Raspberry/openVPN

[DmitryDaJerus]

Trying to understand how openVPN on Raspberry should work and how set wi-fi that comes from Raspberry on desirable ip (CH's ip)
Is there someone actively using it and can give me some tips?

 

[Mutt]

Setting up OpenVPN on a Raspberry Pi to act as a VPN server and configuring the Wi-Fi to use a specific IP (such as your cardholder's IP) involves several steps. Below, I’ll explain how OpenVPN works on a Raspberry Pi, how to set up the Wi-Fi with a specific IP, and provide practical tips based on common practices and user experiences. Since the goal is to use a "cardholder's IP" (which I interpret as a specific static IP address assigned to the Raspberry Pi or associated with your network), I’ll focus on a clear, actionable setup process.

How OpenVPN on Raspberry Pi Works​

OpenVPN is an open-source software that creates a secure, encrypted tunnel between your device (client) and the Raspberry Pi (server) over the internet. When set up on a Raspberry Pi, it allows you to:

• Access your home network remotely: Connect to devices on your home network (e.g., file servers, cameras) from anywhere.
• Secure public Wi-Fi: Route your internet traffic through the Raspberry Pi’s VPN server to encrypt data on unsecured networks.
• Mask your traffic: Your external traffic appears to originate from your home network’s public IP (the "cardholder’s IP" in this context, likely your home router’s public IP).

The Raspberry Pi acts as the VPN server, listening for connections on a specific port (default: UDP 1194). Clients use an OpenVPN client application and a configuration file (.ovpn) to connect securely. The setup requires a static IP for the Raspberry Pi on your local network, port forwarding on your router, and optionally a Dynamic DNS (DDNS) service if your public IP changes.

Step-by-Step Guide to Set Up OpenVPN and Configure Wi-Fi​

1. Prepare Your Raspberry Pi​

• Hardware Requirements:
  • Raspberry Pi (e.g., Pi 3, 4, or 5; newer models offer better performance).
  • MicroSD card (8GB or larger) with Raspberry Pi OS Lite installed.
  • Stable internet connection (Ethernet preferred for reliability, but Wi-Fi is fine).
• Update the System:
  

  sudo apt update
  sudo apt full-upgrade -y
  sudo reboot

  This ensures your Raspberry Pi is running the latest software.

2. Set a Static IP for the Raspberry Pi​

To ensure consistent VPN access, assign a static IP to your Raspberry Pi on your local network (e.g., 192.168.1.100). This is likely what you mean by "cardholder’s IP" in the local context. There are two methods:

• Option 1: DHCP Reservation in Router(Recommended)
  • Log in to your router’s admin panel (e.g., 192.168.1.1).
  • Find the DHCP settings and reserve an IP (e.g., 192.168.1.100) for your Raspberry Pi’s MAC address.
  • Check your router’s manual for specific instructions.
• Option 2: Configure Static IP on Raspberry Pi If your router doesn’t support DHCP reservation:
  • Edit the network configuration file:
    

    sudo nano /etc/dhcpcd.conf

  • Add the following at the end (adjust for your network):
    

    interface eth0  # Use wlan0 for Wi-Fi
    static ip_address=192.168.1.100/24
    static routers=192.168.1.1
    static domain_name_servers=8.8.8.8 8.8.4.4

  • Save (Ctrl+X, Y, Enter) and reboot:
    

    sudo reboot

  • Verify the IP:
    

    hostname -I

3. Install OpenVPN Using PiVPN​

PiVPN is a user-friendly script that simplifies OpenVPN installation.

• Install PiVPN:
  

  curl -L https://install.pivpn.io | bash

• Follow the Installation Wizard:
  • Static IP: Confirm your static IP (e.g., 192.168.1.100). Select “Yes” if you set a DHCP reservation or configured it manually.
  • User: Choose the default pi user or another user you’ve created.
  • Protocol: Select OpenVPN (not WireGuard) for this guide.
  • Port: Use the default UDP 1194 unless you have a specific reason to change it.
  • DNS Provider: Choose a public DNS like Google (8.8.8.8) or Cloudflare (1.1.1.1).
  • Public IP or DDNS: If your home’s public IP is dynamic (changes periodically), sign up for a free DDNS service like No-IP or DuckDNS and enter the hostname. Otherwise, use your router’s public IP (find it at whatismyipaddress.com).
  • Unattended Upgrades: Enable these for automatic security updates.
  • Reboot when prompted.

4. Configure Port Forwarding​

To allow external devices to connect to your VPN:

• Log in to your router’s admin panel.
• Set up a port forwarding rule:
  • External Port: 1194 (or your chosen port).
  • Internal IP: Your Raspberry Pi’s static IP (e.g., 192.168.1.100).
  • Protocol: UDP.
• Save and restart your router if required.

5. Create Client Profiles​

• Generate an .ovpn file for each device that will connect to the VPN:
  

  pivpn add

• Enter a client name (e.g., myphone) and optionally a password.
• The .ovpn file is saved in /home/pi/ovpns/.
• Transfer the file to your client device (e.g., via SCP, USB, or email):
  

  scp /home/pi/ovpns/myphone.ovpn user@client-device:/path/to/destination

6. Set Up Wi-Fi on Raspberry Pi​

If you want the Raspberry Pi to act as a Wi-Fi access point (AP) that routes traffic through the VPN, or if you simply need to connect it to your Wi-Fi network with a specific IP, follow these steps:

• Connect Raspberry Pi to Wi-Fi with Static IP:
  • If not using Ethernet, configure Wi-Fi with the static IP set earlier.
  • Use Raspberry Pi Imager to preconfigure Wi-Fi during OS installation:
    • In the Imager, click the gear icon, enable Wi-Fi, and enter your network’s SSID and password.
    • Alternatively, configure Wi-Fi manually:
      

      sudo nano /etc/wpa_supplicant/wpa_supplicant.conf

      Add:
      

      network={
          ssid="YourWiFiSSID"
          psk="YourWiFiPassword"
      }

      Save and reboot.
  • Ensure the static IP configuration (from step 2) applies to wlan0 if using Wi-Fi.
• Turn Raspberry Pi into a VPN-Secured Wi-Fi Access Point(Optional):If you want devices to connect to the Raspberry Pi’s Wi-Fi and have their traffic routed through the VPN:
  • Install hostapd and dnsmasq to create a Wi-Fi access point:
    

    sudo apt install hostapd dnsmasq

  • Configure hostapd:
    

    sudo nano /etc/hostapd/hostapd.conf

    Add:
    

    interface=wlan0
    driver=nl80211
    ssid=PiVPN
    hw_mode=g
    channel=7
    wmm_enabled=0
    macaddr_acl=0
    auth_algs=1
    ignore_broadcast_ssid=0
    wpa=2
    wpa_passphrase=YourWiFiPassword
    wpa_key_mgmt=WPA-PSK
    wpa_pairwise=TKIP
    rsn_pairwise=CCMP

  • Configure dnsmasq:
    

    sudo nano /etc/dnsmasq.conf

    Add:
    

    interface=wlan0
    dhcp-range=192.168.2.100,192.168.2.200,12h

  • Enable IP forwarding:
    

    sudo nano /etc/sysctl.conf

    Uncomment or add:
    

    net.ipv4.ip_forward=1

  • Set up iptables to route Wi-Fi traffic through the VPN:
    

    sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
    sudo iptables -A FORWARD -i tun0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    sudo iptables -A FORWARD -i wlan0 -o tun0 -j ACCEPT

    Save iptables:
    

    sudo sh -c "iptables-save > /etc/iptables/rules.v4"

  • Start services:
    

    sudo systemctl enable hostapd dnsmasq
    sudo systemctl start hostapd dnsmasq

  • Devices connecting to the PiVPN Wi-Fi network will have their traffic routed through the VPN, appearing to originate from your home’s public IP (the "cardholder’s IP").

7. Install OpenVPN Client on Devices​

• Windows/Mac: Download OpenVPN Connect from openvpn.net.
• Mobile: Install the OpenVPN app from the App Store or Google Play.
• Import the .ovpn file and connect. Enter the passphrase if set during client creation.

8. Test the VPN​

• Connect a client device to the VPN.
• Verify the IP at whatismyipaddress.com. It should match your home’s public IP.
• Check for DNS leaks using dnsleaktest.com.
• If using the Pi as a Wi-Fi AP, connect a device to the PiVPN SSID and confirm its traffic routes through the VPN.

Tips from Active Users and Common Practices​

• Dynamic DNS for Changing Public IPs: If your ISP assigns a dynamic public IP, use a DDNS service (e.g., No-IP, DuckDNS) to assign a hostname (e.g., myvpn.duckdns.org). Update the DDNS client on your Raspberry Pi or router to keep the hostname tied to your current public IP.
• Security:
  • Enable unattended upgrades to keep OpenVPN secure:
    

    sudo apt install -y unattended-upgrades
    sudo dpkg-reconfigure --priority=low unattended-upgrades

  • Set up a kill switch to block non-VPN traffic:
    

    sudo iptables -A OUTPUT -o eth0 -p udp --dport 1194 -j ACCEPT
    sudo iptables -A OUTPUT -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
    sudo iptables -A OUTPUT -o eth0 -j DROP

    Save iptables as above.
• Performance:
  • Use a wired Ethernet connection for the Raspberry Pi to reduce latency.
  • If speeds are slow, try a more powerful Pi model (e.g., Pi 5) or switch to WireGuard (faster but less widely supported).
• Troubleshooting:
  • Can’t connect remotely: Verify port forwarding (UDP 1194) and check if your ISP blocks the port. Try changing to TCP or a different port (e.g., 443).
  • Slow speeds: Test a closer server location or reduce encryption (e.g., from 2048-bit to 1024-bit, though this lowers security).
  • Certificate errors: Regenerate client certificates with pivpn add.
• Wi-Fi AP Tips:
  • Ensure your Raspberry Pi’s Wi-Fi adapter supports AP mode (most built-in Wi-Fi chips do).
  • If Wi-Fi clients don’t route through the VPN, check iptables rules and ensure tun0 (the VPN interface) is active.

Notes on "Cardholder’s IP"​

A specific local IP: Set as the static IP for the Raspberry Pi (e.g., 192.168.1.100) or for the Wi-Fi AP’s subnet (e.g., 192.168.2.1).If you meant a specific external IP (e.g., from a VPN provider), you’d need to configure the Raspberry Pi as an OpenVPN client, not a server, using a provider’s .ovpn file. Let me know if this is the case, and I can provide additional steps.

Final Thoughts​

Using PiVPN simplifies OpenVPN setup significantly, and configuring the Raspberry Pi as a Wi-Fi access point allows devices to connect wirelessly and use the VPN. Regularly update your system, monitor logs (journalctl -u openvpn), and test connections to ensure reliability. If you encounter issues, double-check port forwarding, firewall settings, and DDNS updates.

If you have specific details about your setup (e.g., Raspberry Pi model, whether you need a Wi-Fi AP), I can tailor the advice further. Are you actively setting this up now, or do you need help with a specific step?