Background
Believe it or not the Raspberry Pi can be a pretty nifty little router. Not so much as a single all-in-one solution like the typical residential router, but more as part of a routing solution combined with one or more WAPs and gigabit ethernet switches. It runs a forked version of OpenWRT called LEDE, and for this guide, a build from a group of Canadians and Australians called ROOter that focuses on being ready-to-deploy with strong support for USB cellular modems.
I've had to tweak things a bit though to get the OpenVPN Client support configured for ease of use with Private Internet Access (PIA), so I'm documenting that here. This could be a good solution too, for anyone that has an existing router that doesn't have either cellular modem or VPN Client support built-in. That router could become an AP and the Raspberry Pi the new router.
I'm assuming here that you're familar with Raspberry Pi basics and that you know how to flash an SD card with a distro image. Here's the page for "Of Modems and Men" where you can find the ROOter downloads for your particular RPi:
https://ofmodemsandmen.com/downloadsp.html
Flash your SD card, boot, and configure the router basics (not covered here). You'll want a PC based file management and editing tool like WinSCP (use with WINE on Mac) to make moving and editing files as easy as possible. WinSCP treats your ROOter file system much like Windows File Explorer. You can browse the ROOter file system and perform all of the usual file management and creation.
Disable OpenVPN Respawn Daemon
The first tweak I'm recommending is to stop OpenVPN from respawning when you kill the process. It's OK for those that want a full-time VPN that starts at boot -- but for those that want start and stop client instances respawn makes them impossible to kill.
Navigate to /etc/init.d and open "openvpn" with your WinSCP editor. Look for these four lines to comment out by adding a "#" at the beginning of the line and save your changes.
Create Private Internet Access OpenVPN Recipe (Template)
Navigate to /etc/config and open "openvpn_recipes". Add these lines to the end of the file to create a new PIA template in the ROOter LuCI GUI for new OpenVPN Client instances:
Download PIA OpenVPN Keys and Certificates
If you don't already have the latest PIA OpenVPN settings files and certficates, get them from here. The above template is for the (DEFAULT) version, so download that to your PC.
https://helpdesk.privateinternetacc...een-the-OpenVPN-config-files-on-your-website-
Move Keys to Router and Create Username and Password File
Extract the zip and copy the two keys (.crt and .pem) using WinSCP to /etc/openvpn on your ROOter. While you're in that directory right-click to create a new file named "pia_userpass.txt" (all lower case) with the first line consisting of your PIA username and the second your PIA password. Save the file. Your security keys and password file should now be in in the /etc/openvpn directory.
That's it for the work that's needed using WinSCP. From here on we'll be in the ROOter LuCI GUI interface adding your PIA Client instances and starting or stopping them as needed.
Disable OpenVPN Startup Process
Open your browser and navigate to the setup page for your Raspberry Pi ROOter (192.168.1.1 if you didn't change it during setup). Go to System - Startup, scroll down to OpenVPN, and click on "ENABLED" so that it changes to "DISABLED". Earlier we eliminated the OpenVPN respawn daemon, and now we're turning OpenVPN off at startup so that we can start and stop client instances at will.
Create OpenVPN Client Instances Based on Newly Created PIA Recipe
Next we'll go to Services - OpenVPN and your screen should look like this:
Type in the name of the client instance you'd like to create (I'm calling mine pia_midwest), select "Client configuration for Private Internet Access" from the dropdown and click "ADD".
On the "Basic Configuration" screen add the name of the PIA VPN server you'd like to connect to in the "Remote" field in place of the example. A list of available servers can be found here:
https://www.privateinternetaccess.com/pages/network/
(continued on next post)
Believe it or not the Raspberry Pi can be a pretty nifty little router. Not so much as a single all-in-one solution like the typical residential router, but more as part of a routing solution combined with one or more WAPs and gigabit ethernet switches. It runs a forked version of OpenWRT called LEDE, and for this guide, a build from a group of Canadians and Australians called ROOter that focuses on being ready-to-deploy with strong support for USB cellular modems.
I've had to tweak things a bit though to get the OpenVPN Client support configured for ease of use with Private Internet Access (PIA), so I'm documenting that here. This could be a good solution too, for anyone that has an existing router that doesn't have either cellular modem or VPN Client support built-in. That router could become an AP and the Raspberry Pi the new router.
I'm assuming here that you're familar with Raspberry Pi basics and that you know how to flash an SD card with a distro image. Here's the page for "Of Modems and Men" where you can find the ROOter downloads for your particular RPi:
https://ofmodemsandmen.com/downloadsp.html
Flash your SD card, boot, and configure the router basics (not covered here). You'll want a PC based file management and editing tool like WinSCP (use with WINE on Mac) to make moving and editing files as easy as possible. WinSCP treats your ROOter file system much like Windows File Explorer. You can browse the ROOter file system and perform all of the usual file management and creation.
Disable OpenVPN Respawn Daemon
The first tweak I'm recommending is to stop OpenVPN from respawning when you kill the process. It's OK for those that want a full-time VPN that starts at boot -- but for those that want start and stop client instances respawn makes them impossible to kill.
Navigate to /etc/init.d and open "openvpn" with your WinSCP editor. Look for these four lines to comment out by adding a "#" at the beginning of the line and save your changes.
Code:
# procd_set_param respawn
# procd_append_param respawn 3600
# procd_append_param respawn 5
# procd_append_param respawn -1Create Private Internet Access OpenVPN Recipe (Template)
Navigate to /etc/config and open "openvpn_recipes". Add these lines to the end of the file to create a new PIA template in the ROOter LuCI GUI for new OpenVPN Client instances:
Code:
#
# Private Internet Access Client
#
config openvpn_recipe pia_client_tun
option _description "Client configuration for Private Internet Access"
option _role "client"
option client "1"
option dev "tun"
option proto "udp"
list remote "us-example.privateinternetaccess.com"
option port "1198"
option resolv_retry "infinite"
option nobind "1"
option persist_key "1"
option persist_tun "1"
option cipher "aes-128-cbc"
option auth "sha1"
option tls_client "1"
option remote_cert_tls "server"
option auth_user_pass "/etc/openvpn/pia_userpass.txt"
option comp_lzo "yes"
option verb "1"
option reneg_sec "0"
option crl_verify "/etc/openvpn/crl.rsa.2048.pem"
option ca "/etc/openvpn/ca.rsa.2048.crt"
option disable_occ "1"Download PIA OpenVPN Keys and Certificates
If you don't already have the latest PIA OpenVPN settings files and certficates, get them from here. The above template is for the (DEFAULT) version, so download that to your PC.
https://helpdesk.privateinternetacc...een-the-OpenVPN-config-files-on-your-website-
Move Keys to Router and Create Username and Password File
Extract the zip and copy the two keys (.crt and .pem) using WinSCP to /etc/openvpn on your ROOter. While you're in that directory right-click to create a new file named "pia_userpass.txt" (all lower case) with the first line consisting of your PIA username and the second your PIA password. Save the file. Your security keys and password file should now be in in the /etc/openvpn directory.
That's it for the work that's needed using WinSCP. From here on we'll be in the ROOter LuCI GUI interface adding your PIA Client instances and starting or stopping them as needed.
Disable OpenVPN Startup Process
Open your browser and navigate to the setup page for your Raspberry Pi ROOter (192.168.1.1 if you didn't change it during setup). Go to System - Startup, scroll down to OpenVPN, and click on "ENABLED" so that it changes to "DISABLED". Earlier we eliminated the OpenVPN respawn daemon, and now we're turning OpenVPN off at startup so that we can start and stop client instances at will.
Create OpenVPN Client Instances Based on Newly Created PIA Recipe
Next we'll go to Services - OpenVPN and your screen should look like this:
Type in the name of the client instance you'd like to create (I'm calling mine pia_midwest), select "Client configuration for Private Internet Access" from the dropdown and click "ADD".
On the "Basic Configuration" screen add the name of the PIA VPN server you'd like to connect to in the "Remote" field in place of the example. A list of available servers can be found here:
https://www.privateinternetaccess.com/pages/network/
(continued on next post)
Last edited:
