid 12349) 134s; run: log: (pid 12350) 134s ``` ### View Veltar VPN logs: ```plaintext sudo veltar-vpn-ctl tail ``` Example output: ```plaintext 2024-10-11_09:15:23.12345 [INFO] Veltar VPN started successfully 2024-10-11_09:15:24.67890 [INFO] Listening on port 80 ``` ## Advanced Configuration ### Rotating the API Bearer Token To change the API Bearer Token: ```plaintext sudo veltar-vpn-ctl api-token-rotate ``` Example output: ```plaintext Security Warning: Rotating the API Bearer Token will invalidate the current one. Ensure any dependent systems are updated with the new token! Rotating API Bearer Token... Rotated API Bearer Token successfully. New token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... Keep this token safe and do not share it! ``` Important: After rotation, immediately update the token in your Scalefusion MDM integration to maintain connectivity. ## Update VPN Build on VPN Server Here are the step-by-step instructions to update the existing VPN build on the VPN server: ### Prerequisites 1. Access to the VPN server via SSH. 2. Root or sudo privileges on the VPN server. 3. The latest `.deb` build file available locally. ### Steps to Update the VPN Build **1. Copy the New Build to the VPN Server** From your local machine, copy the latest build file to the VPN server: ```plaintext scp veltar-vpn_.deb user@:~/ ``` This will place the `.deb` file in the user’s home directory on the server. Replace: `<latest_version>` → version string of the new build (e.g., `2.0.0~20250912051708-0_amd64`) **2. Install the New Build** Log in to the VPN server and install the package: ```plaintext dpkg -i veltar-vpn_.deb ``` This installs the new VPN package over the existing one. **3. Restart the VPN Service** Restart the service to apply the new build: ```plaintext systemctl restart veltar-vpn-runsvdir.service ``` ## Frequently Asked Questions (FAQ) Q: How often should I rotate the API Bearer Token? A: It is recommended to rotate the token every 90 days or immediately if you suspect it has been compromised. Q: Can I use Veltar VPN without Scalefusion MDM? A: No, Veltar VPN is designed to work seamlessly with Scalefusion MDM only. Q: What should I do if I forget to update the API Bearer Token in Scalefusion after rotation? A: If this happens, your devices will not lose the connection. However, you will not be able to create new tunnels or publish VPN on devices. Simply update the token in Scalefusion as soon as possible to restore full functionality. Q: How can I check if Veltar VPN is running correctly? A: Use the following command to check the status of all Veltar VPN services: ```plaintext sudo veltar-vpn-ctl status ``` This will show the status of HAProxy, PostgreSQL, and the main Veltar VPN service. Q: What ports do I need to open for Veltar VPN? A: You need to open: 1. The port configured for the web interface (HTTP or HTTPS) 2. UDP port(s) for VPN tunnels (e.g., 51820-51830) Always ensure these ports are properly secured and only accessible as needed.