3

I have a Raspberry Pi 3B+ which is working as a hotspot using a Hologram Nova usb ppp0 device where it receives Internet from and routes the internet through WiFi and Ethernet. This Hologram usb ppp0 device does not allow port forwarding so can't play around with ports on it.

I have realized that the IP address on the hotspot-pi changes every time the hotspot-pi reboots, Given that it's a mobile SIM, the cellphone company does not assign a permanent IP address. This makes it very hard or impractical to connect through SSH or access the local network.

The hotspot-pi's local IP address is 192.168.50.1; and it uses a bridge with a range of 192.168.50.0/24 that work or route both wlan0 and eth0 interfaces. All devices connected to the hotspot via wlan0 or eth0 obtain an ip in the range of the 192.168.50.0/24.

I created a home VPN using OpenVPN and a second raspberry pi (different Pi, located at home and acting as a server), and have the hotspot-pi connect to the OpenVPN-pi (at home) using OpenVPN as a client.

The purpose of this is so that once the hotspot-pi is connected to the OpenVPN-pi, I can see the hotspot-pi and all the other devices connected to it on my local network at home (OpenVPN-pi) using either FING (phone app) or nmap (linux) or any type of ip scanner application.

Edit: I have Completed part 1, 2 and 3 of Ingo's Answer. I get OpenVPN to start and connect to the server successfully. However where my issues arise are:

  • Once connected to the OpenVPN-pi, all devices connected to the hotspot-pi loose internet access.
  • Only the hotspot-pi is able to ping the OpenVPN-pi at 10.8.0.1 or any IP's in the server's local network
  • Only the hotspot-pi retains the ability to connect to internet, none of the attached devices to the hotspot retain internet. Only when disconnecting to the VPN does internet return for the devices

What's left to do:

  • Re-allow internet access to devices connected to the Hotspot-pi while it is connected to VPN.
  • Allow devices in the server side network (OpenVPN-pi at home) to see devices attached to hotspot-pi (client VPN side on the field)
  • The ability to ping or ssh from any device on the server side to any devices on the client side.

I have done a bit more research:

I now know, that I need to do a type of bridging or layer 2 vpn. and I have found some information about it: OpenVPN bridged vpn

However with this new given information I know that if I try to simply implement it, it will definitely break something else. I am not a network engineer nor do I have the tremendous experience with networks, so I would greatly appreciate if someone experienced would be able to explain this a bit better for me.

Current settings on the client vpn hotspot-pi:

Result of ip addr on the PiVPN Server:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
   valid_lft forever preferred_lft forever
inet6 ::1/128 scope host 
   valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether b8:27:eb:fa:a5:b9 brd ff:ff:ff:ff:ff:ff
inet 10.10.10.83/8 brd 10.255.255.255 scope global noprefixroute eth0
   valid_lft forever preferred_lft forever
inet6 fe80::d187:36d0:fc8e:f762/64 scope link 
   valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none 
inet 10.8.0.1/24 brd 10.8.0.255 scope global tun0
   valid_lft forever preferred_lft forever
inet6 fe80::20fe:5e73:93cd:15eb/64 scope link stable-privacy 
   valid_lft forever preferred_lft forever

Result of ip route in the PiVPN server:

default via 10.10.10.1 dev eth0 src 10.10.10.83 metric 202 
10.0.0.0/8 dev eth0 proto dhcp scope link src 10.10.10.83 metric 202 
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1 

Result of systemctl status openvpn@server.service

● openvpn@server.service - OpenVPN connection to server
Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled-runtime; vendor preset: enabled)
Active: active (running) since Mon 2019-11-18 20:43:07 EST; 10min ago
 Docs: man:openvpn(8)
       https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
       https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 421 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 2200)
Memory: 2.8M
CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
       └─421 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf --writepid /run/openvpn/server.pid

Nov 18 20:51:09 piVPN ovpn-server[421]: 24.114.69.217:59077 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-ECDSA-AES256-GCM-SHA384, 256 bit EC, curve: prime256v1
Nov 18 20:51:09 piVPN ovpn-server[421]: 24.114.69.217:59077 [piHotspot] Peer Connection Initiated with [AF_INET]24.114.69.217:59077
Nov 18 20:51:09 piVPN ovpn-server[421]: piHotspot/24.114.69.217:59077 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Nov 18 20:51:09 piVPN ovpn-server[421]: piHotspot/24.114.69.217:59077 MULTI: Learn: 10.8.0.2 -> piHotspot/24.114.69.217:59077
Nov 18 20:51:09 piVPN ovpn-server[421]: piHotspot/24.114.69.217:59077 MULTI: primary virtual IP for piHotspot/24.114.69.217:59077: 10.8.0.2
Nov 18 20:51:10 piVPN ovpn-server[421]: piHotspot/24.114.69.217:59077 PUSH: Received control message: 'PUSH_REQUEST'
Nov 18 20:51:10 piVPN ovpn-server[421]: piHotspot/24.114.69.217:59077 SENT CONTROL [piHotspot]: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-25
Nov 18 20:51:10 piVPN ovpn-server[421]: piHotspot/24.114.69.217:59077 Data Channel: using negotiated cipher 'AES-256-GCM'
Nov 18 20:51:10 piVPN ovpn-server[421]: piHotspot/24.114.69.217:59077 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Nov 18 20:51:10 piVPN ovpn-server[421]: piHotspot/24.114.69.217:59077 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

Result of ip addr in piHotspot (client):

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
   valid_lft forever preferred_lft forever
inet6 ::1/128 scope host 
   valid_lft forever preferred_lft forever
2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast master br0 state DOWN group default qlen 1000
link/ether b8:27:eb:3f:0e:89 brd ff:ff:ff:ff:ff:ff
3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 8a:ea:17:87:3f:87 brd ff:ff:ff:ff:ff:ff
inet 192.168.50.1/24 brd 192.168.50.255 scope global br0
   valid_lft forever preferred_lft forever
inet6 fe80::88ea:17ff:fe87:3f87/64 scope link 
   valid_lft forever preferred_lft forever
4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
link/ether b8:27:eb:6a:5b:dc brd ff:ff:ff:ff:ff:ff
inet6 fe80::ba27:ebff:fe6a:5bdc/64 scope link 
   valid_lft forever preferred_lft forever
5: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 3
link/ppp 
inet 25.109.236.155/32 scope global ppp0
   valid_lft forever preferred_lft forever
6: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none 
inet 10.8.0.2/24 brd 10.8.0.255 scope global tun0
   valid_lft forever preferred_lft forever
inet6 fe80::c280:60ee:ad54:2cbb/64 scope link flags 800 
   valid_lft forever preferred_lft forever

Result of ip route on piHotspot (client):

0.0.0.0/1 via 10.8.0.1 dev tun0 
default via 25.109.236.155 dev ppp0 proto static 
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.2 
10.176.0.0/16 via 25.109.236.155 dev ppp0 proto static 
10.254.0.0/16 via 25.109.236.155 dev ppp0 proto static 
(my IP address) via 25.109.236.155 dev ppp0 
128.0.0.0/1 via 10.8.0.1 dev tun0 
192.168.50.0/24 dev br0 proto kernel scope link src 192.168.50.1 

Result of systemctl status openvpn@piHotspot.service

● openvpn@piHotspot.service - OpenVPN connection to piHotspot
  Loaded: loaded (/lib/systemd/system/openvpn@.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2019-11-18 20:49:30 EST; 10min ago
 Docs: man:openvpn(8)
       https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
       https://community.openvpn.net/openvpn/wiki/HOWTO
Process: 342 ExecStart=/usr/sbin/openvpn --daemon ovpn-piHotspot --status /run/openvpn/piHotspot.status 10 --cd /etc/openvpn --config /etc/openvpn/piHotspot.conf --writepid /run/openvpn/piHotspot.pid (code=exited, status=0/SUCCESS)
Main PID: 380 (openvpn)
Tasks: 1 (limit: 4915)
CGroup: /system.slice/system-openvpn.slice/openvpn@piHotspot.service
       └─380 /usr/sbin/openvpn --daemon ovpn-piHotspot --status /run/openvpn/piHotspot.status 10 --cd /etc/openvpn --config /etc/openvpn/piHotspot.conf --writepid /run/openvpn/piHotspot.pid

Nov 18 20:51:10 RPiHotspot ovpn-piHotspot[380]: ROUTE_GATEWAY 25.109.236.155/255.255.255.255 IFACE=ppp0 HWADDR=00:00:00:00:00:00
Nov 18 20:51:10 RPiHotspot ovpn-piHotspot[380]: TUN/TAP device tun0 opened
Nov 18 20:51:10 RPiHotspot ovpn-piHotspot[380]: TUN/TAP TX queue length set to 100
Nov 18 20:51:10 RPiHotspot ovpn-piHotspot[380]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Nov 18 20:51:10 RPiHotspot ovpn-piHotspot[380]: /sbin/ip link set dev tun0 up mtu 1500
Nov 18 20:51:10 RPiHotspot ovpn-piHotspot[380]: /sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
Nov 18 20:51:10 RPiHotspot ovpn-piHotspot[380]: /sbin/ip route add (my IP address) via 25.109.236.155
Nov 18 20:51:10 RPiHotspot ovpn-piHotspot[380]: /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
Nov 18 20:51:10 RPiHotspot ovpn-piHotspot[380]: /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
Nov 18 20:51:10 RPiHotspot ovpn-piHotspot[380]: Initialization Sequence Completed

Update: Nov 14, 2019

I am able to ping server and client from each other, I can ping devices attached to the server's local network but I cannot ping devices attached to the hotspot network. I'd prefer it the other way for my specific use. In fact I'd like to be able to ssh or control any devices in the client's network from the server. Devices attached to the client loose internet connection when I establish the vpn tunnel. The moment I stop the service, internet is back up.

Lastly, in the client/server files, they both have a tun set not a tap, won't this explain why I can't get an IP Address the same as my server's local network?

As always, I would greatly appreciate any and all help! I feel I'm so close to finishing this project I'm at the end of the line!

Thank you kindly!

  • It looks that you want to run an openVPN server on the RasPi so you can connect with a device from the internet to your network. Can you please make it a bit clearer in the question? You must be able to connect to the RasPi from the internet. So does the RasPi has a private ip address or a public one? If it has a private one does the USB modem is able to do port forwarding? – Ingo Jul 13 at 8:51
  • @Ingo, I have modified my responsee, thank you! – Agustin Jul 13 at 21:34
  • I have left focus on this question. Please give me feedback with a comment when you have found port forwarding on the USB modem. – Ingo Jul 23 at 23:14
  • There was no port forwarding on the modem, so I cannot create a VPN server using OpenVPN with the hotspot. I have decided that maybe it would be a bit smarter to create a VPN server at home, and open those ports here, and have the device "call home" so install a vpn client. But installing OpenVPN on a raspberry pi terminal seems a bit troublesome since I need to create some kind of .crt files and so and so. So I'm stuck trying to install OpenVPN client on the hotspot at the moment – Agustin Jul 24 at 3:45
  • You have linked to a setup with a bridged vpn using a tap interface. You can also find a tested one with Raspberry Pi at How to bridge an access point with a remote network by openvpn?. – Ingo Nov 9 at 21:06
3
+50

Having a remote OpenVPN server at your home and connect to it with the RasPi is a good solution if you cannot use port forwarding on the modem. Here is an example setup for what you have described:

          (dhcp
        from RPi)        bridge      10.8.0.2/24               ┌──────────┐   10.8.0.1/24   192.168.50.2
           ╱    wifi    ┌───────┐       /       vpn-tunnel     │          │       \        /
mobile-phone <~.~.~.~.> │(wlan0)│   (tun0) ═════════╗ ╔══════════════════════════ VPN-SERVER
                        │    br0│RPi(ppp0) <-----> MODEM <---> │ INTERNET │           subnet
      laptop <────────> |(eth0) │╲      \    usb          wan  │          │        192.168.50.0/24
           ╲    wired   └───────┘╱     (dhcp                   └──────────┘
         (dhcp           192.168.4.1   from MODEM)
        from RPi)

The ip addresses from the endpoints of the vpn tunnel must be on the same subnet. Here I use the subnet 10.8.0.0/24, so I give the vpn tunnel the shown ip addresses. These addresses are only used for routing to the vpn tunnel. They are not used by any other interface. Due to my test environment I have used some different subnets than yours.

Starting with a fresh flashed Raspbian Buster Lite you should setup the VPN router in three steps so you can test each step independently.

♦ Setup the modem connection

Setup the modem connection so you get the ppp0 interface and you can ping google.com. Nothing else is connected to the hotspot RasPi. I don't have a 4G modem so I used USB tethering with my smartphone to test it. This will give me the interface usb0. But the settings with ppp0 should look similar to this at this time:

rpi ~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether dc:a6:32:01:db:ec brd ff:ff:ff:ff:ff:ff
3: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether dc:a6:32:01:db:ed brd ff:ff:ff:ff:ff:ff
4: usb0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 1000
    link/ether 12:8e:37:b5:a9:10 brd ff:ff:ff:ff:ff:ff
    inet 192.168.42.218/24 brd 192.168.42.255 scope global noprefixroute usb0
       valid_lft forever preferred_lft forever
    inet6 fe80::c1dd:14fa:9aab:41a6/64 scope link
       valid_lft forever preferred_lft forever

rpi ~$ ip route
default via 192.168.42.129 dev usb0 proto dhcp src 192.168.42.218 metric 204
192.168.42.0/24 dev usb0 proto dhcp scope link src 192.168.42.218 metric 204

rpi ~$ cat /etc/resolv.conf
# Generated by resolvconf
nameserver 192.168.42.129

♦ Setup the bridge and the internet connection

Setup the bridge and the internet connection as shown in How can I set my pi 3 up to be WiFi AND ethernet router simultaneously?. In that setup just replace all strings *usb0* with *ppp0*. Also replace ip address 192.168.4.1 just with that you want to use, e.g. with 192.168.50.1 but have an attention it isn't from the ip range that is used by the modem. When finished then you should have a running setup as shown in the drawing above but just without the vpn tunnel. You should be able to ping everything from everywhere now, except interfaces from the VPN tunnel (it's not setup at this point). The settings are:

rpi ~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br0 state UP group default qlen 1000
    link/ether dc:a6:32:01:db:ec brd ff:ff:ff:ff:ff:ff
    inet6 fe80::dea6:32ff:fe01:dbec/64 scope link
       valid_lft forever preferred_lft forever
3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether be:1e:14:46:ba:8d brd ff:ff:ff:ff:ff:ff
    inet 192.168.4.1/24 brd 192.168.4.255 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::bc1e:14ff:fe46:ba8d/64 scope link
       valid_lft forever preferred_lft forever
4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
    link/ether dc:a6:32:01:db:ed brd ff:ff:ff:ff:ff:ff
    inet6 fe80::dea6:32ff:fe01:dbed/64 scope link
       valid_lft forever preferred_lft forever
6: usb0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 1000
    link/ether fe:89:43:14:4f:41 brd ff:ff:ff:ff:ff:ff
    inet 192.168.42.245/24 brd 192.168.42.255 scope global dynamic usb0
       valid_lft 3595sec preferred_lft 3595sec
    inet6 fe80::fc89:43ff:fe14:4f41/64 scope link
       valid_lft forever preferred_lft forever

rpi ~$ ip route
default via 192.168.42.129 dev usb0 proto dhcp src 192.168.42.245 metric 1024
192.168.4.0/24 dev br0 proto kernel scope link src 192.168.4.1
192.168.42.0/24 dev usb0 proto kernel scope link src 192.168.42.245
192.168.42.129 dev usb0 proto dhcp scope link src 192.168.42.245 metric 1024

rpi ~$ cat /etc/resolv.conf
# This file is managed by man:systemd-resolved(8). Do not edit.
--- snip ---
nameserver 192.168.42.129

♦ Setup VPN connection

I have used this Simple openVPN with static keys setup to test the configuration. Here in short only the needed setup.

I assume you have a working internet connection from the hotspot RasPi to the VPN server. I use port forwarding but how to setup it is out of scope here. For this example I use the public ip address 84.152.97.94 to connect to the router, that forwarded default openvpn port 1194 to the VPN server. You should be able to ping from the hotspot RasPi the remote address of the VPN server, in my example ping 84.152.97.94.

Install OpenVPN on the VPN server

# Install OpenVPN
server ~$ sudo -Es
server ~# apt install openvpn openvpn-systemd-resolved

# disable classic networking
server ~# systemctl mask networking.service dhcpcd.service
server ~# mv /etc/network/interfaces /etc/network/interfaces~
server ~# sed -i '1i resolvconf=NO' /etc/resolvconf.conf

# enable systemd-networkd
server ~# systemctl enable systemd-networkd.service systemd-resolved.service
server ~# ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

Setup network interface eth0. Because I configured port forwarding on the internet router (192.168.50.1) I have to set a static ip address so the internet router can forward traffic on default OpenVPN port 1194 to this ip address.

server ~# cat > /etc/systemd/network/04-eth.network <<EOF
[Match]
Name=e*
[Network]
Address=192.168.50.2/24
Gateway=192.168.50.1
DNS=84.200.69.80 1.1.1.1
IPForward=yes
EOF

Then generate a static secret key:

server ~# openvpn --genkey --secret /etc/openvpn/static.key

Create a client config file:

server ~# cat > /etc/openvpn/server.conf <<EOF
dev tun
ifconfig 10.8.0.1 10.8.0.2
secret static.key
cipher AES-256-CBC
auth-nocache
route 192.168.4.0 255.255.255.0
EOF

Please note that the server will never connect to the client so it does not have a remote entry. The connection is always initiated by the client. Enable the VPN server:

server ~# systemctl enable openvpn@server.service

Reboot. The setting should now look like this:

server ~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether b8:27:eb:0e:3c:6f brd ff:ff:ff:ff:ff:ff
    inet 192.168.50.2/24 brd 192.168.50.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::ba27:ebff:fe0e:3c6f/64 scope link
       valid_lft forever preferred_lft forever
3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether b8:27:eb:5b:69:3a brd ff:ff:ff:ff:ff:ff
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none
    inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::2a9e:7d49:c632:62a3/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

server ~$ ip route
default via 192.168.50.1 dev eth0 proto static
10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1
192.168.4.0/24 via 10.8.0.2 dev tun0
192.168.50.0/24 dev eth0 proto kernel scope link src 192.168.50.

server ~$ cat /etc/resolv.conf
# This file is managed by man:systemd-resolved(8). Do not edit.
--- snip ---
nameserver 84.200.69.80
nameserver 1.1.1.1

Install OpenVPN on the hotspot RasPi

Here we will install an OpenVPN configuration, named "client" on the hotspot RasPi.

client ~$ sudo -Es
client ~# apt install openvpn openvpn-systemd-resolved

Copy /etc/openvpn/static.key from the VPN server to /etc/openvpn/static.key here and set its permission with sudo chmod 600 /etc/openvpn/static.key. Create a client config file:

client ~# cat > /etc/openvpn/client.conf <<EOF
dev tun
remote 84.152.97.94
ifconfig 10.8.0.2 10.8.0.1
route 192.168.50.0 255.255.255.0
secret static.key
cipher AES-256-CBC
auth-nocache
EOF

Start the VPN client:

client ~# systemctl enable --now openvpn@client.service
client ~# exit
client ~$

Now you should be able to ping the VPN server:

client ~$ ping 10.8.0.1
client ~$ ping 192.168.50.2
client ~$ ping google.com

This will establish a connection. After that you should also be able to ping the hotspot RasPi from the VPN server:

server ~$ ping 10.8.0.2
server ~$ ping 192.168.4.1
client ~$ ping google.com

You should also be able to ping any device connected wired or wireless to the hotspot RasPi. Please keep in mind that the VPN server will not connect to the client. First ping the server from the client (hotspot RasPi).

The setup should look like this:

client ~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br0 state UP group default qlen 1000
    link/ether dc:a6:32:01:db:ec brd ff:ff:ff:ff:ff:ff
    inet6 fe80::dea6:32ff:fe01:dbec/64 scope link
       valid_lft forever preferred_lft forever
3: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether be:1e:14:46:ba:8d brd ff:ff:ff:ff:ff:ff
    inet 192.168.4.1/24 brd 192.168.4.255 scope global br0
       valid_lft forever preferred_lft forever
    inet6 fe80::bc1e:14ff:fe46:ba8d/64 scope link
       valid_lft forever preferred_lft forever
4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
    link/ether dc:a6:32:01:db:ed brd ff:ff:ff:ff:ff:ff
    inet6 fe80::dea6:32ff:fe01:dbed/64 scope link
       valid_lft forever preferred_lft forever
5: usb0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 1000
    link/ether 8a:ef:e0:df:7e:1e brd ff:ff:ff:ff:ff:ff
    inet 192.168.42.92/24 brd 192.168.42.255 scope global dynamic usb0
       valid_lft 2707sec preferred_lft 2707sec
    inet6 fe80::88ef:e0ff:fedf:7e1e/64 scope link
       valid_lft forever preferred_lft forever
6: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none
    inet 10.8.0.2 peer 10.8.0.1/32 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::4cf3:3f85:c0f7:3cd6/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

client ~$ ip route
default via 192.168.42.129 dev usb0 proto dhcp src 192.168.42.92 metric 1024
10.8.0.1 dev tun0 proto kernel scope link src 10.8.0.2
192.168.4.0/24 dev br0 proto kernel scope link src 192.168.4.1
192.168.42.0/24 dev usb0 proto kernel scope link src 192.168.42.92
192.168.42.129 dev usb0 proto dhcp scope link src 192.168.42.92 metric 1024
192.168.50.0/24 via 10.8.0.1 dev tun0

client ~$ cat /etc/resolv.conf
# This file is managed by man:systemd-resolved(8). Do not edit.
--- snip ---
nameserver 192.168.42.129

Setup routing on the VPN server

If you try from the hotspot RasPi to ping devices connected to the VPN server on its subnet 192.168.50.0/24 you will see that it doesn't work now. The reason is that they don't know where the subnet 192.168.4.1 of the hotspot RasPi is. We have to tell it with an additional routing information. You can configure each client with a static route, or you can configure its DHCP server to give that route to the clients, if it can. But the easiest is to disable the running DHCP server on subnet 192.168.50.0/24 and enable the DHCP server on the VPN Server. It will do all work automagically. Just append this to 04-eth.network:

server ~$ sudo -Es
server ~# cat >> /etc/systemd/network/04-eth.network <<EOF
DHCPServer=yes
[DHCPServer]
DNS=84.200.69.80 1.1.1.1
EOF

Don't forget to disable the "old" running DHCP server before enable this:

server ~# systemctl daemon-reload
server ~# systemctl restart systemd-networkd.service
server ~# exit
server ~$
  • from your drawing, it's not too clear whether thanks to the tunnel the attached devices will have a similar 10.10.10.x range, but if that's the case then I would say yes this is what I would like to have, my vpn server indeed has a 10.10.10.X range but the IP address on the tun0 is not in that range. it's in the 10.8.0.x range, the wlan0 range is also indeed in the 192.168.50.x range as well as eth0. – Agustin Aug 2 at 13:04
  • @Agustin I have updated the answer. You mention interface eth0 in your comment the first time. What do you want to do with it? – Ingo Aug 2 at 16:51
  • The eth0 interface is being used to provide a LAN to any device that needs access to internet through ethernet. In other words, similarly to the WLAN, the eth0 interface will be used to provide internet from the hotspot ppp0 (pi). So on your drawing both the wlan0 and eth0 interfaces provide the same 192.168.50.1 routing. The RPI hotspot doesn’t have yet a tunnel, the RPI that has a vpn installed is currently at home and is independent from the RPI hotspot. At home the IP range is in the 10.10.10.1 range and the RPI VPN has a tun0 at indeed 10.8.0.1 range. I have also updated the wordin – Agustin Aug 2 at 17:34
  • @Agustin I have updated the drawing with a bridge. That should now be the final solution. Please add the additional information about using eth0 to your question. The OpenVPN server must have an ip address from the same subnet of the RasPi as shown in the drawing. I will not have a focus on the vpn server in the first step. I just assume that it is working. When the local hostspot on the RasPi is running we can have a look at it. Just a moment please. I have to setup the test. – Ingo Aug 2 at 18:23
  • I’d like to add if it’s okay. On your drawing, to the rightmost (to the right of VPN server) maybe add my local network at home with the 10.10.10.1 ip? – Agustin Aug 2 at 18:36
0

I think, what you are looking for is dynamic DNS.

Your Pi will be assigned a subdomain of the service you choose. This static url you can then use to access your Pi.

In the background, you need to run SW on your Pi that regularly updates the external IP of your Pi with the service you are using.

Dynamic DNS is a favorite of people whose external IP address from their ISP changes quite regularly.

  • Sounds about right, I guess I was wondering if a VPN tunnel would be configurable on a hotspot raspberry pi, as well as having a dynamic DNS – Agustin Jul 13 at 4:02
  • So the only reason why a dynamic dns service wouldn't work in this instance, is because once I figure out the public IP address of the hotspot, I still can't access whatever ETHERNET device is attached to it. I need to basically be able to view the ethernet device attached to the pi and be able to access it in the network. – Agustin Aug 1 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.