Unknown user at 05:18, 19 August 2020

2020-08-19T05:18:29Z

← Older revision		Revision as of 05:18, 19 August 2020
Line 3:		Line 3:
	Previous: [[Ubuntu/Bespin/Ansible]]		Previous: [[Ubuntu/Bespin/Ansible]]

	Next: [[Ubuntu/Bespin/~~PiHole~~]]		Next: [[Ubuntu/Bespin/DNS]]

	In this section we set up a VPN tunnel using OpenVPN and a pre-existing OpenVPN server. For this specific example we cover the use of Private Internet Access, a third-party VPN provider.		In this section we set up a VPN tunnel using OpenVPN and a pre-existing OpenVPN server. For this specific example we cover the use of Private Internet Access, a third-party VPN provider.

Unknown user at 04:48, 19 August 2020

2020-08-19T04:48:42Z

← Older revision		Revision as of 04:48, 19 August 2020
Line 108:		Line 108:
	and look up the IP address location to determine whether your traffic is being routed properly through Belgium, or wherever you chose.		and look up the IP address location to determine whether your traffic is being routed properly through Belgium, or wherever you chose.

			==Related==


			Also see: [[Ubuntu/OpenVPN Server]]

Unknown user at 04:47, 19 August 2020

2020-08-19T04:47:51Z

← Older revision		Revision as of 04:47, 19 August 2020
Line 1:		Line 1:
			Up: [[Ubuntu/Bespin]]

			Previous: [[Ubuntu/Bespin/Ansible]]

			Next: [[Ubuntu/Bespin/PiHole]]

	In this section we set up a VPN tunnel using OpenVPN and a pre-existing OpenVPN server. For this specific example we cover the use of Private Internet Access, a third-party VPN provider.		In this section we set up a VPN tunnel using OpenVPN and a pre-existing OpenVPN server. For this specific example we cover the use of Private Internet Access, a third-party VPN provider.

Unknown user: Created page with "In this section we set up a VPN tunnel using OpenVPN and a pre-existing OpenVPN server. For this specific example we cover the use of Private Internet Access, a third-party VP..."

2020-08-18T03:01:24Z

Created page with "In this section we set up a VPN tunnel using OpenVPN and a pre-existing OpenVPN server. For this specific example we cover the use of Private Internet Access, a third-party VP..."

New page

In this section we set up a VPN tunnel using OpenVPN and a pre-existing OpenVPN server. For this specific example we cover the use of Private Internet Access, a third-party VPN provider.

==Install software==

<pre>
sudo apt-get -y install openvpn
</pre>

==Obtain OpenVPN profile==

For PIA:

<pre>
cd /tmp
wget https://www.privateinternetaccess.com/openvpn/openvpn.zip
unzip -d openvpn openvpn.zip
cd openvpn
</pre>

This directory contains multiple OpenVPN profiles for each of PIA's server regions.

RUN THE FOLLOWING COMMANDS AS ROOT.

To use the openvpn profile, server cert, and client key:

<pre>
PROFILE="Belgium"
cp ca.rsa.2048.crt /etc/openvpn/.
cp crl.rsa.2048.pem /etc/openvpn/.
cp ${PROFILE}.ovpn /etc/openvpn/.
</pre>

Now add login credentials to a login file:

<pre>
touch /etc/openvpn/login
echo "USERNAME" >> /etc/openvpn/login
echo "PASSWORD" >> /etc/openvpn/login
</pre>

Modify the OpenVPN profile to use the credentials file we just made, and to point to the correct locations of the certificate and key.

Also modify the OpenVPN profile to name the tunnel device it will create. We will set the tunnel device name as <code>tun1</code>:

<pre>
sed -i 's+^auth-user-pass+& /etc/openvpn/login+' /etc/openvpn/${PROFILE}.ovpn
sed -i 's+^ca ca.rsa.2048.crt+& /etc/openvpn/ca.rsa.2048.crt+' /etc/openvpn/${PROFILE}.ovpn
sed -i 's+^crl-verif crl.rsa.2048.pem+& /etc/openvpn/crl.rsa.2048.pem+' /etc/openvpn/${PROFILE}.ovpn
sed -i 's+dev tun$+dev tun1+' /etc/openvpn/${PROFILE}.ovpn
</pre>

==Testing OpenVPN Tunnel==

Test the VPN connection by running <code>curl -4 icanhazip.com</code> before and after you bring the VPN up to verify your IP has changed:

<pre>
openvpn --config /etc/openvpn/${PROFILE}.ovpn
</pre>

Note that you may have a config file (.conf) instead, in which case, use the config file instead of the .ovpn file.

Use <code>curl -6 icanhazip.com</code> to test whether your IPv6 address has changed.

You can also run <code>ifconfig</code> and you should see a <code>tun1</code> device with an IP address like 10.X.Y.Z. This is the VPN connection. To run curl using specifically that network interface, use the <code>--interface</code> flag with curl:

<pre>
curl --interface 10.96.10.6 -4 icanhazip.com
</pre>

The VPN should be capturing and routing ALL traffic through the VPN tunnel. Double check by running this command, which should fail to do anything:

<pre>
curl --interface 192.168.0.199 -4 icanhazip.com
</pre>

where 192.168.0.199 is the IP address of bespin on the wifi network.

==Modifying OpenVPN Service==

Before we can automatically start OpenVPN, we need to modify the startup service to look for .ovpn files instead of .conf files. Use this sed one-liner to do that:

<pre>
sed -i 's|\.conf|.ovpn|' /lib/systemd/system/openvpn@.service
</pre>

==Enabling OpenVPN Service==

To start the process automatically in the background, and on boot, enable the OpenVPN service. It will be called <code>openvpn@${PROFILE}</code>. So, to use the example of Belgium.ovpn,

<pre>
sudo service openvpn@Belgium start
</pre>

This will look for a file named Belgium.ovpn and start an OpenVPN client process connecting to that server.

Once again you can check your public IP with

<pre>
curl -4 icanhazip.com
</pre>

and look up the IP address location to determine whether your traffic is being routed properly through Belgium, or wherever you chose.

[[Category:Ubuntu]]
[[Category:Linux]]
[[Category:PIA]]
[[Category:VPN]]
[[Category:OpenVPN]]
[[Category:Proxy]]

Ubuntu/Bespin/PIA - Revision history

Unknown user at 05:18, 19 August 2020

Unknown user at 04:48, 19 August 2020

Unknown user at 04:47, 19 August 2020

Unknown user: Created page with "In this section we set up a VPN tunnel using OpenVPN and a pre-existing OpenVPN server. For this specific example we cover the use of Private Internet Access, a third-party VP..."