Qnet

A secure, decentralized overlay network with proxy access, scalability, and anonymous communication. Offering tracker blocking, encryption, anonymous communication, and more.

Setting up the VPS (Ubuntu)

Step 1 - Create an ssh key using the below command

ssh-keygen -t rsa

Step 2 - Import the public key into the VPS (sometimes it is needed during VPS creation)

Step 3 - Connect to VPS

ssh -i </path/to/key> user@<VPS_IP_ADDR>

[!NOTE] Note You can use echo <VPS_IP_ADDR> "host" >> /etc/hosts to use "host" instead of having to remember the IP address of your VPS

Step 4 - Initial system setup

Update root password

ubuntu@ov-ecc154:~$ sudo -i  
root@ov-ecc154:~# passwd

Update the System Immediately

sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y

Install net-tools

sudo apt install net-tools

Create a Non-Root Sudo User

# Create a named user (replace 'admin' with your preferred username)
sudo adduser sysadmin # (leave all fields blank)
sudo usermod -aG sudo sysadmin

# Switch to the new user
su - sysadmin

Migrate (or create) SSH pubkey

Migrate:

# su - sysadmin # If not already
cd
mkdir .ssh && sudo mv /home/ubuntu/.ssh /home/sysadmin/
sudo chown -R sysadmin .ssh

Create:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys
# Paste your public key and save
chmod 600 ~/.ssh/authorized_keys

Step 5 - Hardening Security

[!NOTE] Future plans Remove ANY root access in the final product. Sudo operations are done automatically by nologin users. The host doesn't have root access.

SSH

Change default SSH port

sudo nano /etc/ssh/sshd_config # and ssh_config!
# Change:
# Port 22
# To a high port (e.g.):
Port 5522

# Check if socket active
systemctl is-active ssh.socket

# If so:
systemctl edit ssh.socket

Enter the following:

[Socket]
ListenStream=
ListenStream=5522

# Update firewall BEFORE restarting SSH
ufw allow 5522/tcp
# OR: ufw allow proto tcp from 10.200.200.0/24 to any port 5522 for WG-only

systemctl daemon-reload
systemctl restart ssh.socket
systemctl is-active ssh.socket

# If socket inactive, restart ssh service
systemctl restart ssh.service

UFW

[!NOTE] Note! Ports 1024-49151 are designated for services and are not reserved for system use ![[Pasted image 20260616161814.png]]

Configure UFW Firewall

ufw default deny incoming
ufw default allow outgoing

# Block the default SSH port
ufw deny 22/tcp # test before applying this change!

# Allow application ports (add only what you need)
ufw allow 80/tcp     # HTTP
ufw allow 443/tcp    # HTTPS
ufw allow 5522/tcp   # SSH

# Wireguard
sudo ufw allow 42069/udp
sudo ufw allow in on QLS # Allow traffic from interface

# DNS
ufw allow in on QLS from 10.200.200.0/24 to any port 53

# Enable firewall
ufw enable
ufw status verbose

# Blocks IPs making 6+ connections in 30 seconds
ufw limit 5522/tcp

Fail2Ban

Install and Configure Fail2Ban

sudo apt install fail2ban -y
sudo systemctl enable fail2ban

sudo nano /etc/fail2ban/jail.local

Copy-paste this into the file and save it:

# Fail2Ban jail.local configuration
# Generated by Flowtriq - https://flowtriq.com/tools/fail2ban-generator
# Date: 2026-04-28
#
# Place this file at: /etc/fail2ban/jail.local
# Test syntax:  fail2ban-client -t
# Restart:      systemctl restart fail2ban
# Status:       fail2ban-client status

[DEFAULT]
# Default ban action - applies to all jails unless overridden
banaction = iptables-multiport
banaction_allports = iptables-allports

# IPs that should never be banned (add your own IPs!)
ignoreip = 127.0.0.1/8 ::1

# Email notifications (optional - configure sendmail/msmtp first)
# destemail = admin@example.com
# sender = fail2ban@example.com
# mta = sendmail
# action = %(action_mwl)s   # ban + email with whois + logs

# ─── SSH Protection ──────────────────────────────────────
# Monitors /var/log/auth.log for failed SSH login attempts
[sshd]
enabled   = true
port      = ssh
filter    = sshd
logpath   = /var/log/auth.log
maxretry  = 5
findtime  = 600
bantime   = 3600
mode      = aggressive
# aggressive mode catches additional patterns like
# invalid user attempts and pre-auth disconnects

# ─── Nginx Auth Failures ─────────────────────────────────
[nginx-http-auth]
enabled   = true
port      = http,https
filter    = nginx-http-auth
logpath   = /var/log/nginx/error.log
maxretry  = 6
findtime  = 600
bantime   = 3600

# ─── Nginx Bad Bots ──────────────────────────────────────
# Uses a custom filter to detect bad bots and scanners
[nginx-badbots]
enabled   = true
port      = http,https
filter    = nginx-badbots
logpath   = /var/log/nginx/access.log
maxretry  = 2
findtime  = 600
bantime   = 3600

# ─── Nginx Rate Limiting (requires limit_req in nginx.conf) ──
# Bans IPs that trigger nginx's built-in rate limiting repeatedly
[nginx-limit-req]
enabled   = true
port      = http,https
filter    = nginx-limit-req
logpath   = /var/log/nginx/error.log
maxretry  = 6
findtime  = 600
bantime   = 3600

# Generated by Flowtriq - https://flowtriq.com

And this one:

# ═══════════════════════════════════════════════════════════
# File: /etc/fail2ban/filter.d/nginx-badbots.conf
# ═══════════════════════════════════════════════════════════
[Definition]
# Matches common scanner and bad bot User-Agent strings
failregex = ^<HOST> .* "(GET|POST|HEAD) .* HTTP/.*" .* "(.*(?:nikto|sqlmap|nmap|masscan|ZmEu|w3af|Havij|acunetix|nessus).*)"$
ignoreregex =

Now. Restart the service with

sudo systemctl restart fail2ban

# Check Fail2Ban status
sudo fail2ban-client status sshd

# View banned IPs
sudo fail2ban-client status sshd | grep "Banned IP"

ASU etc

Enable Automatic Security Updates:

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

Secure Shared Memory

sudo nano /etc/fstab

# Add this line:
tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0

Disable Unused Services

# List all running services
sudo systemctl list-units --type=service --state=running

# Disable services you don't need (examples):
sudo systemctl disable bluetooth
sudo systemctl disable avahi-daemon      # mDNS — unnecessary on servers
sudo systemctl disable cups              # Printing — unnecessary on servers
sudo systemctl disable ModemManager     # Modem management — unnecessary on VPS

# Check what's listening on network ports
sudo ss -tlnup

Harden Kernel Parameters (sysctl)

sudo nano /etc/sysctl.d/*-security.conf

# Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Disable ICMP redirects (prevents routing attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# Log martian packets (helpful for detecting spoofed traffic)
net.ipv4.conf.all.log_martians = 1

# Protect against SYN flood attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Disable IPv6 if not used (reduces attack surface)
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# Prevent kernel pointer leaks
kernel.kptr_restrict = 2

# Restrict dmesg access
kernel.dmesg_restrict = 1

# Restrict ptrace (prevents some privilege escalation attacks)
kernel.yama.ptrace_scope = 1

sudo sysctl --system

NOTE: I skipped step 11 (for now) https://usavps.com/post/ubuntu-vps-security-hardening-2026/

AIDE

Set Up Intrusion Detection with AIDE

sudo apt install aide -y

# Initialize the database (takes 5-10 minutes)
sudo aideinit

# Copy the new database to the checked location
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# Check for changes (run regularly)
sudo aide --check

During setup, I chose "local only" and put sysadmin@queerliberationserver.org as the FQDN for email.

Schedule daily integrity checks:

sudo crontab -e
# Add:
0 3 * * * /usr/bin/aide --check 2>&1 | mail -s "AIDE Check: $(hostname)" your@email.com

Various

Configure Log Monitoring with Logwatch

sudo apt install logwatch -y

# Send daily summary
sudo logwatch --output mail --mailto your@email.com --detail high

Restrict Access to Cron

# Only allow specific users to use cron
sudo bash -c "echo 'sysadmin' > /etc/cron.allow"
sudo bash -c "echo 'ALL' > /etc/cron.deny"

# Verify cron directory permissions
sudo chmod 700 /etc/cron.d /etc/cron.daily /etc/cron.weekly /etc/cron.monthly
sudo chmod 600 /etc/crontab

Enable Process Accounting

sudo apt install acct -y
sudo systemctl enable acct
sudo systemctl start acct

# View recent commands by user
sudo lastcomm

# See user activity summary
sudo sa

Step 6 - Wireguard

[!NOTE] Note Client-Server topology is the same as Hub and Spoke topology. The server is the hub. My topology is Hub & Spoke.

Install Wireguard

sudo apt install wireguard-tools

Generate keys

umask 077
wg genkey | tee privkey | wg pubkey > pubkey
wg genpsk > psk
echo PrivateKey: $(cat privkey)
echo PublicKey: $(cat pubkey)
echo PresharedKey: $(cat psk)
rm privkey pubkey psk

Configuration:

[Interface]
Address = 10.200.200.1/24
#SaveConfig = true
ListenPort = 42069
PrivateKey = MIvhcYqdWfuCQvlMPATyUzMvrNdaLX7Y8TW4qMwgylY=

# Forward traffic from WG Iface; Forward to WG Iface;  allow P2P; NAT VPN traffic to internet and enable masquerading;
PostUp =   iptables -I FORWARD 1 -i QLS -j ACCEPT; iptables -I FORWARD 1 -o QLS -j ACCEPT; iptables -I FORWARD 1 -i QLS -o QLS -j ACCEPT; iptables -t nat -I POSTROUTING 1 -s 10.200.200.0/24 -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i QLS -j ACCEPT; iptables -D FORWARD -o QLS -j ACCEPT; iptables -D FORWARD -i QLS -o QLS -j ACCEPT; iptables -t nat -D POSTROUTING -s 10.200.200.0/24 -o ens3 -j MASQUERADE


[Peer]
AllowedIPs = 10.200.200.2/32 # Client config should have a netmask of /24
PublicKey = [Client 1 PubKey]
PresharedKey = [Client 1 PSK]

Start service

sudo systemctl enable --now wg-quick@QLS

Enable packet forwarding

# /etc/sysctl.conf
# Uncomment the next line to enable packet forwarding for IPv4  
net.ipv4.ip_forward=1

Disable IPv6

# /etc/sysctl.conf
# Add the following to the bottom of the file
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv6.conf.tun0.disable_ipv6 = 1

Reload system

sudo sysctl --system

Step 7 - Pihole/Unbound

[!NOTE] Note Probably use Technitium instead?

https://vdaluz.com/blog/pihole-unbound-installation/ https://www.linuxbabe.com/ubuntu/set-up-unbound-dns-resolver-on-ubuntu-20-04-server https://micronugget.com/vpndns-pihole-wireguard-unbound-installation Unbound configuration: /etc/unbound/unbound.conf.d/pihole.conf

server:

# Threads
num-threads: 4

# Enable operation information logging; up to 5
verbosity: 5
logfile: "/etc/unbound/unbound.log"

# Listen to queries on WG interface
interface: 127.0.0.1
port: 5335

# Disable ipv6
do-ip6: no

# IP range authorized to send queries to DNS
access-control: 0.0.0.0/0 refuse
access-control: 127.0.0.1/32 allow
access-control: 10.200.200.0/32 allow

# Hide id.server and hostname.bind
hide-identity: yes

# Hide version.server and version.bind
hide-version: yes

# Hide addresses on the private network
private-address: 10.0.0.0/8

# A total number of unwanted replies is kept track of; when reached cache is cleared to prevent DNS Poisoning
unwanted-reply-threshold: 10000000

# Because my server has low traffic/usage I enable prefetch; this adds load but cache elements are prefetched before expiry
prefetch: yes
prefetch-key: yes

# Add minimum cache lifetime in seconds
cache-min-ttl: 1800
cache-max-ttl: 14400

# Secure DNS and use DNSSEC
harden-glue: yes
harden-dnssec-stripped: yes

Install pihole

(choose 127.0.0.1 as the DNS server)

curl -sSL https://install.pi-hole.net | bash

Step 8 - Hysteria2

Step 9 - LLARP

Step 10 - SELinux

Policies: https://gitlab.com/liguros/liguros-repo/-/tree/stable/sec-policy/

FIRST - Install the tools load_policy, semodule, and restorecon

[!NOTE] Tools to keep in mind: semanage, audit2allow, restorecon, sealert

# SSH
sudo semanage port -a -t ssh_port_t -p tcp 5522

# Wireguard
semanage permissive -a wireguard_t

# Nginx
https://docs.nginx.com/nginx-instance-manager/system-configuration/configure-selinux/

# DNS?

# Hysteria2?

# LLARP?

Future steps:

Turn all this documentation into code, run it on another node, and try to federate the two. If this works, Proof of Concept is COMPLETE!!!!