Setup a VPN server with El Capitan server 10.11
We asked Rusty Ross (@ConsultantRR) to help us put together a tutorial that will help Macminicolo customers setup their Mac minis to serve as VPNs. He’s broken it down in a few parts so be sure to take the steps that are best for your situation:
PART I: VLAN and DNS
PART II: Internet Routing (OPTIONAL)
PART III: VPN
PART IV: Client Setup
If you are simply looking to enable VPN service on your OS X Server for secure connection(s) between your server and client(s), you can skip PART II. That’s right: you can jump straight from PART I to PART III. The procedures discussed in PART II are intended for those who are looking to route internet traffic from their VPN clients over the VPN and out to the internet via their server’s public internet connection at Macminicolo.
Also, it should be mentioned that server administration (particularly at the command line level) can be tricky. If you do proceed beyond this point, which shall be exclusively at your own risk, then please proceed carefully, and as always, don’t ever proceed without a backup of your server and other irreplaceable data.
Still here? Okay, let’s get started.
PART I: VLAN and DNS
First, let’s set up a VLAN.
In System Preferences, go to Network, and choose “Manage Virtual Interfaces…”
Then choose “New VLAN…”
Let’s just name our VLAN something like “LAN”, and all other defaults here should be fine:
After pressing “Create”, you’ll see this:
After pressing “Done”, you’ll be able to enter network info for your new VLAN. Make sure to choose “Manually” for “Configure IPv4”, and set the IP Address, Subnet Mask, and Router as shown below.
(Advanced: We’ll be using a 10.0.0.1 private IP for the server and 10.0.0.0/24 private network in this walkthrough, but note that the technique documented here will work with any private IP addressing scheme. To accomplish that, you’d substitute that alternate network info here, as well as a few other places further along in this walkthrough.)
After pressing “Apply”, you should see an something like this, indicating that your newly-created VLAN is active:
Nice work. Now, let’s get basic DNS up and running. Launch Server.app, and click on the “DNS” section of the sidebar, under “Advanced”:
All DNS defaults in Server.app should be fine, so let’s switch DNS service on:
Great. Now, once again, if you are NOT interested in routing public internet traffic from your VPN client(s) over the VPN and out to the internet via your server’s public internet connection at Macminicolo, you should SKIP from here to PART III.
PART II: Internet Routing (OPTIONAL)
So far, so good. Now things get a little trickier, as we need to dive into the command line a bit to get NAT and routing set up. First, we’ll need to edit two privileged text files, so we are going use a command line text editor called nano. Breathe easy, we've got each other's backs here, and we will take this step by step.
As we proceed, it is important to remember that in the command line, typos aren't the least bit welcome, and also, uppercase/lowercase needs to match exactly, so it is extremely important to enter text into Terminal.app exactly as it is described here.
One additional (but important!) point: The quotation marks used here in terminal commands are "straight" quotes. Some web browsers and text editors may automatically convert these marks to smart (curly) quotes, particularly when copying and pasting. It's important to use straight quotes when entering the commands from this tutorial in Terminal.app.
Okay? Let's forge ahead.
Launch Terminal.app:
Inside the terminal window that appears, enter the following command (as a single line), and press return:
sudo nano /etc/pf.anchors/com.apple
You’ll be prompted for your password, and if you’ve not used sudo on this Mac in the past, you may see a warning about using sudo, which is fine. Enter your password (you wont see the cursor move while you type your password) and press return:
Upon doing this, you should expect to see the following text file open inside of nano, our friendly command line text editor:
Okay, we are now going to add three custom lines to this document. Red arrows in the picture below indicate where these lines should go. To move the cursor into the correct place to add these lines, simply use the arrow keys on your keyboard.
The three lines you’ll be adding are:
nat-anchor "100.customNATRules/*"
rdr-anchor "100.customNATRules/*"
load anchor "100.customNATRules" from "/etc/pf.anchors/customNATRules"
Great. Now we need to tell nano to save the changes you made to this text file. This will be a three step process, and we'll take it one step at a time.
First you'll press the “control” key and the “X” key simultaneously (that's right, “control-X”) to tell nano you are done editing. Upon doing so, you will see this:
Now press the “Y” key to let nano know that, yes indeed, you do want to save changes:
And finally, nano is already suggesting the proper location to save the file you edited, so simply press return to accept its suggestion:
Well done! You are back where you started, having edited a text file in nano.
Since you are now a nano expert, let's use it once more, this time to create an entirely new text file. Start nano up again as follows:
sudo nano /etc/pf.anchors/customNATRules
Upon entering the command above and pressing return, you will be reunited with your friend nano, now editing a new text file which, thus far, contains no text:
We are simply going to add two lines of text here:
nat on en0 from 10.0.0.0/24 to any -> (en0)
pass from {lo0, 10.0.0.0/24} to any keep state
(Advanced: If you are using private IP addressing other than 10.0.0.0/24, you should customize these two lines to match your chosen network.)
And now that these two lines have been added, well, you know the drill, the old three-step save: “control-X”, then “Y”, and then press return.
Again, that's “control-X”:
Then “Y”:
And then press return:
Excellent. Though nano has served us well, we won't need to use it again during this tutorial.
Now, just a couple more commands in Terminal.app, and we’ll be done with the command line altogether.
Enter this command (as a single line) into your Terminal.app window and press return:
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.pfctl.plist
And finally, enter this command (as a single line) into your Terminal.app window and press return:
echo 'net.inet.ip.forwarding=1' | sudo tee -a /etc/sysctl.conf
The Terminal should respond with “net.inet.ip.forwarding=1”, which is what we want.
Well done. You can now close your Terminal.app window entirely.
Okay, you have now set up NAT and routing for your private network. The last piece of the puzzle on the server will be to configure and enable VPN service.
Before you proceed, though: RESTART your server now. (We’ll wait…)
Now that you have restarted your server, let’s continue.
PART III: VPN
Whether or not you have just completed Part II or skipped to this point straight from Part I, rest assured that everyone is welcome here in Part III.
First, open Server.app and click on the “VPN” section of the sidebar:
Several default settings here are already in place as we’d want them, so we’ll just edit a few.
Enter your Shared Secret as desired:
Now press “Edit…” next to DNS Settings. You will likely see the Macminicolo DNS IP addresses here, which is NOT what we want in this particular place:
Instead, change this to 10.0.0.1 as follows:
(Advanced: If you are using an alternate private network, customize the above appropriately.)
Press “OK” and we’re back here:
Now press “Edit…” next to Client Addresses, and enter settings as pictured below:
(Advanced: If you are using an alternate private network, or have different needs in terms of address pool size, customize appropriately.)
Press “OK” and once again, we are back here:
...and should be all set to go. Switch the VPN service on:
Brilliant. Wait about 30 seconds for the VPN service to become fully active, and your Mac mini server should now be ready to serve VPN clients and (optionally, if you completed Part II) route their public internet traffic over its connection.
PART IV: Client Setup
Now that your server’s VPN is configured, enabled, and (optionally) ready to route public internet traffic for its clients, you may want a little guidance on how best to configure a client.
Let’s set up an El Capitan client as an example.
In System Preferences, go to Network, and press the “+” in the lower-lefthand corner:
Choose “VPN”, make sure you are using “L2TP over IPSec”, and give your service a name:
Press “Create”, and then make sure your new VPN is selected in the sidebar on the left, so you can edit its details on the right:
As shown above, enter the IP address or DNS name for your server in the “Server Address” field. In the “Account Name” field, enter the username for the account on the server that you want to use to log in from the client.
Press “Authentication Settings…” and you’ll see this:
Enter the Password for the account you just specified, and the Shared Secret exactly as you set it up on the server.
Press “OK”, and you are back to:
Now press “Advanced…” and you should see this panel:
If you chose to complete optional “Part II: Internet Routing” section earlier:
Then you should check the option to “Send all traffic over VPN connection” so that your client will, um, send all its traffic (including public internet-bound traffic) over the VPN when the VPN connection is active.
Otherwise, if you skipped the optional “Part II: Internet Routing” section, make sure to un-check “Send all traffic over VPN connection” (unlike the picture above).
Press “OK”, and you are back to:
Press “Apply” to save changes.
And now your client should be ready to connect to your server’s VPN.
Just press “Connect” when you want make this happen.
Well done.
As I mentioned, this tutorial came from Rusty Ross (@ConsultantRR), a great hands-on consultant that works with a bunch of happy MMC customers on a wide range of topics, including setup, migration, troubleshooting, maintenance, networking, strategic planning, and creative thinking. He’s available for a quick-fix, a specific project, or a longer-term relationship. If you have questions, you can find us on Twitter @macminicolo. And if you’re looking for somewhere safe and connected to place a VPN server, check out our prices to host a Mac mini with us.
Upgrade to El Capitan on a remote Mac mini
Apple has released OS X El Capitan today and it’s a great update. As with every OS X update, we predict that the hundred of Mac minis in our data center will get upgraded. A few notes for those ready to upgrade:
- Please, please get a backup. For the most part, upgrades have been pretty smooth in our testing. However, each setup is different and there is always a chance of a corrupt upgrade that could break your setup. We have options to add an external drive if you would like to take that route. At a minimum, get a disk image of your boot drive and store it locally or on a remote service like Dropbox.
- The upgrade can be done remotely. You just need to open the App Store, download the update, and let it run. If you keep your screen sharing window open, it’ll come back and you can watch part of the upgrades. Regardless, plan for your mini to be offline for about an hour. If it runs longer than an hour, just put in a ticket on the support site and we can help you troubleshoot.
- If you want to use this chance to get a clean install of OS X, we’re happy to help you do that. (It needs to be done locally since a clean install would have no networking information.) Just let us know with a ticket.
- If you’d like to have both a clean install of OS X, and also get a faster Mac mini, be sure to check our page of used Mac minis. We have some powerful, quad-core options available right now. We can run the new and old minis simultaneously for a while so you have time to get data moved over.
- We’ve been testing El Capitan and sent tweets on some of our findings. One especially great upgrade in 10.11.1 is drastically improved screen sharing. Look forward to that.
Enjoy the new version of OS X. As usual, we’re here to help if needed.
Replace Google products with a Mac mini server
It’s been interesting to watch as Apple, and Tim Cook specifically, begins to peck away at Google and the way it makes money. When iOS 9 is released, it will have a system-wide way to disable ads on the web. The early looks at this tech is pretty jarring the way it simplifies the web. Some people have said this is bad for bloggers. That may be true, but bloggers are a resourceful bunch and they have proven their ability to adapt. Plus, in general, they respect their readers and want them to have a good experience while also earning an income themselves. They’ll be fine.
In reality, I wonder for Google more. The overwhelming majority of their profit comes from ads on websites and searches. As mobile viewers become more dominate, and iOS has a high percentage of all mobile viewers, that will be a big hit for Google. Imagine if Apple takes away 50% of the ad revenue from Google. Thermonuclear indeed.
In the last couple years, Tim Cook has weighed in on these issues and why he prefers the way that Apple does business. This quote from an open letter written by Tim is pretty clear:
“Our business model is very straightforward: We sell great products. We don’t build a profile based on your email content or web browsing habits to sell to advertisers. We don’t “monetize” the information you store on your iPhone or in iCloud. And we don’t read your email or your messages to get information to market to you. Our software and services are designed to make our devices better. Plain and simple.”
In that same vein, we’ve seen more and more people and small businesses come to us looking for ways to own their own data and servers. With a Mac mini server, it’s more simple than you think. Obviously, we sell the service and benefits of hosting the mac mini in a data center, but I hope this will be useful for anyone looking for some more control over their data.
Below is a list of apps that you can run on your own machine, usually free or low in cost. Most are fairly simple to set up, though we can also get you the help you need. And best of all, they run on your hardware with your privacy controls.
OS X Server is the most obvious place to start though I think it's often overlooked. It is available on the Mac App Store for just $20. (And if you’re a developer for Apple, you’re entitled to a free copy.) What can you do with Server?
Mail is simple to setup and run. You have options to limit mailbox sizes, filter junk mail and run virtual domains. Also, your email isn’t scanned by a large company to put ads up against it or put surprises in your search results.
The mail service also offers push notifications, which Gmail dropped a couple years ago. And if you’re running a business, you can setup unlimited users on the machine as there is no per-person cost.
The Calendar Server in OS X Server will let you share calendars, schedule meetings even book conference rooms or other shared resources for a company. You can also send invitations by email. And of course, push notifications can be enabled.
The Contacts Server is equally as powerful. You can sync and share contacts for the company and each person.
There are other great options built into OS X Server, but I think that those are the big three that can replace Google services and keep your data private. It also has File Sharing, though I think it is lacking a bit there. Other services you might look at are a Profile Manager to configure and deploy Macs and iOS Devices, a VPN that you can connect to while traveling, or a Messages Server to collaborate with your team. (But seriously, Slack is so good that I’d probably still go with that. Hopefully they aren’t bought by Google anytime soon.)
Piwik is a great alternative to Google Analytics. When you install the free and open-source software on your machine you have complete data ownership. But more than that, it really protects the privacy of your readers and customers and supports "do not track." Google Analytics is so simple and quick to get started (Confessions: we use it right now too but plan to change soon) but the data collected on individuals must be enormous.
BitTorrent Sync is a powerful alternative to Google Drive. With Sync, the data and files that you share never reside on hardware that you don’t own. The encryption and speed are really amazing too, usually faster than services like Google Drive and Dropbox. It's so simple (and even fun) to setup.
I want to recommend a good alternative to Google Docs, but I just don’t think there is a self-hosted one worth recommending yet. Hopefully soon. (If you know of one, let us know.)
We’ll add to this list as we find other great options. The options listed above should be sufficient to get most small businesses onto servers that they own and control. And, most likely it will even save you and your business some money.
About Macminicolo
Macminicolo, a Las Vegas based company, has been hosting Mac minis since their introduction in January 2005. We are the leaders in this niche market and are known for our personal service and advanced data center. We currently host hundreds of Mac minis for satisfied customers located in 56 different countries around the world. Find us on Twitter @macminicolo or on our company blog.
How to host a Mac mini server
Sometimes we’ll hear from our customers after they’ve signed up and they’ll write something like, “If we would have know it was this easy to get started, we would have started a long time ago.”
This makes us wonder if others are intimidated by the startup process because they’ve never done it before. To help, here is what it takes to get a Mac mini in a data center:
1) Visit our signup page. There you can choose which options you’d like for your account. You can also purchase the the Mac mini if you prefer that route. After the form is submitted, you will receive your network information and the shipping address in an email.
2) You can then build your Mac mini at home just how you’d like it to run. You can preload data, setup your users, etc. Before sending the machine in you’ll want to be sure you enter your new IP address and enable Screen Sharing so you can reach the Mac mini when it’s here. Once done, just send it to the Macminicolo data center.
3) We’ll watch for the machine to arrive, get it installed and let you know it’s ready with an email. As long as you can reach it, we won’t even need to log into your server. You are then able to control the machine however you’ve set it up. When you connect with Screen Sharing, the machine will have all the benefits of being in a data center but still respond like it’s sitting in front of you.
That’s pretty much it. And if you buy the Mac mini through us, then it’s even easier. We usually have some used Mac minis available as well. It’ll take about one business day for us to get the machine, set it up in our data center, and then hand over control to you. You can then change any passwords/users that you want to change.
If you have any questions, feel free to contact us.
Use Bittorrent Sync on a Mac mini server
When you host a Mac mini in our data center, you're welcome to install anything you'd like to run on your server. Recently, BitTorrent Sync has become a very popular application on servers here. People love Dropbox (for good reason) but there is a real benefit to having your data, on a server you own, hosted safely in a very secure data center.
On the BitTorrent Sync site you can read about how it works, how people are using it, and all the technology that keeps it secure. In short, Sync "uses advanced peer-to-peer technology to share files between devices....This means there are no accounts, no file size limits, and transfer speeds are never throttled...Data is transferred directly from device to device." It's a great tool for personal data, company data, and just about everything else.
As more people become interested in controlling their own data, here is a screenshot tutorial of how to get Sync installed on your Mac, your Mac mini server, and on your iPhone. (There are also apps for Windows, Android and Linux.)
Start by getting Sync installed on the Mac in front of you. Visit GetSync.com and your download option will default to the OS you're running on.
If you scroll to the bottom, you're see all of the download options:
Once downloaded, just put BitTorrent Sync into your Applications folder:
Double click the app and you'll be asked to accept the terms:
Now you're all set to choose the first folder that you would like to share:
Once you choose your folder, you'll have some options on how you'd like others to be able to interact with your folder and it's content. You'll also be able to share the link to that folder via email, URL, or a QR Code:
Once you've made the choices, the folder is shared and waiting for it's first peer:
Now access your remote Mac mini with Screen Sharing:
Follow the same process from above to install the BitTorrent Sync app. Once you have the app installed, open Safari and paste the URL that was shared from your local Mac:
Select that you already have Sync installed:
And where you would like to store that shared folder:
You can also choose what your user and machine name will be as it's listed as a "peer" on your shared folders.
On your local Mac (where you shared the folder from) you'll be asked to confirm the new peer:
Once approved, the folder sill start syncing and the menubar item will also spin:
Now that the Mac mini server is in sync, we can also install on the iPhone. Sync has a real nice way to get this done. First, get the Sync app on the App Store:
Once installed, you'll open the app and be able to "Add a folder":
On your Mac, choose to share the folder with a QR code:
Then line up the Sync camera and it will scan it quickly:
And just like that, you are syncing the folder along with the two other peers:
And the original Mac can keep track of who is syncing, and the state they are at:
BitTorrent Sync is a great app, and only due to get better as they release version 2.0 soon.
If you have any questions about Sync, and the installation of it to your Mac mini server, feel free to send a question to us @macminicolo.
About Macminicolo
Macminicolo, a Las Vegas based company, has been hosting Mac minis since their introduction in January 2005. We are the leaders in this niche market and are known for our personal service and advanced data center. We currently host hundreds of Mac minis for satisfied customers located in 56 different countries around the world. Find us on Twitter @macminicolo or on our company blog.
Macminicolo turns ten
Today marks ten years of Macminicolo. We started just a couple days after the Mac mini was released. (In case you missed it, I also wrote about my ten years of watching and working with the Mac mini.)
I've thought a lot about the company and what has made it last over the years. I think it really boils down to three things.
First, offer personal service. Send us an email and get one back quickly that is personal and informed. Reach us on iMessage or AIM/iChat. I just want to be available on the tools you already use every day.
Second, prices that are fair for the customer and the company. It's important to find the right place where a customer feels like they are getting the value for which they pay. It also needs to be a price that can keep a company sustained for ten years. I've seen a lot of other companies come along to host Mac minis. Usually, they try to undercut us and eventually they go out of business or they spread to other services, pulling focus from their Mac mini customers. Just be fair and offer value.
Finally, work with great hardware. The Mac mini doesn't get enough credit for being so reliable. People can be hesitant of the spinning disk or the single ethernet port. Over the years, the Mac mini has proved incredibly good as a server. The hardware last years when they are rarely moved and always stored in a controlled environment like a data center.
Thank you to all of the great customers we've been working with over the years. We still have some customers from those very first months of business. Thanks for supporting the company and for spreading the word.
About Macminicolo
Macminicolo, a Las Vegas based company, has been hosting Mac minis since their introduction in January 2005. We are the leaders in this niche market and are known for our personal service and advanced data center. We currently host hundreds of Mac minis for satisfied customers located in 56 different countries around the world. Find us on Twitter @macminicolo or on our company blog.