Step 3 (NOTE): What IPs are to be placed here - "san @IP_address --san IP_address"?

Hi Josh,

I believe that you’re on the right track! When using an IP address instead of a domain name for your VPN server, you need to include your server’s IP address in all three places: the Common Name (CN) and both Subject Alternative Name (SAN) entries.

Here’s how you should modify the command:

pki --pub --in ~/pki/private/server-key.pem --type rsa \
| pki --issue --lifetime 1825 \
    --cacert ~/pki/cacerts/ca-cert.pem \
    --cakey ~/pki/private/ca-key.pem \
    --dn "CN=YOUR_SERVER_IP" --san @YOUR_SERVER_IP --san YOUR_SERVER_IP \
    --flag serverAuth --flag ikeIntermediate --outform pem \
>  ~/pki/certs/server-cert.pem

Replace YOUR_SERVER_IP with the actual IP address of your VPN server.

Explanation:

• --dn "CN=YOUR_SERVER_IP": Sets the Common Name in the certificate to your server’s IP address.
• --san @YOUR_SERVER_IP: Adds your server’s IP as an IP type SAN. The @ symbol indicates that it’s an IP address.
• --san YOUR_SERVER_IP: Adds your server’s IP as a DNS type SAN. Some clients require the IP address to be listed as a DNS SAN as well.

Including both SAN entries ensures compatibility with various clients that might handle certificate verification differently.

Regarding your other questions:

1. Will I be able to use this VPN and find my server on Minecraft Java?

   Yes, once connected to the VPN, your devices will be on the same virtual network, allowing you to connect to your Minecraft server using its private IP address.

2. Will it slow down the connection?

   There might be a slight overhead due to encryption, but IKEv2 is efficient and generally offers high performance, so any impact on your connection speed should be minimal.

3. I set the UFW rate limit rule to open the 25565/TCP port. Will I be able to connect to my server from one of my approved (publickey) devices?

   Yes, as long as the firewall is correctly configured to allow traffic on port 25565/TCP and your devices are connected to the VPN, you should be able to connect without issues.

- Bobby