Can we make a Vpn server run on Android? Can we make a Vpn server run on Android. Can applications do this? If yes, which protocols are supported and is this a good idea to use such apps? If not, what are some issues that we may face?
Yes we can run VPN server on Android, but not without root. Stock Android doesn't support VPN servers, even many protocols aren't supported as client too, so you have to install third party apps. There are apps like Servers Ultimate which offer VPN server, but I haven't tested. CLI keeps life simple:


Build openvpn static binary and copy to /system/bin.
Create a basic server configuration file:

### /etc/openvpn/server.conf

# basic configuration
port 69
proto udp
dev tun
mode server
tls-server
keepalive 10 120

# dynamic IP pool
server 10.8.0.0 255.255.255.0

# send RESTART command to clients if tunnel is restarted (UDP)
explicit-exit-notify 1

# configure like a "traditional" broadcast-based network
topology subnet
push "topology subnet"

# send all traffic from client to VPN
push "redirect-gateway def1 bypass-dhcp"

# DNS nameservers
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"

# certificates and keys to use
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
tls-crypt tc.key

# cipher algorithm to use for encryption
cipher AES-256-CBC

# log files
log /data/media/0/openvpn.log
status /data/media/0/openvpn-status.log
verb 3

# do not recreate TUN interface on reset (SIGUSR1)
persist-tun

# do not reread key files on reset (SIGUSR1)
persist-key

Create server keys and certificates. tc.key can be created by executing openvpn --genkey --secret tc.key.
ca.crt, server.key, server.crt and dh2048.pem are built using EasyRSA. It can be done easily on a Linux/Windows PC, on Android it rquires some extra effort:

~$ easyrsa init-pki
~$ easyrsa build-ca
~$ easyrsa build-server-full server nopass
~$ easyrsa gen-dh

Copy configuration file, certificates and keys to /etc/openvpn/ and set permissions:

~# chmod 0600 /etc/openvpn/{ca.crt,dh2048.pem,server.crt,server.key,tc.key}
~# chmod 0644 /etc/openvpn/server.conf
~# chmod 0755 /system/bin/openvpn
~# chown -R 0.0 /etc/openvpn /system/bin/openvpn

In the same way build client key and certificate using EasyRSA:

~$ easyrsa --days=30 build-client-full client nopass


Copy the contents of ca.cert, client.key, client.crt and tc.key to client configuration file. Also add public IP address of Android device if want to connect from internet or local (WiFi/hotspot) IP address:

### client.ovpn

client
dev tun
auth-nocache
verb 3

remote-cert-tls server
cipher AES-256-CBC

pull
resolv-retry infinite

remote &lt;IP_ADDRESS&gt; 69 udp
nobind
connect-retry 5 5
connect-timeout 10

# only for Windows
#block-outside-dns

&lt;ca&gt; INSERT_HERE &lt;/ca&gt;
&lt;cert&gt; INSERT_HERE &lt;/cert&gt;
&lt;key&gt; INSERT_HERE &lt;/key&gt;
&lt;tls-crypt&gt; INSERT_HERE &lt;/tls-crypt&gt;

Android ignores main table at all, create custom rule and insert routes:

~# ip rule add table 5000 priority 5000
~# ip route add 10.8.0.0/24 dev tun0 table 5000
~# ip route add 192.168.43.0/24 dev wlan0 table 5000
~# ip route add default dev rmnet_data1 table 5000


Where rmnet_data1 is the interface connecting to Mobile Data and wlan0 is WiFi or hotspot. Adjust interface names and network addresses according to your device.

Setup forwarding and source NAT:

~# echo -n 1 &gt;/proc/sys/net/ipv4/ip_forward
~# iptables -I FORWARD -i tun+ -j ACCEPT
~# iptables -I FORWARD -o tun+ -j ACCEPT
~# iptables -t nat -I POSTROUTING -o rmnet_data1 -j MASQUERADE

Run server, but first make a minor adjustment due to difference in Android vs. Linux:

~# mkdir /dev/net
~# ln -s /dev/tun /dev/net/tun

~# openvpn --cd /etc/openvpn/ --config server.conf



Import the client.ovpn in any OpenVPN client app (on Android / Windows / Linux) and connect.

You can do advanced configuration on server, run it as an Android init service, or what ever you want.



RELATED:


How to run SSH/SFTP server for multiple user logins with password authentication on Android?
How to use your Android phone as a proxy server?