CloakVPN: A Personal, Region-Aware Stealth VPN Built with Python & Terraform

Ever felt like commercial VPNs are black boxes — taking your traffic through unknown infrastructure while you trust them blindly with your data? I wanted more control. More transparency. And absolute ownership of the network path.

That's why I built CloakVPN — a fully automated, personal VPN system where the infrastructure is yours. It provisions AWS EC2 instances in multiple regions, configures OpenVPN on each, and rotates connections based on your chosen mode. All orchestrated from your own machine.

No third-party VPN provider. No opaque logs. No data sharing. Just your own VPN nodes, running on your own cloud.

🧩 Motivation: Why Build Your Own VPN?

Commercial VPNs often offer convenience at the cost of:

• Lack of transparency — you don't control the servers.
• No guarantee of data isolation — traffic logs could be retained.
• Limited configurability — no custom modes, rotation, or deeper tuning.

With CloakVPN, your VPN traffic is routed through AWS EC2 nodes that you launch and destroy. It's built to:

• Give full visibility and ownership of IP infrastructure
• Rotate VPN identities across regions automatically
• Match your browsing identity to IP geography
• Explore network-level privacy from the ground up

🏗️ Architecture Overview

📁 Folder Structure

📦 CloakVPN
├── terraform/                 # Infra provisioning
│   ├── main.tf
│   ├── outputs.tf
│   ├── variables.tf
│   └── modules/
│       └── vpn/               # OpenVPN EC2 module
├── orchestrator/              # Python runner
│   ├── cloakvpn_gui.py        # tkinter GUI
│   ├── provisioner.py         # Terraform + OVPN orchestration
│   ├── vpn_connector.py       # OpenVPN connector (full/partial mode)
│   ├── download_ovpn.py       # SSH download logic
│   ├── utils.py               # Logging, ping utils, sudo checks
│   └── constants.py
├── regions.json               # Input config (regions + count)
└── README.md

🧠 Philosophy

This project is about control and observability. Instead of outsourcing VPN trust, you:

• Decide where VPN nodes are (per region)
• Own all .ovpn credentials locally
• Rotate connections every N seconds (full mode)
• Lock to a single trusted region (partial mode)
• Always know which IP you're using — because it's yours

🖥️ Features

• ✅ GUI to select regions & modes
• ✅ Live Terraform apply with streaming logs
• ✅ Auto-fetch .ovpn files via SSH
• ✅ Ping-based selection of fastest OpenVPN node
• ✅ IPv6 hard-disable during VPN use
• ✅ Log file tracking all activity
• ✅ CLI/GUI flexibility

💡 Budget Comparison vs NordVPN

NordVPN base plan: $12.99/month ≈ $0.43/day

Let's see how many AWS VPN instances you can run per day for the same cost:

You get better value, dynamic IPs, and zero third-party data logging — on infrastructure you control. People have a notion that EC2 instances are costly, but if it's well managed, it can be quite cheap.

🧪 VPN Modes

1. Full Cloak Mode

• Chooses a random region from available .ovpn files
• Connects for N seconds → disconnects → rotates
• Ensures frequent IP rotation, ideal for general privacy and geo-hopping

2. Partial Cloak Mode

• Locks to a specific region
• Picks the best .ovpn from that region by ping
• Ideal for persistent identity, but via a trusted exit node

🧰 How It Works

Step 1: Choose Regions

Using the GUI, select your desired AWS regions (e.g. US-East, EU-Central, Japan).

Step 2: Provision Infrastructure

• CloakVPN uses Terraform to spin up EC2 instances
• Each instance is bootstrapped with OpenVPN and generates a .ovpn client file
• Files are pulled back over SSH

Step 3: Run VPN in Full or Partial Mode

• In Full Mode, the system rotates through available .ovpn files automatically
• In Partial Mode, it picks the fastest server in your chosen region

🧱 Requirements

• macOS or Linux
• Python 3.8+
• AWS CLI + credentials
• Terraform installed
• OpenVPN installed

Python dependencies (from requirements.txt):

ping3
requests

⚙️ To Run Locally

a. Clone the repo

git clone git@github.com:BitanSarkar/cloak-vpn.git
cd cloak-vpn

b. Install dependencies

pip install -r requirements.txt

c. Run GUI with sudo

sudo python3 orchestrator/cloakvpn_gui.py

📷 Screenshots

🔘 Region Selection & Provision

A. First select the regions.

B. Click Provision + Fetch OVPN to terraform the architecture.

C. Wait for the .ovpn files to download.

📡 Ping Summary

After provisioning, it creates the ping summary.

🔄 VPN Control

A. Partial mode

Choose a region and click Start — connection logs stream on the right.

Then go to whatismyipaddress.com to verify location.

Open YouTube — your location will have changed.

Open Netflix, Prime, or any site, and you'll get the content available in those regions.

B. Full Mode

Your IP rotates randomly between regions every 120 seconds.

For the first 120 seconds:

Next 120 seconds:

🧠 When to Use Full Mode vs Partial Mode

CloakVPN offers two operational modes — each designed for a different stealth or stability strategy. Here's how to choose.

🔁 Full Mode

What it does

• Periodically rotates VPN connections across multiple regions.
• Each connection randomly selects one .ovpn configuration file from that region.
• IP, geolocation, and network fingerprint keep changing every N seconds.

Best for

• Stealth operations: testing region-specific access, censorship circumvention, or rotating IPs during scraping.
• Temporary obfuscation: you don't want your identity tied to a single region or address.
• Ad blocking, rate limiting, and firewall avoidance scenarios.

Trade-off

• Your session may be interrupted briefly during rotation.
• Not ideal for apps requiring a persistent connection (e.g. streaming or banking).

📍 Partial Mode

What it does

• Connects to only one region.
• Picks the best .ovpn file based on lowest ping latency.
• VPN stays fixed and stable.

Best for

• Long sessions in a consistent region (e.g. browsing, file transfers).
• Country-specific content like streaming platforms or government portals.
• Secure browsing using a single trusted server that you control.

Trade-off

• IP stays static (until you re-run provisioning).
• Less stealth, but more stability and predictability.

💡 Tip: If you're unsure, start with Partial Mode for stability. Use Full Mode only when you want dynamic IP hopping, or to avoid long-term association with one region.

🔒 Why This Matters

In an era of privacy erosion, outsourcing identity to third-party VPNs is no longer enough. CloakVPN gives you:

• Transparent exit node setup
• Owned infrastructure for VPN routing
• Real-time control over how and where you appear

Because when it comes to privacy, owning the pipe is better than trusting it.

🚧 Future Improvements

• Add Docker-based deployment
• Deploy OpenVPN nodes on cheaper spot instances
• Auto-destroy idle nodes on exit
• Add a CLI wrapper for headless mode
• Extend to support WireGuard

🧠 Final Thoughts

This was a weekend-long dive into Terraform + Python glue code, SSH, and privacy tooling. And while it may not replace your everyday VPN yet, it proves that you can roll your own secure identity layer — and understand every moving part of it.

Give it a try. Your VPN should be yours.

🔗 Resources

👉 GitHub — CloakVPN

Feedback and contributions welcome.