Quick Start: Build Your Cross-Platform Native SSH VPN Secure Network from Scratch
In today's digital operations and remote work landscape, secure, stable, and compliant connection channels are essential for every team. Traditional VPN setup is often tedious, requiring complex certificate management, firewall configuration, and routing tables that frequently break.
Easy Connect Systems addresses this elegantly by building directly on the widely deployed and highly mature SSH protocol to deliver lightweight, out-of-the-box Layer 3 network tunneling (TUN Mode) and application-level proxying (SOCKS Mode).
This guide walks you through the configuration process from scratch, enabling you to build your own cross-platform secure communication links.
1. How to Quickly Add a Profile and Establish an SSH VPN
No matter what operating system you are using—macOS, Windows, Linux, Android, or iOS—the profile configuration process in the Easy Connect SSH client is consistent. Follow these three simple steps to start your secure tunnel in seconds:
Step 1: Download and Install the Client
Go to the Downloads Page to get the latest installation bundle for your platform (e.g., .dmg for macOS, installers for Windows, archive files for Linux, or .apk for Android).
Step 2: Create a New Profile
Launch the app. You will see a clean, ad-free dashboard:
- Click the "+" button in the top right or below the list.
- In the profile editor, fill in the following parameters:
- Host (Alias): Assign a memorable name (e.g.,
Hong Kong Dev Server). - Address & Port: Enter your server's public IP address (or domain) and the SSH port (default is standard
22). - Username: Enter your SSH account username (e.g.,
vpnuserorroot). - Auth Type:
- Password: Type in your server password directly.
- SSH Key (Highly Recommended): Select or specify the path to your local private key file (e.g.,
~/.ssh/id_rsaor a.pemfile).
- Mode: Select either SOCKS5 or TUN Mode based on your needs.
- Host (Alias): Assign a memorable name (e.g.,
Step 3: Connect
Save the configuration, select the profile from the main list, and toggle the "Connect" switch to the active state.
- Privilege Request: If you are enabling TUN Mode for the first time, your operating system will ask for authorization to set up the virtual network interface and routing rules. Click "Allow" and enter your device password.
- Once connected, the client dashboard will display real-time traffic statistics. Your secure connection is now fully active!
2. Under the Hood: SOCKS Mode vs. TUN Mode
Understanding the difference between the two working modes helps you select the best approach for your specific tasks.
| Dimension | SOCKS Mode (App-Level Proxy) | TUN Mode (System-Wide VPN) |
|---|---|---|
| Working Principle | Launches a local SOCKS5 proxy server (default port 1080) | Provisons a virtual network card at the IP layer (L3) |
| Traffic Scope | Only proxies applications manually configured to use SOCKS5 | All system-wide traffic (transparant network-level intercept) |
| Protocol Support | Supports TCP traffic (UDP support depends on the app client) | Full support for TCP, UDP, and ICMP (e.g., you can ping) |
| Privileges | Runs entirely in user-space; no Admin/Root access required | Modifies system routing tables; requires Admin/Root privileges |
| Typical Use Cases | Web browsers, specific IDE code syncing and debugging | Terminal commands, Git sync, gaming, global network routing |
| Pricing | Free and open under the basic client edition | Commercial feature requiring a premium license subscription |
How to Upgrade and Unlock TUN Mode
Because TUN Mode utilizes complex user-space TCP stack translation and virtual interface management, it is a premium feature. To unlock it:
- Open the account registration window in the client, or go to the unified billing center: Easy Connect User Portal.
- Register and log into your account.
- Select your preferred subscription package in the billing portal:
- Monthly Plan: ¥9.90/month — Suitable for short-term evaluation (supports 3 simultaneous devices).
- Yearly Plan: ¥49.90/year — The most popular value option (supports 5 simultaneous devices, approx. ¥4.16/month).
- Lifetime Pass: ¥99.90/one-time — Perpetual license with lifetime updates and feature priority.
- Once paid, log into your account inside the client, and the TUN Mode toggle will instantly unlock.
3. One Purchase, Full Cross-Platform Support
Many applications charge separate fees for different platforms (e.g., mobile vs. desktop, or macOS vs. Windows). Easy Connect SSH features a user-centric, cross-platform subscription policy:
- Multi-Platform Access: A single subscription unlocks premium features on Android, macOS, Windows, Linux, and iOS clients.
- Concurrent Devices: Depending on your tier, you can have 3 to 5 active devices online simultaneously. You can activate your MacBook, Windows workstation, Android phone, and tablet under a single subscription without paying duplicate fees.
4. Server Setup Guide: VPS Provisioning and SSH Configuration
If you do not have a private SSH server, you can buy one from cloud providers for a low cost.
1. Purchase a Cloud VPS
- Go to any major cloud provider (e.g., Alibaba Cloud, Tencent Cloud, AWS, Huawei Cloud).
- Search for "Lightweight Application Server" (轻量应用服务器). These plans provide high performance-to-price ratios and include dedicated public IPv4 addresses and bandwidth quotas.
- Region Selection: Choose a region closest to your target resources or teams (e.g., Hong Kong, Singapore, Tokyo).
- OS Image: Select Ubuntu (20.04/22.04 LTS) or Debian (11/12) as your base image.
2. Set Up Security Firewall
In the cloud provider console, open the firewall/security group settings and ensure that TCP port 22 (default SSH port) is set to allow inbound connections.
3. Service Auto-Configuration
Log into your server terminal. We provide a one-click deployment script to configure permissions and tune keepalive parameters. Run the following commands:
# 1. Download the setup script
curl -o setup_vpn_server.sh https://raw.githubusercontent.com/sshvpn-go/ssh-vpn-wiki/main/scripts/setup_vpn_server.sh
# 2. Grant permissions and run setup
chmod +x setup_vpn_server.sh
sudo ./setup_vpn_server.sh allWhat the script does: The script automatically creates a dedicated connection user
vpnuser, modifies/etc/ssh/sshd_config, and restarts the SSH daemon. Specifically, it:
- Enables
AllowTcpForwarding yesto permit packet routing.- Configures
ForceCommand /usr/sbin/nologin(disabling interactive shell access for security; the account can only route network traffic).- Adjusts TCP KeepAlive variables to prevent idle connections from dropping.
4. Key-Based Authentication
For production setups, we recommend using keys instead of passwords:
# Generate and associate an SSH key pair with vpnuser
sudo ./setup_vpn_server.sh gen-key [email protected]Once generated, print and copy the private key contents (located at /root/.ssh/your_email_ed25519 or similar):
sudo cat /root/.ssh/your_email_ed25519Save this key locally to a text file (e.g., id_ed25519.pem). In the client Profile editor, choose key authentication, select this file, set the username to vpnuser, and connect.
5. Under the Hood: Technical and Security Mechanisms
Using the standard SSH protocol for Layer 3 tunneling offers several benefits for security, performance, and compliance.
1. Yamux Multiplexing
Standard SSH port forwarding opens a separate TCP connection for each concurrent request, causing high latency. Easy Connect SSH integrates the Yamux multiplexing protocol. It multiplexes hundreds of logical bidirectional streams over a single physical SSH connection, improving network round-trip performance and reducing handshake overhead.
2. User-Space SOCKS-to-TUN Translation (Preventing TCP-in-TCP Meltdown)
Routing raw TCP packets inside a TCP-based SSH tunnel (known as TCP-in-TCP) causes congestion control algorithms to conflict during packet drops. This often leads to a drop in throughput (TCP Meltdown). Easy Connect SSH avoids this using User-Space SOCKS-to-TUN translation:
- When raw IP packets are intercepted from the TUN adapter, the client unpacks the inner TCP streams in user-space and routes them directly to a local high-performance SOCKS5 proxy layer.
- This ensures that only raw payload data is sent through the SSH channel, preventing double TCP congestion loops and maintaining throughput on unstable networks.
3. Security Design
- Industry Standard Cryptography: The client uses standard OpenSSH v2 cryptographic standards. Tunnels are secured with algorithms such as
AES-256-GCMorChaCha20-Poly1305to prevent eavesdropping. - Privilege Isolation: The script uses
ForceCommand /usr/sbin/nologinto restrict shell access on the server. If your connection password or key is leaked, the account cannot be used to run commands or browse directories. - Sandbox Compliance and Local Storage: Profiles are stored securely on the local device using system keychain encryption. The app runs in system sandboxes, contains no third-party trackers, and does not harvest network logs.
Conclusion
Easy Connect SSH combines the security of the standard SSH protocol with the convenience of system-wide TUN routing. Whether you need a tool for quick server administration or a secure access channel for your team, Easy Connect SSH provides a lightweight, reliable solution.
For additional documentation and tuning details, refer to: