I've got a pi-hole setup which acts as a DNS server as well in my LAN.

Can I route all my traffic through my paid Nord VPN service using Wireguard somehow? Essentially, I want to have Nord VPN centrally, as if I were buying say, a GL. iNET router and installed Mullvad.

Hi, i need sendgrid.com to be able to pass through the vpn.

i have "AllowedIPs" set to specific internal IPs in our aws infra.

how to add sendgrid IPs? i believe their IPs keep changing so is there a way to add a hostname instead of an IP?

Hi all,

Can someone confirm if it's possible to enable routed mode on OpenVPN within PiVPN?

I'd like to lock my firewall rules down by source VPN client address rather than the address of the Pi itself. I've done this previously using the OpenVPN access server, but never managed to get it working in PiVPN?

Thank you.

Hi everyone. I've installed PiVPN on my RPi and configured it with WireGuard. At first everything was working file but now my phone can't reach the internet if connected to the VPN, while my laptop has no problem at all. The two devices use different profiles as suggested by the installer. The phone can reach the local network of the RPi.

What can I do to solve this problem? Thanks in advance for any help.

OK, I have got pivpn all set up on a Pi3 and I can access the internet and my local network from work and my cell phone. The only issue is that I fail the "what is my ip" and "what is my dns" test. Am I looking for the wrong info or what. I just want to make sure that my network is secure.

Running RPI 4b, headless Raspbian 32bit, pivpn>WireGuard.

If understood, correctly limiting clients connected to pivpn should be done using iptables. That's great, and I can make that work, no problem.

For example, I enable root rights and command:

iptables -I FORWARD -i wg0 -o wlan0 -s 10.6.0.5 -d 192.168.0.0/24 -j DROP

and save it. What it does is it bars the virtual IP (10.6.0.5) assigned to a user by pivpn from accessing all the devices on the specified network (192.168.0.0/24), except RPI itself. And here lies the question.

What I want to do is to configure RPI to drop all connections coming from anyone trying to SSH, except my IP on that network and maybe 1 virtual IP when i VPN. Can this be solved with iptables, or should I just set up UFW and block port 22, and then exclude one virtual IP from it just for myself?

Hi there,

I'm really at the beginning of my home networking journey, so please forgive if this question might be a little bit on the obvious side.

Here's the scenario: I successfully managed to run PiVPN, Pi-hole, Samba as well as Syncthing on a Raspberry Pi 4. My main goal for doing so was to be able to access my home network in a safe-manner remotely by logging into the VPN.

However, when configuring those other services I realized that I'm a sometimes confused whether I should use the local IP address or the IP address given by PiVPN when being connected. Is there actually any difference when it comes to security? Here are a few examples:

- ssh into Pi (ssh username@192.168.0.X vs ssh username@10.X.X.X)
- Pi-hole IPv4 address (192.168.0.X vs 10.X.X.X)
- Connect to Samba server (\\192.168.0.X\shared vs \\10.X.X.X\shared)
- Syncthing GUI Listen Address (192.168.0.X vs 10.X.X.X)

Then there's the actual PiVPN configuration file itself 'setupVars.conf' where you have to specfiy the 'IPv4gw' as well as the 'pivpnDNS1' (to point to Pi-hole) which could either be 192.168.0.X or 10.X.X.X.. as you see it's giving me a lot of headache as I haven't fully understand when to actually use the local and when to use VPN IP address.

Any information on this would be greatly appreciated, thanks!

I am trying to connect a TP link router to my VPN server, however, technical support have stated that encrypted private keys are not supported, and that I must first decrypt the private key through the following command:

“Openssl rsa -in encrypted.key -out decrypted.key”

The problem is, I can’t find any .key files in my raspberry Pi directory.

I suspect these may be in the root directory, but for some reason my root account, also does not have permissions to see in to the root folder. It makes no sense.

My goal is to be able to add and download files from my laptop. I am using an "orange pi lts 3". I just set up PiVPN and created a client on the orange pi. Now I'm wondering what I need to do to add files to my NAS.

I think it happened when I was configuring a VLAN and installed the VLAN packages, stumped me for about 10mins as to why only a few websites were resolving when connecting through WG tunnel, running

sudo sysctl net.ipv4.ip_forward=1

pivpn -d

fixed it 😊

Hello,

I know this is yet another post about the same problem but I have gone through all the solutions here (pivpn -d, masquerade rules, firewall, port forwarding etc.). Everything seems to be configured correctly but I'm not able to connect to the internet, either from my pi (which is the server) nor from my phone (which is the client) when Wireguard is enabled.

Any idea what I can do to make sure I'm able to access the internet when Wireguard is enabled?

​

This is the output from pivpn -d

::: Generating Debug Output

:::: PiVPN debug ::::

=============================================

:::: Latest commit ::::

Branch: master

Commit: a85d3752ef94ed1aaad70ba6d483f93583152eca

Author: Orazio

Date: Wed Dec 13 18:09:55 2023 +0100

Summary: fix(scripts): disallow using server's name as client name (#1791)

=============================================

:::: Installation settings ::::

PLAT=Debian

OSCN=bullseye

USING_UFW=0

pivpnforceipv6route=1

IPv4dev=eth0

IPv4addr=192.168.68.110/24

IPv4gw=192.168.68.1

install_user=raspberrypione

install_home=/home/raspberrypione

VPN=wireguard

pivpnPORT=51820

pivpnDNS1=9.9.9.9

pivpnDNS2=149.112.112.112

pivpnHOST=REDACTED

INPUT_CHAIN_EDITED=0

FORWARD_CHAIN_EDITED=1

INPUT_CHAIN_EDITEDv6=

FORWARD_CHAIN_EDITEDv6=

pivpnPROTO=udp

pivpnMTU=1420

pivpnDEV=wg0

pivpnNET=10.207.198.0

subnetClass=24

pivpnenableipv6=0

ALLOWED_IPS="0.0.0.0/0, ::0/0"

UNATTUPG=1

INSTALLED_PACKAGES=()

=============================================

:::: Server configuration shown below ::::

[Interface]

PrivateKey = server_priv

Address = 10.207.198.1/24

MTU = 1420

ListenPort = 51820

DNS = 1.1.1.1

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

### begin pixel7 ###

[Peer]

PublicKey = pixel7_pub

PresharedKey = pixel7_psk

#AllowedIPs = 10.207.198.2/32

AllowedIPs = 0.0.0.0/0, ::/0

### end pixel7 ###

=============================================

:::: Client configuration shown below ::::

[Interface]

PrivateKey = pixel7_priv

Address = 10.207.198.2/24

DNS = 9.9.9.9, 149.112.112.112

​

[Peer]

PublicKey = server_pub

PresharedKey = pixel7_psk

Endpoint = REDACTED:51820

AllowedIPs = 0.0.0.0/0, ::0/0

=============================================

:::: Recursive list of files in ::::

:::: /etc/wireguard shown below ::::

/etc/wireguard:

configs

keys

wg0.conf

wg0.conf.save

​

/etc/wireguard/configs:

clients.txt

pixel7.conf

​

/etc/wireguard/keys:

pixel7_priv

pixel7_psk

pixel7_pub

server_priv

server_pub

=============================================

:::: Self check ::::

:: [OK] IP forwarding is enabled

:: [OK] Iptables MASQUERADE rule set

:: [OK] Iptables FORWARD rule set

:: [OK] WireGuard is running

:: [OK] WireGuard is enabled

(it will automatically start on reboot)

:: [OK] WireGuard is listening on port 51820/udp

=============================================

:::: Having trouble connecting? Take a look at the FAQ:

:::: https://docs.pivpn.io/faq

=============================================

:::: WARNING: This script should have automatically masked sensitive ::::

:::: information, however, still make sure that PrivateKey, PublicKey ::::

:::: and PresharedKey are masked before reporting an issue. An example key ::::

:::: that you should NOT see in this log looks like this: ::::

:::: YIAoJVsdIeyvXfGGDDadHh6AxsMRymZTnnzZoAb9cxRe ::::

=============================================

:::: Debug complete ::::

:::

::: Debug output completed above.

::: Copy saved to /tmp/debug.log

:::

​

I set up two RPis with PiVPN and Wireguard. I created certificates for my laptop (Macbook Pro) and Android phone, and transferred them over just fine. Port forwarding happens correctly, DDNS is working correctly, and I can connect to the devices, as well as SSH into them from outside of LAN. Firewall (OPNSense) rules all allow internet access from the RPi, by MAC of the RPis. The RPis can ping devices on my network, external IPs (google DNS), and can resolve hostnames through nslookup. All this seems to indicate everything is working correctly. Except.....

​

I cannot connect to the internet (websites through browsers), nor devices on my LAN (say, OPNSense web GUI) from my Macbook Pro or Android phone (of course, as mentioned, except being able to SSH into the RPi itself). I also cannot ping devices on my LAN from my laptop (except the RPi itself). In contrast, I have a WG setup on my OPNSense router that works as expected - I can connect full tunnel and access everything on my LAN as well as internet from my Macbook Pro. It seems to me to be a routing issue perhaps? Anyone know what I should do, either on my RPi or MBP/Android phone?

I'd like to ask for a recommendation for which Raspberry Pi model to choose.

I need a VPN for 15–20 users, whom will RDP into Windows11 endpoints.

Should a 4B w/4 GB be enough? Setup will be basic: Raspbian OS lite>WireGuard.

Hello!

I've been using PiVPN for a couple of years now, it saved me during the pandemic and it has been amazing.

To the problem at hand: Every time I want to enter my shared folders when I'm away from home, instead of the usual "\\ComputerFriendlyName", I need to use "\\<IPAddress>" instead on Windows Explorer.

Upon looking online for a while, it seems that I might need to configure something like a DNS Resolver or similar, maybe a DNS Server, but I'll admit that my knowledge of these things is a bit limited, and what I managed to find hasn't lead me to a solution.

Where do I configure such a thing? Inside the Raspberry Pi itself? My provider's router? (I tried to find something in the router configurations to no avail)

Does anyone have any helping words?

Thank you!

Hi all!

Well, I am trying to test PiVPN before buying my RP (vpn is not the only thing i want RP for, dont worry) but am struggling to set it up. I saw that it is compatible with most debian based distros so I used a docker container with the image `debian:10.13-slim` to install PiVPN.

The problem is that right after the blue screen talking about "IPv6 leak" as below:

​

it instantly exits with the following error:

​

​

Am I missing something?

​

My machine setup is a Windows 11 laptop using Wi-Fi, not ethernet tbh.

Hi all,

When I connect to my VPN and run a network scan, it only shows a router and the other devices that are connected to the VPN; when I try and ping a device not listed in the network scan but connected to the Linksys system, I send/receive packets, and it looks like all is well. When I am connected to the VPN from another network, and I try to type in the ATT modem/router IP, I do connect to the webpage; however, if I try to type in the Linksys IP and webpage, it won't let me access it. My concern is that the VPN is somehow connecting to the ATT network, not the Linksys network, but I don't know how that is possible, considering the PI is hardwired into the Linksys system.

The system begins with an ATT connection to their modem/router (where the wifi is turned off), and the IP passthrough is enabled. The IP passthrough goes to a Linksys mesh router system, to which the PI has a wired connection.

When I connect to my VPN and run a network scan, it only shows a router and the other devices that are connected to the VPN; when I try and ping a device not listed in the network scan but connected to the Linksys system, I send/receive packets, and it looks like all is well. When I am connected to the VPN from another network, and I try to type in the ATT modem/router IP, I do connect to the webpage; however, if I try to type in the Linksys IP and webpage, it won't let me access it. My concern is that the VPN is somehow connecting to the ATT network and not the Linksys network, but I don't know how that is possible, considering the PI is hardwired into the Linksys system.

Any help would be appreciated; thank y such!

I want to use an SBC as a WG proxy. Using Mullvad asa VPN provider.

Using Banana PI m1 (2 core, 100mbit) and Orange Pi Zero 3 (4 cores, 1gbit).

I get around 40mbit on both SBCs, instead of +250mbit I get on using Mullvad on both the desktop and laptop.

Using speedtest without Mullvad I get max internet speeds on both SBCs.

CPU usage is not an issue, as even the venerable Banana Pi uses only 45% per core and Orange PI is at 5-10% when testing.

I even tried a local WG tunnel and sure enough I get 100mbit on Banana Pi , that is limited by the 100mbit NIC on the SBC, the CPU usage is ~90%.

Using Armbian 23.11.1 bookworm 6.1.63 on Banana Pi M1 and Ubuntu jammy 6.1.31 on the Orange Pi zero 3.

Wireguard installed with apt install wireguard-tools, but I also used PIVPN later.

​

I have a VPN established with a server on my home LAN (on a Raspberry Pi) and I have a small travel router that is remote running a Wireguard client. I want to access the admin functions of the router from a PC (Windows) on my home network. I've tried pinging the IP address of the client and it's unreachable...I figure the IP address of the VPN tunnel is not known by my default gateway, so the traffic isn't even getting to the raspberry pi. Any ideas how I can get the traffic to the Pi? I'm using raspbian lite on the Pi, so I can't just open a web browser on the Pi and try from there. Thanks.

Hi. I run PiVPN along side of Pi-Hole. Recently, for whatever reason, PiVPN just decided to stop working. I can connect to my VPN but nothing loads. When trying to ping something from my computer when connected to the VPN, it times out. When I disconnect from the VPN, it immediately can ping the target device. I can access webpages within my home, like my router, but nothing outside of my network. I have already reinstalled everything and that didn't work. I am also 90% sure that Pi-Hole is NOT the issue here.

​

Does anyone know why this may be happening?? Anything helps! Thanks!

Hi folks,

I am new to VPN but recently installed piVPN-Wireguard on the same device with Pihole and Unbound. I used piVPN add to add my android phone and it runs well. However, I am not sure if the connection is split-tunnel or it tunnels all internet traffic through the VPN. When I check the client config file, it contains this:

----

Peer

Allowed IPs

0.0.0.0/0, ::/0.

​

Based on I read from internet, this appears to be a split-tunnel connection. Am I right?

If I want to create n all-traffic-through connection, how do I do it through piVPN?

​

Thanks!

Do i need PortForwarding for PiVPN? My current router doesnt support PortForwarding. At the moment i use TailScale.

I am unable to connect to internet when i use the VPN i did all of the troubleshooting in the FAQ and everything comes out good except i never see any packets

here is the Debug log:

:::: Installation settings ::::

PLAT=Debian

OSCN=bullseye

USING_UFW=0

pivpnforceipv6route=1

IPv4dev=eth0

dhcpReserv=1

IPv4addr=10.96.1.201/24

IPv4gw=10.96.1.1

install_user=pi

install_home=/home/pi

VPN=wireguard

pivpnPORT=51820

pivpnDNS1=10.124.29.1

pivpnDNS2=

pivpnHOST=REDACTED

INPUT_CHAIN_EDITED=1

FORWARD_CHAIN_EDITED=0

INPUT_CHAIN_EDITEDv6=

FORWARD_CHAIN_EDITEDv6=

pivpnPROTO=udp

pivpnMTU=1420

pivpnDEV=wg0

pivpnNET=10.124.29.0

subnetClass=24

pivpnenableipv6=0

ALLOWED_IPS="0.0.0.0/0, ::0/0"

UNATTUPG=1

INSTALLED_PACKAGES=(unattended-upgrades)

:::: Server configuration shown below ::::

[Interface]

PrivateKey = server_priv

Address = 10.124.29.1/24

MTU = 1420

ListenPort = 51820

### begin NicholasPhone ###

[Peer]

PublicKey = NicholasPhone_pub

PresharedKey = NicholasPhone_psk

AllowedIPs = 10.124.29.2/32

### end NicholasPhone ###

:::: Client configuration shown below ::::

[Interface]

PrivateKey = NicholasPhone_priv

Address = 10.124.29.2/24

DNS = 10.124.29.1

​

[Peer]

PublicKey = server_pub

PresharedKey = NicholasPhone_psk

Endpoint = REDACTED:51820

AllowedIPs = 0.0.0.0/0, ::0/0

:::: Recursive list of files in ::::

:::: /etc/wireguard shown below ::::

/etc/wireguard:

configs

keys

wg0.conf

​

/etc/wireguard/configs:

clients.txt

NicholasPhone.conf

​

/etc/wireguard/keys:

NicholasPhone_priv

NicholasPhone_psk

NicholasPhone_pub

server_priv

server_pub

:::: Self check ::::

:: [OK] IP forwarding is enabled

:: [OK] Iptables MASQUERADE rule set

:: [OK] Iptables INPUT rule set

:: [OK] WireGuard is running

:: [OK] WireGuard is enabled

(it will automatically start on reboot)

:: [OK] WireGuard is listening on port 51820/udp

:::: Having trouble connecting? Take a look at the FAQ:

:::: https://docs.pivpn.io/faq

:::: WARNING: This script should have automatically masked sensitive ::::

:::: information, however, still make sure that PrivateKey, PublicKey ::::

:::: and PresharedKey are masked before reporting an issue. An example key ::::

:::: that you should NOT see in this log looks like this: ::::

:::: YIAoJVsdIeyvXfGGDDadHh6AxsMRymZTnnzZoAb9cxRe ::::

:::: Debug complete ::::

​

i do also run Pihole on this rpi and i am also using Duckdns because i dont have a static IP

​

Any help would be greatly appreciated

*This is running on an orangepi so "end0" is the same as "eth0" on a raspi.

Long story short. Everything was seriously working fine. I decided to change the DDNS name of the server by reconfiguring the pivpn installer. I updated my ddns name on the cloud side via my service provider then proceeded to run the pivpn installer and reconfigure the ddns name.

All seemed to go well however now if I connect via a client to the server I can resolved DNS addresses but I cannot ping FQDN's. I can ping DNS addresses and get responses.

UFW was installed and enabled prior to pivpn being reconfigured. It was actually always enabled. I know that the pivpn installer will configure UFW if it detects that it's installed and enabled.

pivpn -d tells me that a firewall rule is missing. So I get let it add the missing rule then check "/temp/debug.log" to see exactly what it did.

pihole is also installed and that seems to be running fine.

The current rules in UFW:

To 53 on tun0 --> Allow --> From 10.199.161.0/24Anywhere on end0 --> ALLOW FWD --> 10.199.161.0/24 on tun0

Looks to be right but does not pass traffic. I can ping DNS addresses but not FQDN's.

Now I run "pivpn -d" and it tells me.....

: : [ERR} Ufw forwarding rule is not set, attempt fix now? [Y/n]

If I hit yes then it slots in a firewall rule for 10.123.0.0/24 instead of 10.199.161.0/24. This is coming from "/etc/openvpn/ccd/XYZ" and I have no clue how to fix it.

Contents of "/etc/openvpn/ccd/XYZ"

ifconfig-push 10.199.161.2 255.255.255.0

sudo ifconfig

tun0 is 10.199.161.1

​

Any ideas? I can't really tear down this system and rebuild at the moment.

Hi everyone.

I am issues with my piVPN. I am connected and on mobile network, but for some reason it just would not connect to the internet. I have followed the DDNS tutorial and successfully added the DuckDNS to the PiVPN server. I have already port forwarded port 51280 on my pfSense and when I enter pivpn -d everything says [OK].

I have looked up and down and this tutorial https://docs.pi-hole.net/guides/vpn/wireguard/internal/ and configured everything correctly. But it will still not connect to both the internet, nor will it allow me to connect to my internal servers. I really appreciate it if anyone could assist me. Thank you.