#Pia vpn client pi install#
#Pia vpn client pi password#

My local network has IPs in the 192.168.0.* range so I’ll be using that. You might also want to have the machine reachable from the local network to SSH into it and such, so allow everything to those IPs. # ufw allow out on wlan0 from any to any port 1198 # ufw allow out on eth0 from any to any port 1198 # ufw allow out on wlan0 from any to any port 53 # ufw allow out on eth0 from any to any port 53

The actual VPN port specified by the configuration files, i.e.

DNS resolution on port 53 to find e.g.

OpenVPN obviously needs to be able to connect on the regular interface, and with the default PIA configuration files, this means allowing First, allow everything on OpenVPN’s network interface. I’m going to use UFW because it’s fairly intuitive compared to iptables. To ensure this, we’re going to set up a firewall to deny everything but the VPN handshake on the regular interfaces eth0 and wlan0 while placing no restrictions on tun0. Depending on the use case, it might be preferable for it to stop communicating completely instead, like if you’re downloading warez concerned about your privacy. $ curl ipinfo.ioĪt this point, if the VPN connection drops or OpenVPN stops for some reason, your machine will talk freely over your regular, non-VPN interface. To test connectivity, call an IP echo service such as ipinfo.io, which should report an IP and a country matching your configuration. There should be an interface called tun0 or similar (for tunnel), which is the VPN interface.

To verify this, wait a few seconds and run ifconfig. It should now be possible to start up OpenVPN and have it connect. Instead of using /etc/default/openvpn, move all the configuration files one level down into /etc/openvpn/client and enable the service by calling systemctl enable I’ve tested this on Raspbian Buster, but I’m unsure if it works on older versions as well. Note : since this post was first published, there’s a better way to run OpenVPN as a service. # echo 'AUTOSTART='Germany'' > /etc/default/openvpn To make OpenVPN automatically connect with a certain configuration, set the AUTOSTART directive in /etc/default/openvpn to the configuration filename without the extension. Move everything into place by copying the auth file, configurations, certificate and key file to /etc/openvpn. $ echo 'auth-user-pass auth.txtĭown /etc/openvpn/update-resolv-conf' | tee -a openvpn/*.confįrom here, it might make sense to continue as root. On Debian, this script is included in the OpenVPN install. Here I’ll also throw in a couple of quality tweaks such as keepalive, logging to make troubleshooting easier, and automatic execution of a script called update-resolv-conf, which might be necessary for DNS resolution to work correctly when turning the VPN on and off. Next, make the configurations refer to this file by appending some directives at the end of each.

It’s not very secure, so add a little protection by limiting access to the owner.

#Pia vpn client pi password#

To enable automatic authentication when connecting, put your VPN username and password in a file next to the configs.

#Pia vpn client pi install#

# apt-get install openvpnĭownload the VPN provider’s OpenVPN configuration files. I’m targeting a Pi 3 with Raspbian Jessie here, but the procedure should be similar for other machines and distros as long as packages like OpenVPN and UFW are available. Here’s a short guide to setting up a VPN on Linux - specifically Private Internet Access on a Raspberry Pi, because I’m mostly writing this as a reminder to myself - with a kill switch to prevent non-VPN traffic.