View source for RaspberryPi/OpenVPN

=OpenVPN plus PIA=

==Preparing the Pi==

===Fixing iptables legacy===

On the Kali linux pi image I used, I had to fix iptables to use a legacy NAT mode:

<pre>
$ sudo update-alternatives --config iptables
There are 2 choices for the alternative iptables (providing /usr/sbin/iptables).

  Selection    Path                       Priority   Status
------------------------------------------------------------
  0            /usr/sbin/iptables-nft      20        auto mode
* 1            /usr/sbin/iptables-legacy   10        manual mode
  2            /usr/sbin/iptables-nft      20        manual mode
</pre>

Initially, 0 was selected. Select the one called <code>iptables-legacy</code>.

==OpenVPN==

https://docs.pi-hole.net/guides/vpn/installation/

===Installing OpenVPN===

<pre>
wget https://git.io/vpn -O openvpn-install.sh
chmod 755 openvpn-install.sh
sudo ./openvpn-install.sh
</pre>

This will ask you which interface the openvpn server should bind to. Select the one that is public-facing (the internet).

I used the default port 1194, defaults for everything else.

Grab a coffee, this will install a bunch of stuff.

===Checking OpenVPN Interface===

OpenVPN will create a tun0 interface. Get its IP address:

<pre>
ifconfig tun0 | grep 'inet'
</pre>

Now take note of this IP address, as we will need to set a DNS option for our OpenVPN connection.

===Use Pi VPN Gateway as DNS Server===

The next step will tell anyone on the VPN network we just created to use the Pi as the DNS server.

{{Main|Kali/OpenVPN/DNS}}

==PIA==

https://www.novaspirit.com/2017/06/22/raspberry-pi-vpn-router-w-pia/

<!--

===Setup===

<pre>
wget https://www.privateinternetaccess.com/openvpn/openvpn.zip
unzip openvpn.zip -d openvpn
sudo cp openvpn/ca.rsa.2048.crt openvpn/crl.rsa.2048.pem /etc/openvpn/
sudo cp 'openvpn/US New York.ovpn' /etc/openvpn/US.conf
</pre>

===Add to OpenVPN===

Now add login creds for PIA to file <code>/etc/openvpn/login</code>:

<pre>
username123
password123
</pre>

Now edit the config file to use these creds:

<pre>
vim /etc/openvpn/US.conf
</pre>

change the line with <code>auth-user-pass</code> in it to:

<pre>
auth-user-pass /etc/openvpn/login
ca /etc/openvpn/ca.rsa.2048.crt
</pre>

===Test it out===

Check that it runs interactively:

<pre>
openvpn --config /etc/openvpn/US.conf
</pre>

Now set it as a startup service:

<pre>
sudo systemctl enable openvpn@US
</pre>

===Enable packet forwarding===

Edit <code>/etc/sysctl.conf</code>

Add/uncomment the line:

<pre>
net.ipv4.ip_forward = 1
</pre>

Enable the service:

<pre>
sudo sysctl -p
</pre>

-->

==Forwarding from OpenVPN to Access Point==

{{Main|Kali/OpenVPN/Hotspot}}

=Flags=

{{PiFlag}}

{{OpenVPNFlag}}

[[Category:Networking]]
[[Category:Iptables]]