A VPN server is a useful tool to have access to. For example to browse saver on a public hot spot or access services that are geo-restricted.
OpenVPN and Wireguard are a few good options. In this lesson we will start with OpenVPN.
Installing OpenVPN
The easiest way to install OpenVPN on a Raspberry Pi is to run the script mentioned on this website: https://raspberrytips.com/openvpn-raspberry-pi/
wget https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh -O openvpn-install.shAnd then run it:
sudo bash openvpn-install.shYou should know you local IP address and when the script asks for you external IP address, please use your duckdns name, so it is automatically updated. For the rest you can keep the defaults.
Once the script is done you have created an .ovpn config which you need to connect to your VPN server. Copy this to you local machine (a simple trick is to use the cat command, copy the output and put it in a text document on you local machine.
Open a port in your firewall
Before you can test your installed VPN server you need to open port 1194 UDP in your firewall. This is similar as discussed earlier with the SSH and web server.
Install OpenVPN client
Ubuntu
Ubuntu has build-in support for OpenVPN. On older version you might need to run the following install to be able to set every up in the GUI.
sudo apt install network-manager-openvpn - Open the network settings
- In the VPN section click the + sign
- Pick the ‘Import from file’ section
- Open the .ovpn file
- Connect to the VPN
OSX
- Download and install the client from the official website
- Use the .ovpn file to setup the client
- Connect to your VPN
Windows
- Download and install the client from the official website
- Use the .ovpn file to setup the client.
- Connect to your VPN.
Adding/removing clients
After your initial tests, you might want to add a few more clients, like for you phone, your laptop or a friends device. This can be very easily done by rerunning the script and pick the right option.
sudo ./openvpn-install.shBe sure to not send these configs in plane text over the internet. So maybe the next thing we want to do is create our own paste-bin service.