Deployment Guide

This guide covers deploying Camouflage on cloud providers, VPS, and home servers with proper firewall and network configuration.

Prerequisites

Before deploying Camouflage to the internet, ensure you have:

• A server with a public IP address
• Domain name (optional but recommended for production)
• SSH access to the server
• Root or sudo privileges

Port Requirements

Camouflage requires these ports to be accessible from the internet:

Port	Protocol	Purpose	Required
9443	TCP	Web UI and API	Yes
61700	UDP	VPN daemon (Network 1)	Yes
61701	UDP	VPN daemon (Network 2)	Yes (CE only)
22	TCP	SSH (for management)	Recommended

Security Note: Only expose ports 9443, 61700, and 61701 to the internet. Keep SSH (port 22) restricted to your admin IP addresses if possible.

Cloud Provider Deployments

AWS (Amazon Web Services)

1. Launch EC2 Instance

Recommended Instance Type: t3.small or larger

AMI: Ubuntu 22.04 LTS

Storage: 10 GB minimum (20 GB recommended)

2. Configure Security Group

Create a security group with the following inbound rules:

Type	Protocol	Port Range	Source	Description
Custom TCP	TCP	9443	0.0.0.0/0	Camouflage Web UI
Custom UDP	UDP	61700	0.0.0.0/0	VPN Network 1
Custom UDP	UDP	61701	0.0.0.0/0	VPN Network 2
SSH	TCP	22	Your IP/32	SSH access (restrict to your IP)

AWS Console Steps:

1. Go to EC2 → Security Groups
2. Click "Create security group"
3. Add the inbound rules above
4. Attach to your EC2 instance

AWS CLI:

# Create security group
aws ec2 create-security-group \
  --group-name camouflage-sg \
  --description "Security group for Camouflage VPN"

# Add inbound rules
aws ec2 authorize-security-group-ingress \
  --group-name camouflage-sg \
  --protocol tcp --port 9443 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress \
  --group-name camouflage-sg \
  --protocol udp --port 61700 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress \
  --group-name camouflage-sg \
  --protocol udp --port 61701 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress \
  --group-name camouflage-sg \
  --protocol tcp --port 22 --cidr YOUR_IP/32

3. Elastic IP (Recommended)

Allocate and associate an Elastic IP for a static public address:

aws ec2 allocate-address --domain vpc
aws ec2 associate-address --instance-id i-xxxxx --allocation-id eipalloc-xxxxx

Google Cloud Platform (GCP)

1. Create VM Instance

Machine Type: e2-small or larger

Boot Disk: Ubuntu 22.04 LTS, 10 GB minimum

Firewall: Allow HTTP/HTTPS traffic (we'll customize this)

2. Configure Firewall Rules

GCP Console:

1. Go to VPC Network → Firewall
2. Create firewall rule
3. Add the following:

Firewall Rule 1: Web UI

• Name: camouflage-web-ui
• Targets: All instances in the network (or specific tags)
• Source IP ranges: 0.0.0.0/0
• Protocols and ports: tcp:9443

Firewall Rule 2: VPN Daemons

• Name: camouflage-vpn
• Targets: All instances in the network (or specific tags)
• Source IP ranges: 0.0.0.0/0
• Protocols and ports: udp:61700,61701

gcloud CLI:

# Web UI
gcloud compute firewall-rules create camouflage-web-ui \
  --allow tcp:9443 \
  --source-ranges 0.0.0.0/0 \
  --description "Camouflage Web UI"

# VPN daemons
gcloud compute firewall-rules create camouflage-vpn \
  --allow udp:61700,udp:61701 \
  --source-ranges 0.0.0.0/0 \
  --description "Camouflage VPN daemons"

3. Reserve Static IP

gcloud compute addresses create camouflage-ip --region us-central1
gcloud compute instances delete-access-config INSTANCE_NAME --access-config-name "External NAT"
gcloud compute instances add-access-config INSTANCE_NAME \
  --access-config-name "External NAT" \
  --address camouflage-ip

Azure

1. Create Virtual Machine

Size: Standard_B1s or larger

Image: Ubuntu 22.04 LTS

Disk: 10 GB minimum

2. Configure Network Security Group (NSG)

Azure Portal:

1. Go to Virtual Machines → Your VM → Networking
2. Add inbound port rules:

Priority	Name	Port	Protocol	Source	Destination	Action
100	Camouflage-HTTPS	9443	TCP	Any	Any	Allow
110	Camouflage-VPN1	61700	UDP	Any	Any	Allow
120	Camouflage-VPN2	61701	UDP	Any	Any	Allow
200	SSH	22	TCP	Your IP	Any	Allow

Azure CLI:

# Create NSG
az network nsg create \
  --resource-group myResourceGroup \
  --name camouflage-nsg

# Add rules
az network nsg rule create \
  --resource-group myResourceGroup \
  --nsg-name camouflage-nsg \
  --name Allow-HTTPS \
  --priority 100 \
  --destination-port-ranges 9443 \
  --protocol Tcp \
  --access Allow

az network nsg rule create \
  --resource-group myResourceGroup \
  --nsg-name camouflage-nsg \
  --name Allow-VPN \
  --priority 110 \
  --destination-port-ranges 61700 61701 \
  --protocol Udp \
  --access Allow

DigitalOcean

1. Create Droplet

Size: Basic Plan, 1 GB RAM minimum

Image: Ubuntu 22.04 LTS

2. Configure Firewall

DigitalOcean Console:

1. Go to Networking → Firewalls
2. Create Firewall
3. Add Inbound Rules:

Type	Protocol	Port Range	Sources
Custom	TCP	9443	All IPv4, All IPv6
Custom	UDP	61700	All IPv4, All IPv6
Custom	UDP	61701	All IPv4, All IPv6
SSH	TCP	22	Your IP

doctl CLI:

doctl compute firewall create \
  --name camouflage-fw \
  --inbound-rules "protocol:tcp,ports:9443,address:0.0.0.0/0,address:::/0 protocol:udp,ports:61700,address:0.0.0.0/0,address:::/0 protocol:udp,ports:61701,address:0.0.0.0/0,address:::/0"

Linode

1. Create Linode

Plan: Nanode 1GB or larger

Image: Ubuntu 22.04 LTS

2. Configure Cloud Firewall

Linode Console:

1. Go to Firewalls → Create Firewall
2. Add Inbound Rules:

Label	Protocol	Port Range	Source
HTTPS	TCP	9443	All IPv4 / All IPv6
VPN-1	UDP	61700	All IPv4 / All IPv6
VPN-2	UDP	61701	All IPv4 / All IPv6
SSH	TCP	22	Your IP

VPS / Bare Metal Server

If you're using a VPS provider (Vultr, Hetzner, OVH, etc.) or bare metal server, configure the OS firewall directly.

Ubuntu/Debian (UFW)

UFW (Uncomplicated Firewall) is the easiest way to manage firewall rules on Ubuntu:

# Install UFW (if not already installed)
sudo apt update
sudo apt install ufw

# Allow SSH first (important - don't lock yourself out!)
sudo ufw allow 22/tcp

# Allow Camouflage ports
sudo ufw allow 9443/tcp
sudo ufw allow 61700/udp
sudo ufw allow 61701/udp

# Enable firewall
sudo ufw enable

# Check status
sudo ufw status

Expected output:

Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
9443/tcp                   ALLOW       Anywhere
61700/udp                  ALLOW       Anywhere
61701/udp                  ALLOW       Anywhere

CentOS/RHEL (firewalld)

# Start and enable firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld

# Allow Camouflage ports
sudo firewall-cmd --permanent --add-port=9443/tcp
sudo firewall-cmd --permanent --add-port=61700/udp
sudo firewall-cmd --permanent --add-port=61701/udp

# Reload firewall
sudo firewall-cmd --reload

# Verify
sudo firewall-cmd --list-all

iptables (Advanced)

For direct iptables configuration:

# Allow established connections
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT

# Allow SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow Camouflage
sudo iptables -A INPUT -p tcp --dport 9443 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 61700 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 61701 -j ACCEPT

# Drop everything else
sudo iptables -A INPUT -j DROP

# Save rules (Ubuntu/Debian)
sudo apt install iptables-persistent
sudo netfilter-persistent save

# Save rules (CentOS/RHEL)
sudo service iptables save

Home Server / Behind NAT

If you're running Camouflage on a home server behind a router, you'll need to configure port forwarding.

Router Port Forwarding

Steps (varies by router model):

1. Log into your router's admin panel (usually 192.168.1.1 or 192.168.0.1)
2. Find "Port Forwarding" or "NAT" settings
3. Add port forwarding rules:

Service Name	External Port	Internal Port	Internal IP	Protocol
Camouflage-Web	9443	9443	192.168.1.100	TCP
Camouflage-VPN1	61700	61700	192.168.1.100	UDP
Camouflage-VPN2	61701	61701	192.168.1.100	UDP

Note: Replace 192.168.1.100 with your server's local IP address.

Dynamic DNS (DDNS)

If you don't have a static public IP, use a DDNS service:

Popular DDNS Providers:

• No-IP
• DuckDNS
• Dynu
• Cloudflare (with API)

Example: DuckDNS:

# Install DuckDNS updater
echo "echo url='https://www.duckdns.org/update?domains=YOUR_DOMAIN&token=YOUR_TOKEN&ip=' | curl -k -o ~/duckdns/duck.log -K -" > ~/duckdns/duck.sh
chmod 700 ~/duckdns/duck.sh

# Add to crontab (update every 5 minutes)
crontab -e
# Add: */5 * * * * ~/duckdns/duck.sh >/dev/null 2>&1

Local Firewall (UFW)

Even behind a router, configure the server's firewall:

sudo ufw allow 9443/tcp
sudo ufw allow 61700/udp
sudo ufw allow 61701/udp
sudo ufw enable

DNS Configuration

If you have a domain name, point it to your server's public IP.

DNS Records

Add these records to your DNS provider:

Type	Name	Value	TTL
A	camouflage	YOUR_SERVER_IP	300
A	@	YOUR_SERVER_IP	300

Example (for domain example.com):

camouflage.example.com  →  1.2.3.4
example.com             →  1.2.3.4

SSL Certificates

For production deployments, use a real SSL certificate instead of self-signed.

Option 1: Let's Encrypt (Free)

# Install certbot
sudo apt update
sudo apt install certbot

# Stop Camouflage temporarily
docker stop camouflage-ce

# Obtain certificate
sudo certbot certonly --standalone -d camouflage.example.com

# Certificates will be at:
# /etc/letsencrypt/live/camouflage.example.com/fullchain.pem
# /etc/letsencrypt/live/camouflage.example.com/privkey.pem

# Copy to Camouflage data volume
docker run --rm -v camouflage_data:/data -v /etc/letsencrypt:/certs alpine sh -c "
  mkdir -p /data/ssl &&
  cp /certs/live/camouflage.example.com/fullchain.pem /data/ssl/cert.pem &&
  cp /certs/live/camouflage.example.com/privkey.pem /data/ssl/key.pem
"

# Start Camouflage
docker start camouflage-ce

Option 2: Cloudflare SSL

If using Cloudflare, generate an origin certificate:

1. Go to SSL/TLS → Origin Server
2. Create Certificate
3. Copy certificate and private key
4. Save to /data/ssl/cert.pem and /data/ssl/key.pem

Security Best Practices

1. Change Default Password

Immediately after first login, change the default admin password from camouflage to a strong password.

2. Use SSL Certificates

Replace self-signed certificates with trusted certificates from Let's Encrypt or a commercial CA.

3. Restrict SSH Access

Limit SSH to specific IP addresses:

# UFW
sudo ufw delete allow 22/tcp
sudo ufw allow from YOUR_ADMIN_IP to any port 22

# AWS Security Group
# Change SSH source from 0.0.0.0/0 to YOUR_IP/32

4. Enable Automatic Updates

Keep your server patched:

# Ubuntu/Debian
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

5. Monitor Logs

Regularly check Camouflage logs:

docker logs -f camouflage-ce

6. Backup Configuration

Backup your data volume regularly:

# Create backup
docker run --rm -v camouflage_data:/data -v $(pwd):/backup alpine \
  tar czf /backup/camouflage-backup-$(date +%Y%m%d).tar.gz -C /data .

# Restore from backup
docker run --rm -v camouflage_data:/data -v $(pwd):/backup alpine \
  tar xzf /backup/camouflage-backup-YYYYMMDD.tar.gz -C /data

7. Limit Web UI Access (Optional)

If you only need Web UI from specific IPs:

# UFW example - only allow from office IP
sudo ufw delete allow 9443/tcp
sudo ufw allow from OFFICE_IP to any port 9443

Note: VPN ports (61700, 61701) should remain open to all IPs for client connections.

Verification

After deployment, verify everything is working:

1. Check Ports are Open

From a different machine, test connectivity:

# Test TCP port (Web UI)
nc -zv YOUR_SERVER_IP 9443

# Test UDP ports (VPN)
nc -zvu YOUR_SERVER_IP 61700
nc -zvu YOUR_SERVER_IP 61701

2. Access Web UI

Open browser and navigate to:

https://YOUR_SERVER_IP:9443

or

https://camouflage.example.com:9443

3. Test VPN Connection

Enterprise (with Web UI):

1. Create a test node in the Web UI
2. Download the .camouflage config file
3. Install Camouflage client on another device
4. Import config and connect
5. Verify connection in dashboard

Standalone (daemon only):

1. Register a client: camouflage-daemon add-client --name "test-client"
2. Export a profile: camouflage-daemon export-profile --auth-key "tskey-..." --server YOUR_SERVER_IP:61700 --output test.camouflage
3. Transfer the .camouflage file to the client device
4. Connect: camouflage-client connect --profile test.camouflage
5. Verify with: camouflage-daemon list-clients

Troubleshooting

Port Not Accessible

Check firewall:

sudo ufw status
sudo iptables -L -n

Check Docker container:

docker ps
docker logs camouflage-ce

Check port binding:

sudo netstat -tulpn | grep -E '9443|61700|61701'

SSL Certificate Errors

If using self-signed certificates, browsers will show warnings. This is normal. Click "Advanced" and proceed.

For production, use Let's Encrypt or commercial certificates.

Can't Connect from Clients

1. Verify firewall rules allow UDP 61700 and 61701
2. Check router port forwarding (if behind NAT)
3. Verify server public IP matches DNS record
4. Check Camouflage daemon logs: docker logs camouflage-ce | grep daemon

Performance Issues

1. Check server resources: htop or docker stats
2. Verify MTU settings (default 1200 should work for most)
3. Monitor network bandwidth
4. Consider upgrading server specs

Next Steps

• Connect Clients - Set up client devices
• Configure Networks - Customize network settings

Cloud Provider Pricing Estimates

Monthly costs for running Camouflage CE (as of 2024):

• AWS EC2 (t3.small): ~$15-20/month
• GCP (e2-small): ~$12-18/month
• Azure (B1s): ~$10-15/month
• DigitalOcean (Basic 1GB): ~$6/month
• Linode (Nanode 1GB): ~$5/month
• Vultr (1GB): ~$5/month
• Hetzner (CX11): €4/month ($4.50)

Add $2-5/month for static IP if needed. Let's Encrypt SSL certificates are free.