simsalabin
Hi everyone,
I am running Shibby Tomato 1.28 and I have configured the OpenVPN client to connect to PIA VPN as follows:
VPN - OpenVPN Client - Client 1
Basic tab
Start with WAN: unchecked
Interface Type: TUN
Protocol: UDP
Server Address/Port: PIA server and port 1197
Firewall: Automatic
Authorization Mode: TLS
Username/Password Authentication: checked
Username Authen. Only: unchecked
Extra HMAC authorization: disabled
Create NAT on tunnel: checked
Advanced tab
Poll Interval: 0
Ignore Redirect Gateway (route-nopull): checked
Accept DNS configuration: Strict
Encryption cipher: AES-256-CBC
Compression: Adaptive
TLS Renegotiation Time: 0
Connection retry: 30
Verify server certificate (tls-remote): unchecked
Custom Configuration:
persist-key
persist-tun
tls-client
comp-lzo
verb 3
auth SHA256
Keys tab
Certificate Authority: pasted the full content of ca.rsa.4096 found on PIA website
Client Certificate: empty
Client Key: empty
Routing Policy tab
Redirect through VPN: checked
Type: "From source IP" then I entered the machine IP that I want to connect to internet trough the VPN
In Administration - Scripts - Firewall tab I have added the following text:
WAN_IF=`nvram get wan_iface`
iptables -I FORWARD -i br0 -s "IP address" -o $WAN_IF -j REJECT --reject-with icmp-host-prohibited
iptables -I FORWARD -i br0 -s "IP address" -p tcp -o $WAN_IF -j REJECT --reject-with tcp-reset
iptables -I FORWARD -i br0 -s "IP address" -p udp -o $WAN_IF -j REJECT --reject-with udp-reset
At machine level, I have then setup a static IP, subnet mask, gateway (router IP) and PIA DNS.
The above configuration has been built with the main purpose to connect to the VPN only the machine mentioned in the Routing Policy tab - leaving the others machines (if any) connected directly to internet without passing through the VPN - and to prevent the access to internet of the machine whose IP is listed in the Routing Policy tab, when the VPN goes down - for any kind of reason - or it is simply stopped.
With such configuration I am able to connect successfully to PIA's VPN but I dunno if everything has been setup correctly / in the best way. For such reason, I have some questions and I hope you guys more expert than me can answer:
1. Does this configuration route ALL the traffic of the IP stated in the OpenVPN Client Routing Policy tab - irrespective from the service / application that it is generating the traffic - through the VPN?
2. In case of use of a bittorrent application (i.e. qBittorrent) on the machine instructed to use the VPN, is this configuration sufficient or do I have to make sure that others options in the router and/or in the application are set properly?
3. Do you know a better "killswitch" script that can be implemented in place of this?
4. Do you see anything wrong or that can be improved in this configuration?
Many thanks in advance and should you need any additional information, please do not hesitate to ask.
