2

I've managed to setup a PI-hole and my router is using the pi-hole as the DHCP server, and all my devices still have internet access.
I would also like to install ExpressVPN on the Pi, so that all my devices automatically get the benefits of the VPN.

I've managed to install ExpressVPN on the PI, and it connects.
But the problem is once the PI connects to ExpressVPN, all my devices lose internet access.
I am guessing I need to somehow configure the Pi-hole to use the VPN connection as well, but i am not sure how to do that, or even where to start.

I've found a ton of articles about setting up OpenVPN and/or PiVPN but that seems more related to being able to connect to my PI-hole when I am outside of my home, e.g. at work.

Is what I am trying to do even possible and if so, any suggestions will be much appreciated. Thanks in advance.

  • 1
    The problem is that PI-hole and ExpressVPN and other scripts are only doing their things and set interfaces, routing tables etc. to what they need without respecting the settings of other scripts. Mostly it is a problem with routing and you have to correct the script but cannot be done with some deeper knowledge about networking and routing and the current network environment. – Ingo Feb 22 at 19:46
  • did you succeed, you didn't accept any answer. Im also planning to use express vpn near the pi-hole and DOH active – khashashin May 29 at 9:53
2

I ran into the same issue and the solution is actually quite simple. On your pi run the following commands in a terminal:

expressvpn disconnect
expressvpn preferences set force_vpn_dns false
expressvpn connect

Once your vpn connects back up, ensure that you dns resolution is working on your network clients.

Explanation:
'force_vpn_dns' is set to True by default. When set to True this forces the connection to only use ExpressVPN's DNS. Since the OP and myself run PiHole on the same server, which is a DNS server, setting this to False allows the server to send DNS resolution requests to itself. The reason this breaks DNS resolution to all local network clients is because in most cases (mine in particular) the clients' DNS server is pointed at the PiHole server

I hope this helps.

| improve this answer | |
  • Why does it help? What does expressvpn preferences set force_vpn_dns false do? – Ingo Mar 16 at 8:58
  • 'force_vpn_dns' is set to True by default. When set to True this forces the connection to only use ExpressVPN's DNS. Since the OP and myself run PiHole on the same server, which is a DNS server, setting this to False allows the server to send DNS resolution requests to itself. The reason this breaks DNS resolution to all local network clients is because in most cases (mine in particular) the clients' DNS server is pointed at the PiHole server. – Steven Mar 16 at 19:21
  • Your comment should be added to the answer to improve it. – Ingo Mar 16 at 22:46
  • 1
    Done. I originally added this answer as a guest and was pretty short on time. But I figured it would be silly not to post the answer since I had it. – Steven Mar 17 at 17:53
1

Without some additional information, it will be hard for others to give you specific advice/instructions.

The Problem

Right now, with pi-hole and Express VPN, your pi has multiple interfaces and networks. It has a routing table, and can communicate through all of them (presumably) You want it to forward traffic from your LAN clients through the pi-hole software and then through the VPN. Conversely, it must forward traffic in the opposite direction for two-way communication to work.

The Solution

Without more knowledge of your setup, I can only point you towards sources of information to learn the concepts of how to make this work.

IP Forwarding

For the pi to forward packets from one interface to another that originated somewhere else and are destined for somewhere else, IP forwarding must be enabled. Have a look at https://www.eukhost.com/kb/how-to-enable-ip-forwarding-on-linux-ipv4-ipv6/

Firewall/NAT

Even with forwarding enabled, that only solves half the problem. Your pi (which is now acting like a 'router') needs a set of rules to follow to know which packets need to go where and how it should MASQUERADE the addresses to keep from confusing clients. Packets from your LAN forwarded through your VPN would go nowhere if their source address remained in a private range (ie. 192.168.x.x or 10.x.x.x) so the pi has to modify source addresses on outgoing packets to its own. Likewise incoming packets from the VPN destined for the LAN need to have their source address modified to match the pi so that the LAN clients send their responses to the correct place. Further reading: https://www.karlrupp.net/en/computer/nat_tutorial

I hope that helps!

| improve this answer | |
  • You are right with your description (+1), but with the needed know how to manage it you don't need automated scripts/programs like PI-hole and ExpressVPN which do not play together. – Ingo Feb 24 at 8:34
  • 1
    I managed to get the ExpressVPN to work without pi-hole as per this ticket: raspberrypi.stackexchange.com/questions/109100/…. Maybe I can now add the pi-hole as well, else the answer by @steven will probably solve the issues I had. – Quintonn Mar 17 at 6:36
0

Sure I found little information to install a client DNS VPN through Pi-Hole. My conf is a Pi3-B+ with Raspbian last update and upgrade My_IP_Pi:X.X.X.X name IP_A for this exemple

I Install Pi-Hole v5.0 configure with DHCP server. After I install my Client VPN (sorry not ExpressVPN) and configure it with systemctl as service.

Command Pi3-B+: (eth0 interface Pi3-B+) (tun0 VPN) Verify :

ip route show
0.0.0.0/1 via X.X.X.1 dev tun0 
default via 192.168.1.1 dev eth0 src IP_A metric 202 
...

I configure my interface Client with DHCP auto for IP and set DNS Pi to IP_A

The final test Open Browser in Client

On the Pi3-B+ Install tcpdump open 2 Terminal For the first term I check this interface eth0 with

sudo tcpdump -i eth0 udp port 53

For the second I check VPN

sudo tcpdump -i tun0 udp port 53

On the client Browser open a link Page and check if you see a "similar" traffic in eth0 and tun0, for me I think is good. Traffic DNS go to eth0, after on the VPN. tcpdump capture all traffic for DNS, I recommend to test with one Client.

Another Command to check DNS with or without VPN

Install iputils-tracepath and check exemple

tracepath howto.lintel.in

Check IP in Pi3-B+:

curl ipinfo.io

Use command route for routing table

route -n
| improve this answer | |
New contributor
BDup is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.