Quincy is a VPN client and server implementation using the QUIC protocol.
Quincy uses the QUIC protocol implemented by quinn to create an encrypted tunnnel between clients and the server.
This tunnel serves two purposes: - authentication using a reliable bidirectional stream - data transfer using unreliable datagrams (for lower latency and avoidance of multiple reliability layers)
After a connection is established and the client is authenticated, a TUN interface is spawned using an IP address provided by the server.
When all is set up, a connection task is spawned, which handles IO on the TUN interface and the QUIC connection, effectively relaying packets between them.
The tokio runtime is used to provide an efficient and scalable implementation.
Binaries are at the moment available for Linux x86_64 and are attached to every release from 0.2.0 on GitHub.
Using cargo, installation of published version can be done with a simple command:
bash
$ cargo install quincy
As Quincy does not rely upon any non-Rust libraries, the build process is incredibly simple:
bash
$ cargo build
If you additionally want to build Quincy in release mode with optimizations, add the --release switch:
bash
$ cargo build --release
The resulting binaries can be found in the target/debug and target/release directories.
Quincy is split into 3 binaries:
- client: The VPN client
- server: The VPN server
- users: A utility binary meant for managing the users file
The Quincy client requires a separate configuration file, an example of which can be found in examples/client.toml:
```toml
connection_string = "quincy:55555"
[authentication]
username = "test"
password = "test"
trustedcertificates = ["examples/cert/cacert.pem"]
[connection]
mtu = 1400
[log]
level = "info" ```
With the configuration file in place, the client can be started using the following command:
bash
$ quincy-client --config-path examples/client.toml
Routes are set up by default on some systems (Linux) and not set-up at all on others (MacOS).
The Quincy server requires a separate configuration file, an example of which can be found in examples/server.toml:
```toml
[tunnels.tun0]
name = "tun0"
certificatefile = "examples/cert/servercert.pem"
certificatekeyfile = "examples/cert/server_key.pem"
address_tunnel = "10.0.0.1"
address_mask = "255.255.255.0"
users_file = "examples/users"
[connection]
mtu = 1400
[log]
level = "info" ```
With the configuration file in place, the client can be started using the following command:
bash
$ quincy-server --config-path examples/server.toml
The users utility can be used to manage entries in the users file.
The users file contains usernames and password hashes in the following format (examples/users):
test:$argon2id$v=19$m=19456,t=2,p=1$S9rMLOcz/dnYN4cnyc/TJg$ES0p+DErLfcWoUJ2tvZlxZSSIGYNUEe0ZpKBDz7MOj0
The following command can be used to add users to this file:
bash
$ quincy-users --add examples/users
The prompts will look something like this:
Enter the username: test
Enter password for user 'test':
Confirm password for user 'test':
A similar command can be used to remove users from the file:
bash
$ quincy-users --remove examples/users
The prompt will again look something like this:
Enter the username: test
There are a couple of options when it comes to setting up the certificates used by Quincy.
This is the proper way to manage certificates with Quincy.
You can either request/pay for a certificate from a service with a globally trusted CA (Let's Encrypt, GoDaddy, ...) or generate your own certificate authority and then sign an end-point certificate.
If you have a certificate signed by a globally trusted CA, you can simply add it to the server configuration file and run Quincy. The client will trust the certificate, as the signing certificate is most likely in the system's trusted root certificate store.
If you have a certificate signed by your own (self-signed) CA, follow the steps above and additionally add your CA certificate to the client configuration file.
You can use mkcert for generating your own CA certificate and using it to sign an end-point certificate.
This is an easier set up that might be used by home-lab administrators or for local testing.
The steps to generate a self-signed certificate that can be used with Quincy:
1) Generate a private key (I use ECC for my certificates, but RSA is fine)
$ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out <your_certificate_key_file>
2) Generate a certificate request (you can fill out the fields with whatever information you want)
```
$ openssl req -new -key
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
Country Name (2 letter code) [AU]:XX State or Province Name (full name) [Some-State]:. Locality Name (eg, city) []:. Organization Name (eg, company) [Internet Widgits Pty Ltd]:. Organizational Unit Name (eg, section) []:. Common Name (e.g. server FQDN or YOUR name) []:quincy Email Address []:
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: ```
3) Create a v3 extensions configuration file with the following content (fill out the subjectAltName field with the hostname/IP the clients will be connecting to)
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
subjectAltName = DNS:quincy
issuerAltName = issuer:copy
4) Sign your certificate
$ openssl x509 -req -in cert.csr -signkey <your_certificate_key_file> -out <your_certificate_file> -days 365 -sha256 -extfile <your_v3_ext_file>
You then have to add the certificate to both you server and your client configuration files.
Server
```toml
[tunnels.
certificatefile = "servercert.pem"
certificatekeyfile = "server_key.pem" ```
Client ```toml [authentication]
trustedcertificates = ["cacert.pem"] ```