CHPC VPN

The CHPC requires all access to the cluster to use the CHPC Wireguard VPN server. This adds an essential additional security layer to protect the internal network and your connection.

The Wireguard VPN is fast and uses modern advanced encryption to protect your connection.

To connect to our VPN you will need to install the Wireguard software on your computer. Then download the configuration file which includes the secret encryption keys and add to your Wireguard. The steps are listed below.

• Log in to the CHPC User Portal.
• Navigate to the VPN page at users.chpc.ac.za/vpn

• If you do not yet have a VPN profile, click Create Profile.
• Click Download Configuration to download your WireGuard configuration file.
• Install WireGuard on your device: for installation see wireguard.com/install.
• Import the downloaded configuration file into WireGuard.
• Click Connect / Activate in WireGuard to establish the VPN connection.

• Once connected, you can securely access internal CHPC resources (such as SSH access to Lengau).
• To SSH to Lengau, please follow the SSH keys process first: for SSH key setup instructions, see SSH Key Setup Guide.
• Disconnect the VPN when you are finished.

Need help? Contact the CHPC Help Desk if profile creation, configuration download, or connection fails.

The most common reason for failure to connect to our Wireguard VPN is that your university or institution has blocked the port used by Wireguard on their firewall.

This occurs when you are at your university and connected to its network (WiFi or Ethernet) and find that when activating the VPN it fails.

Then please contact your university's IT department and request that they check if UDP port 51820 is open to server vpn.chpc.ac.za.

If they confirm it is blocked then please request they open UDP port 51820 only for our VPN server at DNS address vpn.chpc.ac.za. Should they have any concerns about this, please ask them to contact us on our Help Desk at helpdesk @ chpc.ac.za.

If you are working from home or away from your institution but have to use a VPN to connect to its web services, then you may find that activating our VPN at the same time does not work.

In general, running multiple VPNs simultaneously on the same device can be unreliable as they can interfere with each other because your operating system can not reliably determine which VPN to use for which connection.

We recommend deactivating other VPNs before using the CHPC VPN if you have any issues.

If you are running Linux on your Laptop or workstation then configuring the Wireguard VPN may need some manual steps to be done on the command line.

The steps are straightforward:

• Copy the config file you downloaded into the /etc/wireguard/ directory. You will need to use the sudo command or log into your computer as root.
• Then rename that file to wg0.conf.
  (Of course, if you already have a wg0.conf file for another VPN then rename it to wg1.conf instead.)
• Then start the VPN with the sudo wg-quick up wg0 command.
• After you are finished using the cluster and have disconnected from the CHPC, then use sudo wg-quick down wg0 to disconnect the VPN.

If you are using Debian, Ubuntu, Linux Mint or other Linux distribution based on Debian, then wg-quick may give you the error message

/usr/bin/wg-quick: line 32: resolvconf: command not found

because Debian based distributions (especially older ones) do not by default provide the resolvconf command.

The simplest fix is to set up a symbolic link with

sudo ln -s /usr/bin/resolvectl /usr/local/bin/resolvconf

Note that newer Debian/Ubuntu/Linux Mint already fix this, so only set this up if you get the “resolvconf: command not found” error message.