I have been trying to get this working for a while and posted a few different times with no success.
But i finally got it working how i want but need to know if its secure
The idea
I have a paid VPN with PrivateInternetAccess. If im out of my house and i connect, i obviously dont get to my home LAN also. So my plan was to have a small ubuntu box with a Client to PIA and an OpenVPN server. so the box would always be connected to PIA, then i could connect to it externally and have both PIA and access to my LAN with the one connection.
Setting it up was easy enough.
Server setup ok
Client setup ok
They would both work individually, as in PIA would connect and i could use that from the box. If i disabled the PIA client and enabled the OpenVPN server i could connect in externally, access my LAN but no Internet via PIA. If both were running at the same time. The PIA client connects but i cannot dial in from outside my LAN. just get
waiting for server
It took lots of tweaking and pulling bits from other posts together to get this working as i wanted and now its working great.
The box boots up, enables the OpenVPN server so i can connect in and connects to PIA for secure internet.
So i connect in from my phone or laptop externally, i can get to my LAN and get to PIA. But is it safe with all these rules ive added
my network interfaces file.
This calls a firewall script on boot
iface eth0 inet static
pre-up /etc/firewall-openvpn-rules.sh
address 192.168.20.20
netmask 255.255.255.0
gateway 192.168.20.1
dns-nameserver 8.8.8.8
The firewall script that is run on boot
#firewall-openvpn-rules.sh !/bin/sh
#tun0 is openvpn server tunnel
#tun1 is PIA client tunnel
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.20.20 #my openvpn server
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o tun1 -j MASQUERADE
#
iptables -A FORWARD -i tun0 -o tun1 -j ACCEPT
iptables -A FORWARD -i tun1 -o tun0 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun1 -j ACCEPT
iptables -A FORWARD -i tun1 -o eth0 -j ACCEPT
#
# this line lets me access the LAN when both tunnels are up
iptables -I FORWARD -i tun0 -j ACCEPT
my openvpn server conf file
port 1194
proto udp
dev tun0
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
multihome
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
crl-verify crl.pem
my openvpn client conf which i use for connected in from phone or laptop
client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote [my external ip and port]
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
my PIA client conf file which has a a route-up and route-pre-down script
client
dev tun1
proto udp
remote [ip and port for PIA]
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server
auth-user-pass
comp-lzo
reneg-sec 0
crl-verify crl.rsa.2048.pem
ca ca.rsa.2048.crt
disable-occ
auth-user-pass login.txt
route-up /etc/openvpn/up.sh
route-pre-down /etc/openvpn/down.sh
this route-up script is what lets my connect in when the PIA client is connected.
if i dont use this, when i try and connect i just get
waiting for server.
so this is run when the PIA client connects and then gets flushed using the other rule if it drops
#!/bin/sh
ip rule add from 192.168.20.20 table 10
ip route add default via 192.168.20.1 table 10 #my router
this route-pre-down just flushes that table incase the PIA client drops
#!/bin/sh
ip route flush table 10
my UFW rules which are meant to only allow internet access out on tun1 (which is my PIA tunnel) and then allow full lan access and udp access for dialing out and in
sudo ufw allow OpenSSH
sudo ufw default deny incoming
sudo ufw default deny outgoing
sudo ufw allow out on tun1
sudo ufw allow out to 192.168.20.0/24
sudo ufw allow in from 192.168.20.0/24
sudo ufw allow in from 10.8.0.0/24
sudo ufw allow out to 10.8.0.0/24
sudo ufw allow out 1198/udp
sudo ufw allow in 1194/udp
sudo ufw enable
and thats it.
I dial in using the client conf and I can access LAN and PIA internet at same time
if i go to ipleak.net when dialed in i get the PIA external IP which is what i wanted
so my question is,
is this secure, adding in the extra gateway route so i can dial in when PIA is connected, is that safe, is all my traffic going over the VPN correctly? are there any other way this can be setup using one box?
Thanks
