Startup

Wipe SD Cards

Wipe SD cards and install raspbian

Mount SD Cards

Mount the SD cards as a local filesystem on a Linux box

Now, if you want to modify the file /foo/bar, you can edit the file on the SD card at /media/ubuntu/rootfs/foo/bar

Enable SSH

Touch a file named ssh in the boot sector of the SD card to enable the service to start on boot:

touch /media/ubuntu/boot/ssh

Wifi

Set up wpa supplicant config file for your local wifi network

https://charlesreid1.com/wiki/Ubuntu/Bespin#Configure_WPA_Supplicant

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

network={
    ssid="YOURWIFINETWORK"
    proto=RSN
    key_mgmt=WPA-PSK
    pairwise=CCMP TKIP
    group=CCMP TKIP
    psk="YOURWIFIPASSWORD"
}

Network Interfaces

Next set up the WPA supplicant service to automatically start for our wifi device

Update the contents of your network interfaces file to look like this:

/etc/network/interfaces

source-directory /etc/network/interfaces.d

allow-hotplug lo
iface lo inet loopback

allow-hotplug wlan0
iface wlan0 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

Power up the Pi

Next time you boot up the Pi you should see your wifi card light blinking.

Try running an nmap scan for port 22 before and after the pi is plugged in, from another computer on the same network:

nmap -p22 192.168.0.0/24 > nmap-before

# plug in the pi, wait a few minutes

nmap -p22 192.168.0.0/24 > nmap-after

assuming your home wifi is 192.168.0.0/24.

Troubleshooting

If you need to troubleshoot, power off the Pi and re-mount the SD card on a Linux box. Check the syslog at /media/ubuntu/rootfs/var/log/syslog and see what's going on.

Thing 1

Installing PIA on Thing 1

This sets up a VPN tunnel at tun0 that connects to a PIA VPN server.

Run these commands as sudo:

# install openvpn
apt-get -y install openvpn

# set up pia
cd /tmp
wget https://www.privateinternetaccess.com/openvpn/openvpn.zip
unzip -d openvpn openvpn.zip
cd openvpn

# pick a profile to install
mv 'US West.ovpn' 'West.ovpn'
PROFILE="West"
cp ca.rsa.2048.crt /etc/openvpn/.
cp crl.rsa.2048.pem /etc/openvpn/.
cp ${PROFILE}.ovpn /etc/openvpn/.

# set up login credentials for PIA
touch /etc/openvpn/login
echo "USERNAME" >> /etc/openvpn/login
echo "PASSWORD" >> /etc/openvpn/login
chown root:root /etc/openvpn/login
chmod 600 /etc/openvpn/login

# modify openvpn service to use .ovpn files intead of .conf files, and set absolute paths
sed -i 's+^auth-user-pass+& /etc/openvpn/login+' /etc/openvpn/${PROFILE}.ovpn
sed -i 's+^ca ca.rsa.2048.crt+& /etc/openvpn/ca.rsa.2048.crt+' /etc/openvpn/${PROFILE}.ovpn
sed -i 's+^crl-verif crl.rsa.2048.pem+& /etc/openvpn/crl.rsa.2048.pem+' /etc/openvpn/${PROFILE}.ovpn
sed -i 's+\.conf+.ovpn+' /lib/systemd/system/openvpn@.service

# start openvpn
openvpn --config /etc/openvpn/${PROFILE}.ovpn

Once you have verified it is working, cancel the openvpn process and run the openvpn service:

systemctl enable openvpn@${PROFILE}
systemctl start openvpn@${PROFILE}

Verify it is working:

curl -4 icanhazip.org

and verify it is working.

Connect Thing 1 to internet

At this point, you will need an internet connection, plus an unoccupied wifi device.

You can leave the first wifi card alone as it is, and plug in a second wifi card (wlan1).

Or, you can connect an ethernet cable (eth0) and use wlan0 to run the hostapd.

In our scenario we have the following setup:

The main internet connection for the Pi is a physical ethernet cable eth0 connected to a network at 192.168.0.0/24
The hostapd wifi network is provided through a wifi card wlan0 and providing a network at 192.168.10.0/24

Hostapd on Thing 1

First allow the Pi to forward packets and act as a router by adding this line to your sysctl config:

/etc/sysctl.conf

net.ipv4.ip_forward=1

Reload the sysctl:

sudo sysctl --system

Install hostapd:

sudo apt-get -y install hostapd

Configure hostapd file:

/etc/hostapd/hostapd.conf

interface=wlan1
driver=nl80211
hw_mode=g
channel=1
macaddr_acl=0
ignore_broadcast_ssid=0

# LAN10
ssid=LAN10
wpa_passphrase=cow-doctor-horse-building-5
auth_algs=1
wpa=3
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

Connecting Hostapd and PIA

To continue on the description of the setup provided above, this section describes how to achieve the following setup:

The main internet connection for the Pi is a physical ethernet cable eth0 connected to a network at 192.168.0.0/24
The hostapd wifi network is provided through a wifi card wlan0 and providing a network at 192.168.10.0/24
The Pi runs a VPN tunnel to a PIA server, which creates the virtual device tun0
Traffic from the hostapd wifi network wlan0 is tunneled through the PIA tunnel tun0
NO traffic passes directly between wlan0 and eth0

To connect the hostapd network to the PIA tunnel, we need to use iptables to forward packets from one network interface to another.

Thing 2

Installing PiHole on Thing 2

This one is pretty easy. The one-liner, once you've inspected the code you're about to run (OF COURSE), is:

curl -sSL https://install.pi-hole.net | sudo bash

Normally it's bad practice to pipe to sudo bash, but this time around we make an exception. Ya know. Cuz we do like we do. You don't like it, you fuck off, you hear?

Now where was I.

Enabling DNS queries from local network

To make the PiHole work for everyone on the local network, you need to enable the PiHole to respond to DNS queries from other hosts.

Boot up the Pi and go to the admin interface at 192.168.0.*/admin. Navigate to the Settings, then the DNS tab, and pick the option to respond to all queries from computers that are one hop away (local devices).

Using the PiHole DNS as the PiHole DNS

For some reason, the PiHole doesn't configure itself to use itself as its own DNS server. By default, if you run dig doubleclick.net, it will return the real IP for doubleclick.net (even though that's a domain that the PiHole will block). But if you use the loal IP address of the PiHole, dig doubleclick.net @192.168.0.300 (replace 300 with the IP of the PiHole server), it resolves to 0.0.0.0 as expected.

To use the PiHole DNS as the system DNS, edit the following file:

/etc/resolv.conf

nameserver 192.168.0.300

(replace 300 with the ip of the pihole server)

Now restart the resolved service:

sudo systemctl restart systemd-resolvd

Now you can check to verify that dig returns the right IP (0.0.0.0) for doubleclick.net:

dig doubleclick.net

Installing PIA on Thing 2

Follow the steps above to install PIA on Thing 2.

When the installation is done, you'll probably notice that DNS is borked on the PiHole. That's because the PiHole set up to use itself, the PiHole, as a DNS server, but when the local DNS server can't resolve a URL, it sends the requests to an upstream DNS server. If the PIA tunnel is up, PIA attempts to prevent DNS leaks by blocking the outbound DNS request going to 8.8.8.8.

To fix this, we have to set some iptables rules, so that the DNS requests from the PiHole will be directed through the tunnel, and therefore will not be blocked but will be sent upstream to the PIA proxy server.

Connecting PiHole to PIA

Next step is to set up PIA on Thing 2 so that all DNS queries will pass through a PIA tunnel.

As mentioned above, we need to use iptables to forward packets from one interface to another so that DNS requests can flow from clients to the PiHole server, and from the PiHole server out through the PIA tunnel to the wider internet.

The basic idea behind the rules is to specify when packets can be shared between network interfaces. For example, a packet leaving the PiHole and destined for port 53 should be shared with the VPN tunnel, so the VPN tunnel can send the traffic out.

To set up iptables rules, you can create a script that will flush all rules, populate iptables with the rules you want, then save them so they are persistent on reboot.

Thing 2 PiHole iptables setup

This section gives an iptables setup script that will redirect DNS traffic in the desired way.

Start by installing a tool that allows us to save iptables state across boot:

sudo apt-get -y install netfilter-persistent

Summary of key rules:

Allow all established connections
Allow incoming ping and ssh connections
Allow traffic coming from the local wireless network
Allow incoming localhost traffic
Allow incoming PIA tunnel traffic
Masquerade traffic leaving the PIA tunnel
Allow port 53 (DNS traffic) to come in from anywhere
Allow PiHole to send DNS queries out through tunnel, and accept responses

Note that the PiHole settings page allows the PiHole to receive DNS queries from the local wireless network already, so no iptables rules are needed for that.

Now the script.

Thing 2 PiHole iptables script

This can go in your home directory or wherever. Run it as root!

iptables_thing2.sh

#!/bin/bash
# iptables setup for thing 2 raspberry pi
set -e

ipt="sudo /sbin/iptables"

# start by flushing all rules and setting defaults
$ipt -F
#$ipt -P INPUT DROP
#$ipt -P FORWARD DROP
$ipt -P INPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -P OUTPUT ACCEPT
$ipt -t nat -F
$ipt -t mangle -F
$ipt -F
$ipt -X

# Name of PIA VPN tunnel device
PIATUN="tun0"
# Name of loopback interface for PiHole DNS server
PHDNS="lo"
# Name of wifi interface 192.168.0.0/24
WLAN="wlan0"

##################
# Incoming

# Allow any established connection to come in or out
$ipt -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$ipt -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#################
# Ping

# Allow incoming ping requests
$ipt -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

#################
# ssh

# Allow incoming SSH sessions, new or established
$ipt -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
# Allow incoming SSH traffic, if part of established conversation
$ipt -A INPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

#########################
# traffic from wlan

# Allow incoming (any) traffic from the wlan
$ipt -A INPUT -i ${WLAN} -j ACCEPT

#########################
# localhost to localhost
$ipt -A INPUT -i lo -j ACCEPT

##################
# pia vpn

# This is a PIA VPN tunnel that handles outbound DNS queries
# Accept all traffic coming in from tunnel
$ipt -A INPUT -i ${PIATUN} -j ACCEPT
# Masquaerade outgoing traffic leaving via the tunnel
$ipt -t nat -A POSTROUTING -o ${PIATUN} -j MASQUERADE

##################
# DNS

PROTOCOLS="tcp udp"
for prot in $PROTOCOLS; do

    # General DNS Traffic:

    # Allow incoming DNS traffic coming from 53, part of established conversation
    $ipt -A INPUT  -p $prot --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

    # PiHole DNS (lo) <-> PIA VPN Tunnel (tun0):

    # PiHole can always send DNS queries out through tunnel
    $ipt -A FORWARD -p $prot -i ${PHDNS} -o ${PIATUN} --dport 53 -j ACCEPT
    # Responses to PiHole can always return via tunnel
    $ipt -A FORWARD -p $prot -i ${PIATUN} -o ${PHDNS} --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT

    # Local wifi network can already talk to pihole DNS
    # (set in pihole settings)

done


# Enable logging
$ipt -N LOGGING
$ipt -A INPUT -j LOGGING
$ipt -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "iptables dropped: " --log-level 4
$ipt -A LOGGING -j DROP

# Make rules persistent
sudo netfilter-persistent save

Testing Thing 2 iptables setup

Because we turned on monitoring, you can tail the syslog file while doing these experiments to see what packets are blocked and figure out what rules are needed to allow them:

sudo tail -f /var/log/syslog

You can also run tcpdump on a specific port to check if packets are showing up on the right network interfaces. For example, this listens on the wlan0 interface for traffic on port 53:

sudo tcpdump -i wlan0 port 53

Try a local dig from the PiHole server of a blocked domain:

dig doubleclick.net

should return 0.0.0.0

Try a local dig from the PiHole server of an unblocked domain:

dig reddit.com

Related Pages

RaspberryPi

RaspberryPi/Headless

Flags

RaspberryPi/July 2020

From charlesreid1

Contents