16
I have the same setup as you:
Cable modem -> Router (192.168.1.1) +-> Raspberry Pi (192.168.1.11)
|-> iPad (DHCP)
|-> PC (DHCP)
`-> AppleTV (DHCP)
First, I changed my network settings (/etc/network/interfaces) on the RPi to a static ...
7
From this StackOverflow answer;
Ping your local gateway;
#!/bin/bash
ping -q -w 1 -c 1 `ip r | grep default | cut -d ' ' -f 3` > /dev/null && echo ok || echo error
6
Info: To have a simple openvpn server installation for reference look at Simple openVPN with static keys.
The first idea seeing the picture was that you confused WAN- and LAN-address. But lets look how I understand the setup so far with this example. I assume wifi and wired ethernet are bridged on the router (having the same ip address range).
...
6
I don't know something about AWS VPC. But because it seems to be only a routing problem I will use openVPN for reference. For routing it should not be make a big difference. I will try to be as generic as possible.
An issue is that it isn't possible to add a tun interface to a linux bridge. That's exactly what the error message tells you. On openVPN there ...
5
You could also try and ping 8.8.8.8 to see if you are actually able to get packets out to the internet. If you are then check your DNS settings as per
cat /etc/resolv.conf
You would expect to see something like
nameserver 8.8.8.8
Check that the DNS server in there is actually live and working. If not, edit it using something like nano, then see if it ...
5
The speed could be limited in multiple ways by including one/some bottleneck(s):
WiFi itself being limited
The Pi's internet connection is slow, or...
limited via interface bandwidth..
or the Pi encrypting/decrypting data
Servers being biased towards VPN'd traffic (if it is obviously a VPN, semi-common with Commerical VPNs). Some will straight up try and ...
5
How to bridge an access point with a remote network by Wireguard? (with the use of systemd-networkd)
You like to replace the OpenVPN server from my example (1) with Wireguard as shown on the schema in the question. You also want to have a bridged virtual private network to have both remote private subnets in one broadcast domain like as they were just on one local place, e.g. your home network.
First a summary what's possible or not:
Wireguard does not ...
5
I do not follow the link you have given, tl;dr. But it seems that it uses the method to download WireGuard from the Raspbian testing version Bullseye and install it on the current Raspbian stable version Buster.
Doing this, it is needed to compile the kernel modules for WireGuard so it fit to the Buster kernel. Because you ran into problems, it seems that ...
5
According to a comment on r/Wireguard, this error is caused by having the wrong kernel headers:
dkms packages (wireguard-dkms this time) need kernel headers for
current kernel you have loaded (uname -a). As long as kernel is
updated through apt or aptitude you should not run into problems, but
if you update kernel with rpi-update you'll likely get newer ...
4
Based on Jivings sample code and some of my own logic.
#!/bin/bash
STATE="error";
while [ $STATE == "error" ]; do
#do a ping and check that its not a default message or change to grep for something else
STATE=$(ping -q -w 1 -c 1 `ip r | grep default | cut -d ' ' -f 3` > /dev/null && echo ok || echo error)
#sleep for 2 seconds and ...
4
right off the top of my head:
ping your router
ping google.com
grep ifconfig output for valid gateway and/or valid IP address
4
You need a VPN client running on the Raspberry Pi to be able to connect to your work VPN. One of the most common clients is the Cisco AnyConnect client. There is a version for Linux that seems to run on the Raspberry Pi called OpenConnect as explained here. They provide the steps to install and connect so worth a try. Hope it helps.
4
First some general information to get an idea what to do. As you already have found there are in general two ways to configure a Virtual Private Network: a bridged setup on OSI Layer 2 and a routed setup on OSI Layer 3.
Nowadays we have mainly two VPN programs that are mostly used: the modern and up comming Wireguard and meanwhile classic OpenVPN. I would ...
3
Using ssh to securely access your Raspbery Pi
ssh is a client that interacts with ssh servers. OpenSSH is used on many Linux distributions to act as the server.
Installing openssh-server
Really, this should already be installed.
sudo apt-get install openssh-server #debian
sudo pacman -S openssh #archlinux
Set up the client
Creating Keys
The client ...
3
OpenSSH is designed to be the most secure way to tunnel into your machine.
When I say tunnel, I mean connect into the console via an encrypted tunnel, where you can also connect using SFTP over port 22, reroute local ports into you machine to make it look as if you were at the machine while surfing somewhere else in the world, redirect X application but in ...
3
I'm also fairly new to using the RP. I ran into the same problem using a wired network connection. I edited my /etc/network/interfaces file and removed the line "iface eth0 inet dhcp" and rebooted, this gave Network Manager control of the network interface.
A thorough description of Network Manager can be found here https://wiki.debian.org/NetworkManager
3
There is a debian-way of running OpenVPN, which is a lot easier than trying with different scripts on your own.
When you install openvpn using the package manager (apt), like:
sudo apt-get install openvpn
It will create a /etc/openvpn and a /usr/share/doc/openvpn/examples/sample-config-files directories that are relevant to this answer.
Browse the ...
3
It looks like changing all the ".ovpn" files instead to use ".conf" extension worked. Not sure why that is. E.g.:
sudo openvpn --config /etc/openvpn/Netherlands.conf
3
Change the vpn configs to both have dev tun and change your iptables to use:
*mangle
:PREROUTING ACCEPT
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
COMMIT
*raw
:PREROUTING ACCEPT
:OUTPUT ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT
:INPUT ACCEPT
:OUTPUT ACCEPT
:POSTROUTING ACCEPT
-A POSTROUTING -o tun0 -j MASQUERADE
COMMIT
*filter
:INPUT ...
3
Brdging an access point together with a wired ethernet interface is possible but connect to a local network with internet access together with using a vpn tunnel is a routing problem. So you can only use routing instead of bridging but that requires different subnets e.g. for your wifi, the vpn tunnel and for your local network. A working solution of this ...
3
Not all information about OpenVPN is logged to /var/log/syslog. You can view this information if you run the process manually.
First, stop the OpenVPN service:
sudo systemctl stop openvpn
Then, try running OpenVPN manually:
sudo openvpn --config /path/to/portugal.conf
This will give you much more detailed error messages to help you diagnose the problem ...
3
Well I found the solution for me - hopefully it helps you too!
Found that /var/log/openvpn.log on the RPi had the line "VERIFY ERROR: depth=0, error=CRL has expired"
Searching that gave several results saying to regenerate the Certificate Revocation List, but I couldn't find how to do this with pivpn.
Found this workaround and it worked: use pivpn to add a ...
3
First of all: very good explained question. But it is a sophisticated setup. And just to answer your question: yes, it is needed to setup special static routes on several devices.
But it is very difficult to give advices remotely. I would need access to the network to try setup and look how it works step by step, the usual way to do the work of a network ...
3
The problem is with the routing. You try to connect from remote to the PI, but the return packets are routed through the VPN. The port forwarding might work, you have to find out where it goes wrong.
A solution to the routing problem is policy routing. Create a rule:
ip rule add sport 22 table 222
This assumes that 22 is your SSH port, the table number ...
3
Having a remote OpenVPN server at your home and connect to it with the RasPi is a good solution if you cannot use port forwarding on the modem. Here is an example setup for what you have described:
(dhcp
from RPi) bridge 10.8.0.2/24 ┌──────────┐ 10.8.0.1/24 192.168.50.2
╱ wifi ┌───────┐ /...
3
We don't know anything about your log in commands but you can put this commands into a shell script. This is basic bash programming and you will find millions of tutorials how to do it.
If you have made the script and you have tested it running from the command line then just make a systemd Unit file to start this script one time on boot up. You will also ...
3
The Raspberry Pi 4 does not have cryptographic extensions, to be more precise it has, but to be enabled would require HW changes alongside paying a license to Broadcom/ARM.
Here's the link for a discussion on RPi's forum where a RPi foundation engineer explains the fuzz: https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=207888
jamesh's answer is ...
3
Try this
sudo nano /etc/dnsmasq.conf
My internet is connected via eth0 then theres a vpn connection turned on
interface eth0
static ip_address=192.168.1.80/24 # Static ip for your rpi
static routers=192.168.1.254 # your Routers ip
static domain_name_servers=1.1.1.1 # Dns Cloudfare Server
interface=wlan0 # Use interface wlan0
server=1.1.1.1 ...
3
@Ingo has the correct answer - it seems better than other solutions around the Internet at the moment advising to add the Debian-unstable repository.
I encountered a few issues while running through those steps though - and enough went wrong that I thought I'd document them with another answer, to make it easier to read than a comment - and also so I can ...
3
The Raspberry Pi OS uses systemd, so you will find logs in its journal. It also contains the logging from the OpenVPN server. Look at it to the current boot with:
rpi ~$ journalctl --boot=0 --pager-end
You can filter it to the service:
rpi ~$ journalctl --boot=0 --unit=openvpn.service
Only top voted, non community-wiki answers of a minimum length are eligible
