Personal VPN with Banana Pi
There has been a hype over the internet about government surveillance and eavesdropping. One of the best way one can protect their digital privacy is by using a VPN to access the internet. Though the locations we can put our Banana Pi is limited, a Virtual Private Network can also help jump over firewalls at remote locations or connect securely to your home network from your work.
OpenVPN
OpenVPN is an opensource software that allows the secure connection from a computer, smartphone, to a server. VPN, virtual private networks, can be used to hop over firewalls, access the internet without restrictions, or hide your traffic behind a server. With the Banana Pi M1, we will be creating a OpenVPN server that will provide your with a free personal VPN.
What we will use
A Banana Pi M1 with SD card, Bananian installed
Internet connection (with cable)
Port Forwarding on Router
A computer / smartphone
The whole process can be done with JuiceSSH app in Android instead of using a computer. Check out my JuiceSSH overview
Video
Outline
Making your OpenVPN server is one of the hardest projects here. It involves a lot configuration. It is not the normal copy n' paste project! I made a outline showing the steps involved.
- Getting ready (updating, changing default passwords, and installing OpenVPN)
- Generating Keys (set key size and generate encrypted keys)
- Server side configuration for connection
- Creating .ovpn profile for client side use
- Port forwarding on router
- Connection testing
Starting the Project
First, you will want to update your OS to make sure it is up to date and not vulnerable to known bugs.
apt-get update
apt-get upgradeIt is highly recommended to change the default password, many routers were hacked because people did not bother to change the default password.
passwdNext, let's install OpenVPN
apt-get install openvpn
Generating Keys
Once OpenVPN is installed, we have to begin to generate keys and modify settings.First, we will make a new directory for our keys
mkdir /etc/openvpn/easy-rsa/
cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/So we just copied some example configuration to the directory which we will be modifying the settings and generate the keys.
We can continue by editing the server configuration
I decided to change the encryption key size from 1024 bit to 2048 bit for extra security.
sed -i 's/KEY_SIZE=1024/KEY_SIZE=2048/' /etc/openvpn/easy-rsa/varsNow to change the easy-rsa directory to the one we just created
nano /etc/openvpn/easy-rsa/varsChange theeasy-rsa directory from `pwd` to
/etc/openvpn/easy-rsa
Now we can start generating keys. We need to erase all example keys and generate keys for your new server.
I had trouble in the video now this command will help you a lot! It gives you permission to execute programs in the folder.
chmod -R 777 /etc/openvpn/
cd /etc/openvpn/easy-rsa
source ./vars
./clean-allBuilding keys
./build-caA series of prompts will pop up, I highly recommend you to leave them default and just 'enter' them away. If you do change the defaults, be very careful as things may not work out.
Building a server key. 'bananapi' is the name of my server, you can change it if you want.
./build-key-server bananapiGenerate another key
openvpn --genkey --secret ta.key
cd
cp ca.key /etc/openvpn/easy-rsa/keys/ta.keyBuild a random prime key, it will take a long time. 10 to 20 minutes
./build-dhBuild a key for user1
./build-key-pass user1You can change 'user1' to any name you want, but remember it when we are creating user profiles.
When prompted enter a PEM password of your choice, but leave everything else blank!
Server config
We can proceed by configuring the server, since we will be inputting lines from scratch, it may be a good idea for you to copy and paste below linesnano /etc/openvpn/server.confnano will open up a blank document and paste below lines into it
local 192.168.x.xxx
#(fill in with local IP of your Banana Pi)
dev tun
proto tcp
port 443
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/Server.crt
key /etc/openvpn/easy-rsa/keys/Server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.x.xxx 255.255.255.0"
#(fill in with Banana Pi IP)
push "dhcp-option DNS 192.168.x.x
#(fill in with your router IP)
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
now we have to enable ipv4 forwarding on Banana Pi Server and modify firewall settings
nano /etc/sysctl.confFind the line 'uncomment to enable IPv4 packet forwarding' and delete teh '#' at the beginning of the script under that line.
nano /etc/firewall-openvpn-rules.sh
We are creating a new file that will contain the configurations, fill it in with settings below
#!/bin/bashNOTE the red lines are one line of command.
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.XX.X
Now we need to set the file to run at start up
chmod 700 /etc/firewall-openvpn-rules.sh
chown root /etc/firewall-Openvpn-rules.shWe made the file 'firewall-openvpn-rules.sh' executable
nano /etc/network/interfacesAfter 'iface eth0 inet dhcp', indent and add below line like the picture
pre-up /etc/firewall-openvpn-rules.sh
We made the file 'firewall-openvpn-rules.sh' run automatically the easy way. In breif, we added the line 'sh /etc/firewall-openvpn-rules.sh' after 'exit 0' at the end of the document '/etc/rc.local'
Now it is time to create a config file for the client to open up on Android.
Create a new file
nano /etc/openvpn/easy-rsa/keys/user1.ovpnIt will open up a blank document, so we need to put below lines there
clientOr to see the original example configuration, copy the conf file as user1.ovpn (red is 1 line)
dev tun
proto tcp
remote (public IP of your house) 443
#(443 is the port)
resolv-retry infinite
persist-key
persist-tun
mute-replay-warnings
ca ca.crt
cert user1.crt
key user1.key
ns-cert-type server
cipher AES-256-CBC
comp lzo
verb3
mute 20
cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /etc/openvpn/easy-rsa/keys/user1.ovpn
Now use FileZilla to connect and download files from Banana Pi. Download 'ca.cert' 'user1.crt''user1.key'and'user1.opvn'
Once the file is on your PC, upload it to Google drive so you can download it on your Android.
Start Open VPN and debug
To start and restart the server
service openvpn restartIf the server does not start, debug it with
grep ovpn /var/log/syslog
Port Forwarding
You should be quiet familiar with port forwarding and it is easy! Just go in to your router's control page by typing your router IP and it often looks like this
192.168.1.1Forward port 443 tcp to local IP of Banana Pi If you followed this guide
Connection Testing
Move files from your Banana Pi to your desktop or cloud with FileZilla using sftp
under directory
/etc/openvpn/easy-rsa/keys/files to copy
ca.crt
user1.crt
user1.key
ta.key
user1.ovpn
Firewall Jumping
I did research in firewall jumping and if it is a basic firewall, then set the port to 443 and protocol to tcp and you should be set.
But there are also packet sniffing firewalls that are harder to hide from and I think a SSL tunnel will do the trick and I will do more research and experiment with it.
Import the .opvn file from SD card and you are set!
.
Posts
