Setup Server

This guide covers the initial configuration of a clean Ubuntu 25.04 server for hosting Byakko in production, including system updates, firewall setup, and VPN access.

System Preparation

Download the latest updates:

sudo apt update && sudo apt upgrade -y

Install networking utilities:

sudo apt install net-tools -y

VPN Setup

Run the openvpn-install script to set up the VPN server:

wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh

Then transfer your client profile to the local machine:

scp <source> <destination>
scp username@b:/path/to/file /path/to/destination

Connect to the VPN before continuing with the firewall configuration.

Firewall Configuration

Open the required ports using UFW:

# Public ports
sudo ufw allow 80/tcp      # HTTP
sudo ufw allow 443/tcp     # HTTPS
sudo ufw allow 1194/udp    # OpenVPN
sudo ufw allow 16443/tcp   # Kubernetes Deployment

The Kubernetes Dashboard should only be accessible over VPN. Replace <internal-ip> with your VPN subnet — the subnet varies per setup. To find yours, run ifconfig tun0 and look for the inet line. Derive the subnet by replacing the last octet with 0 (e.g. 10.1.4.60 → 10.1.4.0/24).

sudo ufw allow from <internal-ip>/24 to any port 22      # SSH
sudo ufw allow from <internal-ip>/24 to any port 10443   # Kubernetes Dashboard

Now enable the firewall:

sudo ufw enable

Or reload when firewall is already enabled:

sudo ufw reload

Show added ports:

sudo ufw show added

Verify the rules are active:

sudo ufw status verbose

Remote Access

Once the VPN is running, connect to the server via its VPN IP. Replace <internal-ip> with the server's VPN address (e.g. 10.1.4.1) — this is the first IP in your VPN subnet, assigned to the server itself:

ssh username@<internal-ip>

Restrict SSH to the VPN subnet for additional security by editing /etc/ssh/sshd_config or adding a UFW rule that denies SSH from outside 10.8.0.0/24.

Next Step