Packet
Configure Pritunl Cloud on Packet
Outdated Documentation - This documentation has not yet been updated for the latest release, refer to the Vultr documentation for updated information.
This tutorial will create a multi host Pritunl Cloud cluster on Packet with public IPv6 addresses for each instance. Instances will have VPC networking across all Pritunl Cloud hosts.
Create MongoDB Server
First create a server to host the MongoDB database. All Pritunl Cloud hosts will connect to this database. For high availability a replica set can be configured. Select CentOS 8 as the Operating System. Then add SSH keys and click Deploy Now.

Connect to the server with SSH using the root user. Then run the commands below to optimize the server and configure the firewall.
sudo tee /etc/sysctl.d/10-dirty.conf << EOF
vm.dirty_ratio = 3
vm.dirty_background_ratio = 2
EOF
sudo tee /etc/sysctl.d/10-swappiness.conf << EOF
vm.swappiness = 10
EOF
sudo tee /etc/security/limits.conf << EOF
* hard nofile 500000
* soft nofile 500000
root hard nofile 500000
root soft nofile 500000
EOF
sudo tee /etc/systemd/system/disable-transparent-huge-pages.service << EOF
[Unit]
Description=Disable Transparent Huge Pages
DefaultDependencies=no
After=sysinit.target local-fs.target
Before=basic.target
[Service]
Type=oneshot
ExecStart=/bin/sh -c '/usr/bin/echo never > /sys/kernel/mm/transparent_hugepage/enabled'
ExecStart=/bin/sh -c '/usr/bin/echo never > /sys/kernel/mm/transparent_hugepage/defrag'
[Install]
WantedBy=basic.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable disable-transparent-huge-pages
sudo yum -y update
sudo yum -y remove cockpit-ws
sudo yum -y install chrony
sudo systemctl start chronyd
sudo systemctl enable chronyd
sudo sed -i '/^PasswordAuthentication/d' /etc/ssh/sshd_config
sudo yum -y install firewalld
sudo systemctl enable firewalld
sudo systemctl start firewalld
sudo firewall-cmd --permanent --new-zone=cloud
sudo firewall-cmd --permanent --zone=cloud --add-source=10.0.0.0/8
sudo firewall-cmd --permanent --zone=cloud --add-service=ssh
sudo firewall-cmd --permanent --zone=cloud --add-service=mongodb
sudo firewall-cmd --permanent --zone=public --remove-service=cockpit
sudo firewall-cmd --permanent --zone=public --remove-service=dhcpv6-client
sudo firewall-cmd --reload
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=public --list-all
sudo firewall-cmd --zone=cloud --list-all
Run the commands below to enable automatic updates.
sudo dnf -y install dnf-automatic
sudo sed -i 's/^upgrade_type =.*/upgrade_type = default/g' /etc/dnf/automatic.conf
sudo sed -i 's/^download_updates =.*/download_updates = yes/g' /etc/dnf/automatic.conf
sudo sed -i 's/^apply_updates =.*/apply_updates = yes/g' /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic.timer
Run the commands below to install MongoDB.
sudo tee /etc/yum.repos.d/mongodb-org-4.2.repo << EOF
[mongodb-org-4.2]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/8/mongodb-org/4.2/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-4.2.asc
EOF
sudo yum -y install mongodb-org
sudo systemctl enable mongod
sudo systemctl start mongod
Run the first two commands to generate random passwords. Then open the MongoDB shell and create users. Replace <PASSWORD1>
and <PASSWORD2>
with the random passwords. Run ip addr
to get the private IPv4 address and replace <PRIVATE_IPV4>
. Then add the authorization option to the configuration and restart MongoDB.
head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32 ; echo ''
head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32 ; echo ''
mongo
use admin;
db.createUser({
user: "admin",
pwd: "<PASSWORD1>",
roles: ["root"]
});
db.createUser({
user: "pritunl-cloud",
pwd: "<PASSWORD2>",
roles: [{role: "dbOwner", db: "pritunl-cloud"}]
});
exit;
ip addr
sudo sed -i 's/bindIp: 127.0.0.1/bindIp: <PRIVATE_IPV4>/g' /etc/mongod.conf
sudo tee -a /etc/mongod.conf << EOF
security:
authorization: "enabled"
EOF
sudo systemctl restart mongod
Run sudo reboot
to restart the server to apply optimizations.
Create Pritunl Cloud Host
Create multiple servers to host Pritunl Cloud, select CentOS 8 as the Operating System. Then add SSH keys and click Deploy Now.

After the server has been created open the server panel and select the Network tab. Then click Assign New Elastic. Select Public IPv6 and then choose a /64 block to assign to the server.

Connect to the server with SSH using the root user. Then run the commands below to optimize the server.
sudo tee /etc/sysctl.d/10-dirty.conf << EOF
vm.dirty_ratio = 3
vm.dirty_background_ratio = 2
EOF
sudo tee /etc/sysctl.d/10-swappiness.conf << EOF
vm.swappiness = 10
EOF
sudo tee /etc/security/limits.conf << EOF
* hard nofile 500000
* soft nofile 500000
root hard nofile 500000
root soft nofile 500000
EOF
sudo yum -y update
sudo yum -y remove cockpit-ws
sudo systemctl disable firewalld
sudo systemctl stop firewalld
sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/sysconfig/selinux
sudo setenforce 0
sudo sed -i '/^PasswordAuthentication/d' /etc/ssh/sshd_config
Run the commands below to enable automatic updates.
sudo dnf -y install dnf-automatic
sudo sed -i 's/^upgrade_type =.*/upgrade_type = default/g' /etc/dnf/automatic.conf
sudo sed -i 's/^download_updates =.*/download_updates = yes/g' /etc/dnf/automatic.conf
sudo sed -i 's/^apply_updates =.*/apply_updates = yes/g' /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic.timer
Run the commands below to install Pritunl and QEMU from the Pritunl KVM repository. The directory /var/lib/pritunl-cloud
will be used to store virtual disks, optionally a different partition can be mounted at this directory. If you have disks that will be dedicated to the virtual machines these should be mounted at the /var/lib/pritunl-cloud
directory.
sudo tee /etc/yum.repos.d/pritunl-kvm.repo << EOF
[pritunl-kvm]
name=Pritunl KVM Repository
baseurl=https://repo.pritunl.com/kvm/
gpgcheck=1
enabled=1
EOF
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 1BB6FBB8D641BD9C6C0398D74D55437EC0508F5F
gpg --armor --export 1BB6FBB8D641BD9C6C0398D74D55437EC0508F5F > key.tmp; sudo rpm --import key.tmp; rm -f key.tmp
sudo yum -y remove qemu-kvm qemu-img qemu-system-x86
sudo yum -y install edk2-ovmf pritunl-qemu-kvm pritunl-qemu-img pritunl-qemu-system-x86
sudo tee /etc/yum.repos.d/pritunl.repo << EOF
[pritunl]
name=Pritunl Repository
baseurl=https://repo.pritunl.com/stable/yum/oraclelinux/8/
gpgcheck=1
enabled=1
EOF
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 7568D9BB55FF9E5287D586017AE645C0CF8E292A
gpg --armor --export 7568D9BB55FF9E5287D586017AE645C0CF8E292A > key.tmp; sudo rpm --import key.tmp; rm -f key.tmp
sudo yum -y install pritunl-cloud
Get the bond0
configuration on the server using the command below.
cat /etc/sysconfig/network-scripts/ifcfg-bond0
DEVICE=bond0
NAME=bond0
IPADDR=128.128.128.128
NETMASK=255.255.255.254
GATEWAY=128.128.128.129
BOOTPROTO=none
ONBOOT=yes
USERCTL=no
TYPE=Bond
BONDING_OPTS="mode=4 miimon=100 downdelay=200 updelay=200"
IPV6INIT=yes
IPV6ADDR=2604:5555:5555:5555::3/127
IPV6_DEFAULTGW=2604:5555:5555:5555::2
DNS1=147.75.207.207
DNS2=147.75.207.208
Copy the IP range from the host Elastic IPs in the Network tab. Add a 1
to the end of the address such as 2604:5555:5555:5555::1/64
. This address will be used below.

From the configuration above copy the IPADDR
, NETMASK
, GATEWAY
, IPV6ADDR
, IPV6_DEFAULTGW
, DNS1
and DNS2
to the configuration below. Replace <IPV6ADDR_ELASTIC>
with the elastic address above.
sudo tee /etc/sysconfig/network-scripts/ifcfg-bond0 << EOF
TYPE="Bond"
BOOTPROTO="none"
NAME="bond0"
DEVICE="bond0"
ONBOOT="yes"
BONDING_MASTER="yes"
BONDING_OPTS="mode=4 miimon=100 downdelay=200 updelay=200"
BRIDGE="pritunlbr0"
EOF
sudo tee /etc/sysconfig/network-scripts/ifcfg-pritunlbr0 << EOF
TYPE="Bridge"
PROXY_METHOD="none"
BROWSER_ONLY="no"
IPADDR="<IPADDR>"
NETMASK="<NETMASK>"
GATEWAY="<GATEWAY>"
BOOTPROTO="none"
USERCTL="no"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6ADDR="<IPV6ADDR>"
IPV6_DEFAULTGW="<IPV6_DEFAULTGW>"
IPV6ADDR_SECONDARIES="<IPV6ADDR_ELASTIC>"
DNS1="<DNS1>"
DNS2="<DNS2>"
NAME="pritunlbr0"
UUID="`uuidgen`"
DEVICE="pritunlbr0"
ONBOOT="yes"
EOF
sudo mv /etc/sysconfig/network-scripts/ifcfg-bond0:0 /etc/sysconfig/network-scripts/ifcfg-pritunlbr0:0
sudo mv /etc/sysconfig/network-scripts/route-bond0 /etc/sysconfig/network-scripts/route-pritunlbr0
sudo sed -i 's/bond0/pritunlbr0/g' /etc/sysconfig/network
sudo sed -i 's/bond0/pritunlbr0/g' /etc/sysconfig/network-scripts/ifcfg-pritunlbr0:0
sudo sed -i 's/bond0/pritunlbr0/g' /etc/sysconfig/network-scripts/route-pritunlbr0
Reboot the server to apply the network changes.
sudo reboot
Replace the <PASSWORD>
with the password generated above and replace <PRIVATE_IPV4>
with the private IPv4 address of the MongoDB server. Repeat this on each host.
sudo pritunl-cloud mongo "mongodb://pritunl-cloud:<PASSWORD>@<PRIVATE_IPV4>:27017/pritunl-cloud?authSource=admin"
sudo systemctl restart pritunl-cloud
Run the command below to get the default password.
sudo pritunl-cloud default-password
Configure Pritunl Cloud
In the Users tab select the pritunl user and set a password. Then add the org
role to Roles and click Save.

In the Storages tab click New. Set the Name to pritunl-images
, the Endpoint to images.pritunl.com
and the Bucket to stable
. Then click Save. This will add the official Pritunl images store.

In the Organizations tab click New. Name the organization org
, add org
to Roles and click Save.

In the Datacenters tab click new and name the datacenter us-west-1
then add pritunl-images
to Public Storages.

In the Zones tab click New and set the Name to us-west-1a
. Set the Network Mode to VXLAN
.

In the Blocks tab click New and set the Name to host0
. These blocks will be used for the host internal network, this network allows the host to communicate with the instances and to provide NAT access to the internet. Set the Network Mode to IPv4
and Netmask to 255.255.255.0
. Then add 10.187.1.0/24
to the IP Addresses. Set the Gateway to 10.187.1.1
. Repeat this for each host incremental the network and gateway such as 10.187.2.0/24
and 10.187.2.1
.

In the Packet management console copy the Elastic IP range from the Network tab in each of the hosts.

In the Blocks tab click New and set the Name to host0ip6
. Set the Network Mode to IPv6
and use the IPv6 range from above. Set the Gateway to the first address in the IPv6 range, this must be same address as the IPV6ADDR_SECONDARIES
address from the network configuration. Repeat this for each host.

In the Nodes tab use the Hostname to match the node to the correct IP block and physical server. Set the node Zone to us-west-1a
and the Network Mode to Internal Only
. Add the pritunlbr0:0
to the Internal Interfaces. Set the Network IPv6 Mode to Static
. Add pritunlbr0
with the matching hosts IP block such as host0ip6
to the External IPv6 Block Attachments. Set the Host Network Block to the matching host block such as host0
. Enable Host Network NAT.

In the Firewalls tab click New. Set the Name to instance
, set the Organization to org
and add instance
to the Network Roles.

In the Authorities tab click New. Set the Name to cloud
, set the Organization to org
and add instance
to the Network Roles. Then copy your public SSH key to the SSH Key field. If you are using Pritunl Zero or SSH certificates set the Type to SSH Certificate and copy the Public Key form the SSH authority in Pritunl Zero to the SSH Certificate field. Then add roles to control access.

In the VPCs tab enter 10.97.0.0/16
in the network field and click New. Add 10.97.1.0/24
to the Subnets with the name primary
. Then set the Name to vpc
and click Save.

In the Instances tab click New. Set the Name to test
, set the Datacenter to us-west-1
, set the Zone to us-west-1a
and set the Node. Set VPC to vpc
and the Subnet to primary
. Add instance
to the Network Roles and set the Image to oraclelinux8_1912.qcow2
. If no images are shown check the Storages and restart the pritunl-cloud
service. Click Create twice to accept the Oracle license. Repeat this again to create instances on each node.

Once the instance has started SSH into the instance using the Public IPv6 address and SSH key configured with the username cloud
. Due to a networking issue you may need to first ping the public IPv6 address before using SSH. Verify that VPC traffic works between instances using ping to the Private IPv4 address of each instance.
Updated over 1 year ago