Kali/OpenVPN/PIA

In this scenario, we configure OpenVPN to connect to PIA's VPN servers and make our Kali machine a node on the PIA VPN network.

Setup

These instructions assume you have set up OpenVPN and it has created an interface tun0 at the IP address 10.8.0.1.

See Kali/OpenVPN for setup instructions.

PIA Configuration

Conveniently, PIA provides OpenVPN configuration files to connect to their VPN servers:

wget https://www.privateinternetaccess.com/openvpn/openvpn.zip
unzip openvpn.zip -d openvpn

Copy the profile and certs into /etc/openvpn/:

sudo cp openvpn/ca.rsa.2048.crt openvpn/crl.rsa.2048.pem /etc/openvpn/
sudo cp "openvpn/US California.ovpn" /etc/openvpn/US.conf

Test Configuration

To test that your OpenVPN is routing traffic through PIA as expected:

1. Check your IP (one way is to search "whats my ip" on duckduckgo, which will tell you your IP and a geolocation)

2. Start OpenVPN (interactively) with the PIA config file:

openvpn --config /etc/openvpn/US.conf

3. Repeat step 1 and confirm the IP and geolocation have changed

Troubleshooting

Use tcpdump to monitor packets traveling through interfaces.

Interference with other network interfaces

I had two network interfaces, wlan1 (an access point/wifi hotspot) and wlan2 (a wifi connection to the internet), connected via iptables so that hotspot traffic on wlan1 was forwarded through to the wifi connection on wlan2. However, this broke when OpenVPN was started with the PIA config file.

To troubleshoot, run tcpdump and watch the wlan1 interface, which hosts the hotspot:

tcpdump -i wlan1

Now visit duckduckgo.com on a client on the hotspot and ensure you see that traffic passing through. Incidentally, if you monitor wlan1 you will see the hostname of the hotspot client visiting duckduckgo, but if you monitor wlan2 you will see the hostname of the computer serving as the hotspot access point.

While monitoring a normal connection, you should see packets going FROM the hotspot client hostname TO some destination that is either an IP address or an esoteric cloud URL, and you should also see packets going FROM the destination back TO the hotspot client hostname.

While monitoring the hotspot wifi interface while the OpenVPN connection was on, I would see packets going FROM the hotspot client TO the destination, but would not see any packets going FROM the destination making it back TO the hotspot client.