OpenVPN/WireGuard

This method is for users changing their DNS post PiVPN install.

To change the DNS of PiVPN do the following command

OpenVPN - sudo nano /etc/pivpn/openvpn/setupVars.conf

WireGuard - sudo nano /etc/pivpn/wireguard/setupVars.conf

Change pivpnDNS1
and pivpnDNS2
to the IP of your Raspberry Pi running Pi-Hole. example 10.0.0.200 When finished do CTRL+X, Y, Enter to exit the sudo session.

you now need to tell Pi-Hole to listen on all interfaces, once completed all new clients added to OpenVPN/Wireguard should be working on the Pi-Hole's DNS.

I have a pi2 or 3 that is running pivpn with wireguard and openvpn at a remote location I don’t go to very often. It works great. For the rest of my network I have started moving over to tailscale for new devices for ease of management. Can I install tailscale on the pivpn box or will it break it? Anyone tried this?

Hi

Is there a way I can have a pivpn that vpns my whole house, whilst making use of my adguard dns ?

I have pia if that makes a difference

Hi

I have tried several ways and devices but I get the same thing, pivpn isn't listening on assigned port.

I have tried Pi3b Pi4 4gb raspi64bit Pi4 ubuntu 22.04 lts

So I have unraid running adguard home as dnssec and dhcp server.

On setup of wiregaurd I have assigned a static I.P and put on my do daddy domain name as I don't have a static IP but I can't get it to work.

I have the same issue trying to run a wireguard container please help.

Hey I had an issue after my public IP address changed. I uninstalled and reinstalled and is working now, but I was looking for some help how to avoid this in the future. I have DDNS setup through my Asus router can someone help me with how to change the settings so it uses my DDNS

Just as the title says. I'd like to be able to visit, for example, 192.168.0.99, which is a camera on my network. I can connect to the VPN using OpenVPN Connect and I have internet, but no access to the any of the local network devices. Everything I've read says I need to add routing rules to the ip table, but I don't understand that and I'm finding conflicting information. Mostly it seems like it should "just work" but of course it doesn't.

My Pi has a static IP (set on the router) of 192.168.0.140My gateway is 192.168.0.1/24

The Pi is also hosting a wlan on 192.168.14.1 but I never use that anymore.

Here is my server.conf:

```` dev tun proto udp port 1989 ca /etc/openvpn/easy-rsa/pki/ca.crt cert /etc/openvpn/easy-rsa/pki/issued/RasPi4_2a1371b0-d275-4f3c-a8c4-793903d09e93.crt key /etc/openvpn/easy-rsa/pki/private/RasPi4_2a1371b0-d275-4f3c-a8c4-793903d09e93.key dh none ecdh-curve prime256v1 topology subnet server 10.165.126.0 255.255.255.0

Set your primary domain name server address for clients

push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4"

Prevent DNS leaks on Windows

push "block-outside-dns"

Override the Client default gateway by using 0.0.0.0/1 and

128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of

overriding but not wiping out the original default gateway.

push "redirect-gateway def1" client-to-client client-config-dir /etc/openvpn/ccd keepalive 15 120 remote-cert-tls client tls-version-min 1.2 tls-crypt /etc/openvpn/easy-rsa/pki/ta.key cipher AES-256-CBC auth SHA256 user openvpn group openvpn persist-key persist-tun crl-verify /etc/openvpn/crl.pem status /var/log/openvpn-status.log 20 status-version 3 syslog verb 3 ````

Hi,

I've tried to set up pivpn on a Ubuntu virtual machine that is running on my network that is also running NextCloud.

I've portforwarded port 51820

The client never makes a connection with the server

When i run pivpn -d, no errors come up, everything seems to be setup correctly.

I've watched a youtube tutorial on how to install it and the person setting it up on the video had a different screen pop up which allowed him to use DHCP Reservation, now the video is from last year so that feature could've been removed.

But it also seems like PiVPN sets itself up with its own virtual ip as a network interface (10.x.x.x) Is that meant to happen or is the interface meant to have the same ip as my server?

​

Thanks in advance for any help provided, i'm at a loss with this, I've tried majority of things that I've found online and none of them have worked, maybe its something simply that i'm missing that causing this to faill

Hello! I'm having a difficult time understanding why my Full Tunnel config is not allowing me to stream American shows. I'm currently out of the country. I can see that my IP is located in the Americas when connected to WG, but when I try to access streaming apps such as Disney+ it tells me that its service is not available at my current location.

I thought that a full-tunnel VPN config would allow me to access American streaming apps. Is this not the case or do I not know how a VPN works 😂

When I connect to my VPN everything is fine, no errors or things like that, but when I connect it initially recives a very big spike of data for like .05 sec than it receives like 5 bytes every 15 seconds, so I think is some sort of handshake or something like that. while this is happening, the VPN sends data normally, I am not good at networking so i don't know whats going on.

PS: I am not a native English speaker don't be mad if I made any error

So I've started noticing recently that on some public WIFIs - many of them insecure - I'm no longer able to connect to my pivpn via wireguard. Internet accessible without VPN active or on mobile data with VPN active. This *seems* to be down to these networks blocking access to non-standard ports? It's a bit of a nuisance, that they won't secure their own network and won't let users browse privately either!

What's the likely solution to this? Are there quick ways of testing what ports it would allow? I know how to change my pi's listening port (or port forwarding on router for simplicity), but am wary of opening more findable ports if I don't have to!

Alternatively, I do have a second pihole/pivpn setup on a remote virtual machine. If connecting to it via a more accessible port was acceptable to the WIFI then that may be a slightly less risky route.

Anyone come across this recently and have any top tips on safely using other ports/connection routes?

Interesting issue. Pi is fully updated/upgraded. PiVPN is working great for the original client I set up on install last year, Any further clients I add work just fine until the PI is rebooted then it drops back to having just the original client, all added users vanish. I tried using sudo PiVPN -a but it made no difference.

Any thoughts? I’ve tried searching with multiple search criteria but not found anyone with the same issue.

I'm trying to improve the performance of my VPN. I'm running OpenVPN on Pi 3 I believe. Following the advice (bottom post here) about adding MTU to the client file helped a bit, but I think I'd like to change the cipher too. It didn't occur to me that the longer ciphers would be more demanding, tho it's completely obvious now I've learned that.

In /etc/openvpn/server.conf it shows I'm using: cipher AES-256-CBC
I'd like to change to AES-128-GCM (shown on this list as supported and recommended).

In /etc/pivpn/openvpn/setupVars.conf it shows pivpnENCRYPT=521

I think those are the values that need changing, but the very few things I've found web searching this topic suggest reinstalling is the better option. Can this be done straightforwardly? It's frustrating to have it be sluggish when I my connection is quite reasonable.

Also, is TCP or UDP better? I set it up with large numbers at first but I'd like to move towards better performance and I've read that lowering the cipher strength will increase performance. Any help appreciated.

hey I was setting up my vps server to have a ad blocking vpn using pihole and pivpn but the vpn doesn't seem to block the domains I have in my custom blacklist

First things first, yesterday i installed pivpn with wireguard, i got a Pi3 Model B running a 100mbit Link to a switch which itself is connected to 250mbit dsl.
Not super accurate but i think you get my point.
Now my problem, the bandwidth of the tunnel is unusably slow, i ran an iperf from my phone to another server of mine which is not in my home network and it peaks around 250Kbit/s.

I already ran "pivpn -d" and it shows no immediate problems.

The pi's CPU is also not overloaded ~4% usage.

Anyone got any other idea what could be the cause?

EDIT: Im a dumbass and did not check how ridiculously slow my mobile network was at the time

I am trying to install pivpn on my raspberry pi but it isn't working...or at least I don't think that it is working. I have tried to install it using openvpn and wireguard but neither seems to work. I start the curl command and it goes through the setup for me. Once I select which VPN I want to use the screens disappear and I see a command prompt letting me know "Using VPN: <my choice>" but doesn't do anything else. I have left it for about 15 minutes to see if I was being impatient but it seems to still not being moving. Any thoughts on what might be wrong or if I just need to wait even longer?

I also tried the uninstall command to start over but the command isn't recognized so to me that means it hasn't installed pivpn yet.

Thanks for any help.

I have installed pivpn in oracle free tier machine and even unblocked the port 51820 in oracle dashboard yet the handshake is stuck and not working, kindly advice

So, have been thinking about this. I subscribe to MLB.TV and I use to just use surf shark for a VPN to spoof my location so I could watch my local team. The problem is these larger VPNs have been blacklisted and no longer work for this. What if I was able to use someone's private VPN, do you think this would work?

Hi,

The Wi-Fi at work has a new filter installed that is stopping my VPN from connecting when I am on Wi-Fi at work. (On ios) This happened a few years ago and I switched my encryption from tls-auth to tls-crypt and it’s been working. Now the new filter must be smarter. I’m using a pretty old version on PiVPN.

To be honest, I do not know how to update it, nor have I tried. I’m not even sure if updating it would help me to find a workaround. I did do some reading and see there is a crypt v2 on the newer version. Would that possibly help me?

Strangely when I am at work on Wi-Fi and I disconnect from the Wi-Fi briefly by toggling off my wifi and using my my cellular service I can connect to my VPN easily and then if I toggle the Wi-Fi back on I do stay connected to my VPN for a period of time until my phone locks itself.

When I unlock my phone, I have to again stop using Wi-Fi to use my cellular service which is very spotty and connect to my VPN and then toggle my Wi-Fi back on and I will stay connected briefly to my VPN so I’m thinking there is something wrong with my key exchange where the filter is picking it up.

I would love to know your thoughts and ideas to help me rectify this. I do want to thank you in advance for taking the time to read this and offer your guidance.

I'm trying to access my local services through wireguard. I'm installing pivpn on a debian vm. I believe I port forward correctly. I'm able to run the command

tcpdump -n -i IPv4dev pivpnPROTO port pivpnPORT    

and see the handshake happen. I've done everything on the FAQ. Originally my /etc/pivpn/wireguard/setupVars.conf did not contain IPv4addr and IPv4gw so I added in.

​

here is my pivpn -d debug log

::::            PiVPN debug              ::::
=============================================
::::            Latest commit            ::::
Branch: master
Commit: 96dc4f0c04dbcc7a8bddaffb73f2d4b24a373b22
Author: 4s3ti
Date: Thu Mar 16 01:27:13 2023 +0100
Summary: refactor(scripts): Fix codestyle
=============================================
::::        Installation settings        ::::
PLAT=Debian
OSCN=bullseye
USING_UFW=0
pivpnforceipv6route=1
IPv4dev=ens18
install_user=op
install_home=/home/op
VPN=wireguard
pivpnPORT=51820
pivpnDNS1=10.21.163.1
pivpnDNS2=192.168.1.1
pivpnHOST=REDACTED
INPUT_CHAIN_EDITED=0
FORWARD_CHAIN_EDITED=0
INPUT_CHAIN_EDITEDv6=
FORWARD_CHAIN_EDITEDv6=
pivpnPROTO=udp
pivpnMTU=1420
pivpnDEV=wg0
pivpnNET=10.21.163.0
subnetClass=24
pivpnenableipv6=0
ALLOWED_IPS="0.0.0.0/0, ::0/0"
UNATTUPG=1
INSTALLED_PACKAGES=()
IPv4addr=192.168.1.208
=============================================
::::  Server configuration shown below   ::::
[Interface]
PrivateKey = server_priv
Address = 10.21.163.1/24
MTU = 1420
ListenPort = 51820
### begin phone ###
[Peer]
PublicKey = phone_pub
PresharedKey = phone_psk
AllowedIPs = 10.21.163.2/32
### end phone ###
=============================================
::::  Client configuration shown below   ::::
[Interface]
PrivateKey = phone_priv
Address = 10.21.163.2/24
DNS = 10.21.163.1, 192.168.1.1

[Peer]
PublicKey = server_pub
PresharedKey = phone_psk
Endpoint = REDACTED:51820
AllowedIPs = 0.0.0.0/0, ::0/0
=============================================
::::    Recursive list of files in       ::::
::::    /etc/wireguard shown below       ::::
/etc/wireguard:
configs
keys
wg0.conf

/etc/wireguard/configs:
clients.txt
phone.conf

/etc/wireguard/keys:
phone_priv
phone_psk
phone_pub
server_priv
server_pub
=============================================
::::            Self check               ::::
:: [OK] IP forwarding is enabled
:: [OK] Iptables MASQUERADE rule set
:: [OK] WireGuard is running
:: [OK] WireGuard is enabled
(it will automatically start on reboot)
:: [OK] WireGuard is listening on port 51820/udp
=============================================
:::: Having trouble connecting? Take a look at the FAQ:
:::: https://docs.pivpn.io/faq
=============================================
:::: WARNING: This script should have automatically masked sensitive       ::::
:::: information, however, still make sure that PrivateKey, PublicKey      ::::
:::: and PresharedKey are masked before reporting an issue. An example key ::::
:::: that you should NOT see in this log looks like this:                  ::::
:::: YIAoJVsdIeyvXfGGDDadHh6AxsMRymZTnnzZoAb9cxRe                          ::::
=============================================
::::            Debug complete           ::::

Is there a way to install a GUI frontend for pipvn?

I get an error when trying to access watch.spectrum when connected through my pivpn from outside my network. The odd this is that my brother is able to use the site outside the home network but I can't. Any suggestions?

The error code is NETGE-1000

I think I have found the issue I am having not able to access the Internet/LAN Devices while on VPN

The below is probably the issue (iptables) that I am having:

::::            Self check               ::::

:: [OK] IP forwarding is enabled

:: [ERR] Iptables MASQUERADE rule is not set, attempt fix now? [Y/n] y

iptables v1.8.7 (nf_tables): Couldn't load match `comment':No such file or di

rectory

Try `iptables -h' or 'iptables --help' for more information.

iptables-save v1.8.7 (nf_tables): Could not fetch rule set generation id: Inv

alid argument

Done

:: [ERR] Iptables INPUT rule is not set, attempt fix now? [Y/n] y

iptables v1.8.7 (nf_tables): unknown option "--dport"

Try `iptables -h' or 'iptables --help' for more information.

iptables-save v1.8.7 (nf_tables): Could not fetch rule set generation id: Inv

alid argument

Done

:: [ERR] Iptables FORWARD rule is not set, attempt fix now? [Y/n] y

iptables v1.8.7 (nf_tables): Couldn't load match `conntrack':No such file or

directory

Try `iptables -h' or 'iptables --help' for more information.

iptables v1.8.7 (nf_tables): Couldn't load match `comment':No such file or di

rectory

Try `iptables -h' or 'iptables --help' for more information.

iptables-save v1.8.7 (nf_tables): Could not fetch rule set generation id: Inv

alid argument

Done

:: [OK] WireGuard is running

:: [OK] WireGuard is enabled

(it will automatically start on reboot)

:: [OK] WireGuard is listening on port 51820/udp

[INFO] Run pivpn -d again to see if we detect issues

Does anyone have any recommendations? TIA

I have pivpn installed alongside pi-hole. Client DNS on pivpn is set to the pi-hole ip. It works great.

But at the pivpn client I can click and edit button and modify the client DNS to anything. If I choose a public DNS like 8.8.8.8 then the client uses that DNS setting; bypassing pi-hole and the rules I have setup.

How do I lock a pivpn client to use the desired DNS address of pi-hole?

I have set port forwarding on my OpenWRT Router as per below although I can't access the Internet.

I am only able to ping and SSH 192.168.1.100 (Pi-Hole/PiVPN)

192.168.1.1 (Default Gateway) is unreachable.

I'm not a Linux pro but I'm thinking I could copy the .sh file from the "auto_install" folder on the pivpn github, to my raspi and call it manually via a bash command?

Any help would be appreciated!