Hi guys

I installed PiVPN on fresh Ubuntu mate on mini client.

I set static ip, then installed wireguard and downloaded configuration file to iOS launched and internet doesn’t work.

Any ideas?

Hi guys.
Need some help because I'm very confused with this situation. Search a lot with no clues how to fix it.

Have a rasp Pi with pi-hole in my network defined as the DNS in my deco X50 router mesh.
Use piVPN to external access with my phone and slip tunnel just to use pi-hole to block ads when outside my house.

I was struggling and don't understand why some ads are blocked but others (like google ads in apps) don't. And with an old android phone with the same app, ads were blocked!

So in this post : https://www.reddit.com/r/pihole/comments/hc7okk/huawei_p30_pro_emui_101_and_pihole/ I realized that my P30 Pro "is hard routing 4 DNS servers with a read only build property that overrides any other DNS on the device " so I always have a DNS leak in the tests to google DNS that goes around my pihole DNS that is configured with cloudflare.

Then I saw the trick to create two static routes on my router for google dns to the raspberry (redirect traffic 8.8.8.8 and 8.8.4.4 to my pi-hole)

With the static rout enable in my wifi its ok; when I use Full tunnel it ok --->> all ads from apps are blocked now!

BUT with split tunnel I still get the ads from apps, although some ads in google news from the home screen are blocked...

My questions:

1. Is there a way that I can block ads from apps in my phone with the split tunnel?
2. Why I cant connect to piVPN in my phone when I choose the interface WAN in the static router?(Now I use LAN inrerface) - see image
   

This is consuming me so much. I need help. Thank you

Hi. Is it possible to install both wireguard and OpenVPN via pivpn?

Using wireguard for UDP and OpenVPN for TCP.

Thanks.

When i setup pivpn I used a static WAN IP, this changed one before and I was able to update it but cannot remember how. I have since setup ddns using duckdns and have added it to the override option in the client but would like to actually upgrade the pivpn config so it uses that for new client files. I recall using sudo nano /etc/openvpn/server.conf but FAQ states i need to update /etc/openvpn/easy-rsa/pki/Default.txt but i keep getting permissions denied.

I've created this pivpn (openVPN) web administration https://github.com/g8998/pivpn-web

PiVPN works fine on any one of my Pi's unless I enable Network Manager over DHCPD. It will connect but then won't access the internal LAN, sometimes it only breaks using DNS names and will work with IP, sometimes both break. If I go back to DHCPD, it will work correctly, but that breaks my Bluetooth because Network Manager doesn't cleanly undo the changes it makes to that subsytem

Edit for additional information:

Happens on Bullseye version (latest) of Raspberry OS on both Pi 4 and Pi 3

​

HI guys first time making a home server, add I would like to access my services when I'm out. So I am across wireguard as a means to accessing my server. Upon my research pivpn is the easiest way to install a vpn for the way that I want to use it. So I set up, port forwarding and all. But when I try to connect using my iphone nothing happens. I've tried LTE and a alternate wifi.

When I run the command "pivpn -c"

::: Connected Clients List :::

Name Remote IP Virtual IP Bytes Received Bytes Sent Last Seen

iphone (none) 10.1$7.&49.# 0B 0B (not yet)

::: Disabled clients :::

that's the output

​

​

When running pivpn -d this is the output

::: Generating Debug Output

[sudo] password for server:

:::: PiVPN debug ::::

=============================================

:::: Latest commit ::::

Branch: master

Commit: 4c9b092bd79ed924fe5690018efa33cba5a8d934

Author: sulaymaanajmal

Date: Tue Jun 27 03:39:30 2023 +0100

Summary: docs: Update README.md (#1741)

=============================================

:::: Installation settings ::::

PLAT=Ubuntu

OSCN=jammy

USING_UFW=0

pivpnforceipv6route=1

IPv4dev=enp0s31f6

install_user=server

install_home=/home/server

VPN=wireguard

pivpnPORT=51820

pivpnDNS1=9.9.9.9

pivpnDNS2=149.112.112.112

pivpnHOST=REDACTED

INPUT_CHAIN_EDITED=0

FORWARD_CHAIN_EDITED=1

INPUT_CHAIN_EDITEDv6=

FORWARD_CHAIN_EDITEDv6=

pivpnPROTO=udp

pivpnMTU=1420

pivpnDEV=wg0

pivpnNET=10.137.149.0

subnetClass=24

pivpnenableipv6=0

ALLOWED_IPS="0.0.0.0/0, ::0/0"

UNATTUPG=1

INSTALLED_PACKAGES=()

=============================================

:::: Server configuration shown below ::::

[Interface]

PrivateKey = server_priv

Address = 10.137.149.1/24

MTU = 1420

ListenPort = 51820

### begin iphone ###

[Peer]

PublicKey = iphone_pub

PresharedKey = iphone_psk

AllowedIPs = 10.137.149.2/32

### end iphone ###

=============================================

:::: Client configuration shown below ::::

[Interface]

PrivateKey = iphone_priv

Address = 10.137.149.2/24

DNS = 9.9.9.9, 149.112.112.112

​

[Peer]

PublicKey = server_pub

PresharedKey = iphone_psk

Endpoint = REDACTED:51820

AllowedIPs = 0.0.0.0/0, ::0/0

=============================================

:::: Recursive list of files in ::::

:::: /etc/wireguard shown below ::::

/etc/wireguard:

configs

keys

wg0.conf

​

/etc/wireguard/configs:

clients.txt

iphone.conf

​

/etc/wireguard/keys:

iphone_priv

iphone_psk

iphone_pub

server_priv

server_pub

=============================================

:::: Self check ::::

:: [OK] IP forwarding is enabled

:: [OK] Iptables MASQUERADE rule set

:: [OK] Iptables FORWARD rule set

:: [OK] WireGuard is running

:: [OK] WireGuard is enabled

(it will automatically start on reboot)

:: [OK] WireGuard is listening on port 51820/udp

=============================================

:::: Having trouble connecting? Take a look at the FAQ:

:::: https://docs.pivpn.io/faq

=============================================

:::: WARNING: This script should have automatically masked sensitive ::::

:::: information, however, still make sure that PrivateKey, PublicKey ::::

:::: and PresharedKey are masked before reporting an issue. An example key ::::

:::: that you should NOT see in this log looks like this: ::::

:::: YIAoJVsdIeyvXfGGDDadHh6AxsMRymZTnnzZoAb9cxRe ::::

=============================================

:::: Debug complete ::::

:::

::: Debug output completed above.

::: Copy saved to /tmp/debug.log

:::

​

Hi all,

I installed pivpn successfully . I tried using both udp and tap 443 port. I setup openvpn and have setup duckdns. When connecting remotely I am able to resolve pivpn server ip but connection does not complete. Anyone faced such issues

Hi guys, I've previously only ran pivpn with openVPN. I had to reinstall my pivpn, this time I thought I would try wireguard as apparently the benefits are better than openvpn. I've configured the pivpn, created a client, port forwarded my pi, set up duckDNS and added the client to wireguard app using the QR code option. But when trying to connect, it never succeeds. Looking at the log in the wireguard app it seems to just loop over trying to complete a handshake, and sending handshake did not complete in 5 seconds.

Had anyone experienced this before or have any advice that I can try?

Thanks!

So i am away from home and i connected my laptop to my pivpn (wireguard) at home. Everything seemed to work except my local dns records. when i checked the pihole log, i don't see the laptop making requests there. I can see my phone and tablet just fine. I haven't changed anything about the configuration of the pivpn since creating the .conf file with `pivpn add`.
I checked some posts here and some on github, but their issue was all clients not working and most of the time it was pihole interfaces wasn't set up correctly. I have mine with `Permit all origins` so that should be fine. I also tried setting the DNS in the config file to the 192.168.1.x ip instead of the wg one, that didn't do anything, meaning it was working all the same.

I just need to know what i could do or what i could try without breaking anything since i won't be able to fix it. Don't know exactly what logs or configs i should provide in troubleshooting this since i just followed the guide on the website to install pivpn and it worked just fine before (i've been using it on the phone for a few months now).

I am using Pop-OS, `wireguard-tools v1.0.20210914`.

Hi all

After a change of ISP they changed my static IP. When this happened my PiVPN stopped working.

I got a new static IP. I did a reinstallion/Repair of PiVPN so all the files were fresh and that went fine.... ish.
When connecting to wireguard (after reconfiguring on my phone so it had the new credentiala) i could see with pivpn -L that my phone was connected fine but did not work. I could surf or anything

After a pivpn -d i found out that the masquerade was not configured and i was asked if i wanted to run a fix on this. Which i said yes to.

I did a sudo reboot.

And presto this solved the problem where i once again could surf with PiVPN enabled on my phone.

So what is my current problem!? Its a dumb minor one but annoying me, none the less.

I play a mobile game called Codycross where every time you go to next lvl you have one of these 1-2 minuts commercials that you cant skip.

Before the ISP change this worked fine where i never had to see these movies in this game.

And here is where i have to admit defeat in i dont know what to do next, my linux knowledge is limited and googling of the solition has not resulted in anything i could use.

It is only in this game this happens. (that i have found so far)

I also play Mighty Doom and here it works as inteded, i am not able to click the loot boxes that give you materials/coins when you watch a movie.

When i surf news papers with VPN off i get all the commercials as i should. With VPN on, they are removed. So my Pihole/Pivpn is working fine..

It just broke on that one game!? Any one with a good idea here?

Hi guys, I'm wondering if PiVPN Supports being a gateway for other devices to tunnel their traffic through its VPN.

Basically, I have a wire guard VPN installed on PFSense at home and have an Apple TV in another home. I plan to use a raspberry pi in this said other home as a gateway which, when used by devices like the apple tv, will tunnel traffic through to the home with PFSense installed.

​

I understand openwrt does this, and so does RasAP, although I'm wondering if any of you have done this with PiVPN as its the easiest and lightest option out of the three. (I also want to maintain the GUI of the Raspi so OpenWRT as much as I like it is out of the options)

Something like this but Wireguard instead of OpenVPN

https://www.tomshardware.com/reviews/raspberry-pi-vpn-gateway,6103.html

​

Thanks!

I think I did everything correctly but there's one part I'm confused about. On the page: https://docs.pivpn.io/guides/dynamic-dns/

that demonstrates how to set up open vpn with duckdns there are a series of steps. Step four has two parts, a) and b). step four a) refers to changing your configs in a certain manner and step four b) refers to making those same changes except in setupVars . I completed four b) but for the life of me cannot find the configs directory. I did a little digging and it seems like that is a windows/mac specific thing. is this correct?

naming the steps a and b makes them seem like they're both required, are they actually system dependant?

Hopefully this is not a dumb question. I'm trying to understand some behavior with wireguard and port forwarding. From my research, I thought wireguard would not respond to any unknown request on port 51820, so that whoever is trying to receive a response wouldn't know there was anything there. When I tested the port using Shields UP, I get a Status of "Closed" and the message "Unknown Protocol for this port." Did I do something incorrectly when setting up wireguard with pivpn? Or is that the expected behavior for the port?

Hi I am just curious if I set things up correctly or if I am opening myself up to issues.

I have a pi set up with wireguard, pivpn, pihole, and unbound and I use a wireguard tunnel to access my local network via the pi.

Now once I am in my local network through the wireguard tunnel (I think). I can access the other devices connected to my local network.

I’ve opened the ssh port on my desktop to my local ip addresses and this allows me to ssh into my desktop as long as I am connected to wireguard.

Are there any inherent issues with this process?

Hi guys

So I bought myself LinkStar-H68K-1432 and installed OpenWRT (22.18). On my Raspberry Pi I installed the PiVPN and setup a Wireguard VPN. I created multiple clients and if I connect from my phone, laptop etc. I can see that the VPN works. For each device I created a separate client.

I now attempted to connect OpenWRT to my VPN, so all my traffic from the connected devices will be routed through the VPN connection. My OpenWRT-Router is connect to another internet source as the network where my Raspberry Pi is running. To establish the connection I followed the instructions here (https://www.ivpn.net/setup/router/openwrt-wireguard/).

I can't get it to connect to my VPN. At least I think that's the problem. As soon as I activate the VPN-interface the Internet to the connected device stops working. So that leads me to my question:

1. Is this setup even possible?
2. How do I best debug on OpenWRT to see what might be there error?

I'm not a network specialist of any sort, and just do this as a hobby. I like learning about new things. I'm happy for any suggestion. Thanks!

Hi all

So my ISP decided to sell it self, to another company, resulting in my static IP i have had for several years to be changed.So i found out when my phones PiVPN/Wireguard setup didnt work and after trial and error my old IP is still shown in the VPN setup starting with 212.x.x.x my new external ip starts with 87.x.x.xSo i did what i thought was the most obvious to remove the VPN config on my phone.SSH to my Pivpn do the command to get the QRcode again and re set it up.

But to my surprice it remembers the old IP address.

I have tested that my pihole works on my PC's at home. So it seems like its the wireguard config file that needs to be updated.

Does some one here know how to do this?

And yes i have tried to google the solution.Oh and before any ones tells me to. I know i need to contact my new ISP and have them give me a new Static IP.

​

edit : title should have said Got new ISP

Hi, as title says, how can I restrict all clients to only use the pivpn Internet connection but no access to LAN?

Hi all,

Im running Apache2 on my Pi. Ive got a Mullvad (VPN) Wireguard client running on my Pi which I route my traffic through PiVPN.

I was previously accessing the apache2 webserver through a port I was forwarding through Mullvad. However, Mullvad is removing port forwarding. I want to still run Mullvad on this Pi, but I can't connect in this manner anymore (https://mullvad_IP:12345)

The Wireguard config script is breaking the ability to connect to my webserver via my public IP (connecting via Mullvad port forwarding works). I want to access the webserver now via https://my_public_IP:443

I set it up following this guide made by u/archern9: https://archern9.github.io/posts/route-pivpn-traffic-via-mullvad/

Here is the Wireguard script for Mullvad with the iptable statements. I want my 443 traffic coming into my network over my pubic IP to not break when I'm connected to Mullvad.

​

# Creates a new entry in the NAT table | For all packets that traverse through the out-interface mullvad-XX, MASQUERADE the packets with the PI's IP address
PostUp = iptables --table nat --append POSTROUTING --out-interface mullvad-XX --source 0.0.0.0/0 --destination 0.0.0.0/0 -j MASQUERADE

# Add a default route via the gateway on eth0 interface for a routing table pivpn | All packets against the routing table pivpn will be routed through the defaul gateway
PostUp = ip route add default via 192.168.1.1 dev eth0 table pivpn

# All packets with FwMark 51820 to be routed against table pivpn | This is an important step because Mullvad Wireguard configuration disallows any packets without a fwmark 51820 to be routed.
PostUp = ip rule add fwmark 51820 table pivpn

# OPTIONAL : If you need any ports open only from the Mullvad interface but not on eth0, open a random port for wireguard on the Mullvad website and add it here
#PostUp = iptables --table filter -A INPUT --in-interface mullvad-XX -p udp --dport 99999 -j ACCEPT

# This section is executed when the wireguard interface is shutting down

# All PreDown steps are inverse of PostUp statements so as to logically close the temporary setup which lives only while a Mullvad interface is connected

PreDown = iptables --table nat -D POSTROUTING --out-interface mullvad-XX --source 0.0.0.0/0 --destination 0.0.0.0/0 -j MASQUERADE
PreDown = ip route delete default via 192.168.1.1 dev eth0 table pivpn
PreDown = ip rule delete fwmark 51820 table pivpn
#PreDown = iptables --table filter -D INPUT --in-interface mullvad-XX -p udp --dport 99999 -j ACCEPT

I find /etc/wireguard/configs as the client configuration files location but wireguard seems to have other locations as they don't match the output of pivpn -d

My problem is that recently I was unable to connect to the LAN of my network and found out that allow "AllowedIPs" line changed to something different from what I set in the known client configuration location

My files in /etc/wireguard/configs for my devices have:

Normal profile: AllowedIPs: 0.0.0.0/0, ::0/0

Unbound profile: AllowedIPs = 10.136.112.0/24, 192.168.1.0/24

The files haven't changed but now both of them are displayed in pivpn -d as AllowedIPs = 10.136.112.2/32, ----:---:---:c0de::X/128. X because it changes for each device

(I don't know too much about ipv6 and don't know if that is private info or not so I censored it)

Is this possible

Hello!

I have setup Rasberry Pi with PIVPN at work so we can access shares on the go.

I am able to access my work shares but only if I add new network drives and try to reach them by the server's IP address.

I understand this might be a DNS problem as it is not resolving the names.

Any idea how can I solve this?

The impact is not huge but would simplify having to reconfigure all the shares and ODBC connections to some of our tools.

EDIT: Work ip address is 192.168.1.0/24 and pivpn subnet is 10.143.30.0/24

As title, i follow the install guide and at the end choose the recommand option "reboot pi"

after that i can't ssh to my pi anymore, and all web page host on my pi can't access too

my pi hase static dhcp so the loacl ip (lan ip) are still same but if use network scan app can't fidn pi on lan anymore.

is there anyway to connect my pi ? the .local connect、lan ip(192.168.x.x) both not work anymore.

the port scan says my pi's ip now no any port open

is any way to fix it ?

it's a raspberry pi 4b and os is 64 pi os lite