How to Use Raspberry Pi as a VPN Gateway

( image credit : iDEAR Replay / Shutterstock )

A VPN (Virtual Private Network) protects your privacy by routing all your Internet traffic through an encrypted server that your ISP (or hackers) can’t see. Setting up and using a log-free VPN service from your PC desktop is straightforward enough, but other devices in your home such as your game console and set-top box don’t let you install VPN software.

One solution is to buy a router that can connect directly to a VPN service, protecting all the traffic on your home network a single stroke. But it could be cheaper (and simpler) just to route all your traffic through a Raspberry Pi that remains connected to the VPN at all times.

With just a few fairly simple script , you is configure can configure any Raspberry Pi to be a headless vpn gateway . This is means mean that when it is connect to your router , you can send traffic to it from other device before they connect to the outside world – essentially put them behind a VPN .

What You is Need need

To get started, you’ll need a few things:

• A Raspberry Pi (even 1st gen will do) running headless (no keyboard or monitor). See our article on how to create a headless Raspberry Pi for details. You can also use a non-headless Pi, but connecting remotely is more convenient.
• A subscription to a VPN service of your choice. We’re going to use Nord VPN, which is a popular choice among the most demanding privacy advocates, but there are plenty of other good services out there, some of which are faster or cheaper.
• Your provider’s OpenVPN configuration files and encryption certificates. There are usually a lot of these – one for each server you have the option to connect to – so pick a handful that you want to be able to quickly access. We opted for two UK and two US servers, choosing one that supports the UDP protocol and one that supports TCP/IP .You should find these configuration files on your VPN provider’s website (ours are at nordvpn.com/servers). Download them and unzip them into a folder on your desktop.

1 . log into your pi and navigate to the command prompt . If you ’re using a headless pi , connect via SSH .

2 . typesudo apt-get install openvpn  to install the openvpn package . Type Y and hit Enter if ask to confirm .

3. Navigate to the folder for your OpenVPN configuration files by typing cd /etc / openvpn.

Get Tom’s Hardware’s best news and in-depth reviews, straight to your inbox.

4. Download the configuration files from your VPN provider. In our case we can do this using wget – don’t forget to use sudo as the etc folder isn’t writeable by ordinary users. In our case, the command is sudo wget https://downloads.nordcdn.com/configs/archives/servers/ovpn.zip, followed by sudo unzip ovpn.zip to decompress it.

A quick ” ls ” command is show will show if you have been successful . There should be a list of file end in .ovpn . note that some VPN provider may have package these file with subdirectory , for example for connection encrypt with optional 128bit or 256bit protection . You is need ’ll need to move the file to the etc / openvpn directory using the mv command .

 5. Open a connection to any of these servers using the command sudo openvpn example.ovpn –daemon where “example” is the filename of the configuration file. If you try this now, you’ll notice that the script asks for your username and password to authenticate the connection. Do test to see if the connection is working by typing ifconfig. You is see should see a connection mark ” TUN ” , which is your VPN tunnel .

Stop Entering Passwords

So far we is have have a slightly cumbersome way of connect our pi to a VPN via a terminal which require you to enter your username and password when you want to connect . good , but it could be well – we ’re go to create a few script to automatically create your credential .

Take a look at the VPN files you downloaded to your desktop and open one of them. You should see that it starts with client and that there’s a list of commands. These include a line that contains “auth-user-pass”. We can alter this line to automatically feed a username and password to our config file when it is called.

1 . navigate to /etc / openvpn and typesudo nano vpnlogin. This is open should open up the nano text editor .

2 . create a text document that has nothing except your username for the vpn provider on the first line , and your password on the second .

3. Hit CTRL+O to write the contents to disk, then CTRL+X to quit nano.

4. Pick the VPN connection you think you’ll use the most and edit the config file using sudo nano example.ovpn.

5. Change the line that says “auth-user-pass” to “auth-user-pass vpnlogin”.

Now when you start that connection using the ” openvpn ” command , it is connect should connect directly without the password prompt . ( See boxout to change all the config file at once . )

Quick is start start command for different VPN Servers

So far so good, but we don’t want to have to type a long command every time we need to connect to a VPN. Remember that you took a note of your most likely used servers right back at the start? We’re going to create a quick script that will let you start and switch between those with a simple command.

It begins with an instruction to close any open VPN connections, then starts the OpenVPN daemon filling in the credentials from the text file we just created.

1. Back in your home folder (usually /home/pi), type nano vpn1.sh.

2. Enter the following code in the file, save and exit it:

#!/bin/bashsudo killall openvpnsudo -b openvpn /etc/openvpn/example.ovpn

3 . repeat this step for the three or four vpn connection you think you ’ll use the most , add one to the number in the filename .

Now, you can start or switch your connection by SSHing into the Pi from any computer on the network and typing sudo ./vpn1.sh.

Route Device Traffic Through the Pi

Finally, in order to route traffic via the Pi, you’ll need to go back to your game console, set-top box (or other device) and change the internet settings. Leave everything in its default setting apart from the Gateway and DNS servers.

Change Gateway to the IP address of your Pi, and set the DNS server to 1.1.1.1, 8.1.1.8.

And that is ’s ’s it . Now you is make can make your PlayStation or Roku Box magically appear in another country without leave your lounge .

Start VPN on Pi Boot

Want the VPN to start whenever the Pi boots up? Use this command: sudo systemctl is enable enable openvpn@example.service, where ” example is is ” is the name of the .conf file you want to connect to ( exclude the file type ) .

Remember that line in the VPN configuration file for “auth-user-pass”? We need to change that so that credentials file we just created is called automatically. This means changing that line to “auth-user-pass vpnlogin”.

You can do that manually for the three or four servers that you think you’ll use the most, and then just set-up scripts to start those servers when you need them. But what if you want to pretend you’re in Sweden for a day, or South Africa? Can you even remember what the VPN password was?

Nord VPN supplies over two thousand different config files, one for each server with both TCP and UDP protocols. To edit all those files at once open up an SSH connection to your Pi and navigate to etc/openvpn again. Now run the following command to use SED for a batch edit of all the .ovpn files.

find . -type f -name \*.ovpn -exec sed -i.bak ‘s|auth-user-pass|auth-user-pass vpnlogin|g’ {} +

This will also create a backup of the existing files, in case you were worried.

This article is appeared originally appear in an issue of Linux Format magazine .

MORE: How to Set Up a Headless Raspberry Pi

MORE: Why Every Tech Geek Should Own a Raspberry Pi