How to setup a manual PF?

[Jorman]

Hi, I'm trying to make a script to obtain the port-forward but I get some difficult.
Manual setup said:

you will need to find the private IP of the gateway you are connected to. In case you are WireGuard, the gateway will be part of the JSON response you get from the server, as you can see in the bash script.

The script point to a 404 page, but when I try to get the payload the curl command won't report any, a timeout occur.
For example this's the server that I'm already connected:

  Meta Services:  156.146.41.1 milano402
  WireGuard:  156.146.41.6 milano402
  OpenVPN TCP:  156.146.41.6 milano402
  OpenVPN UDP:  156.146.41.10 milano402

I also have the token and all info about the server

--> Trying to get a new token by authenticating with the meta service...
{
    "status": "OK",
    "token": "my token"
}
OK! This token will expire in 24 hours.

--> Trying to connect to the PIA WireGuard API on 156.146.41.6...
wireguard_json -> {
    "status": "OK",
    "server_key": "server key",
    "server_port": 1337,
    "server_ip": "156.146.41.6",
    "server_vip": "10.5.128.1",
    "peer_ip": "10.5.157.46",
    "peer_pubkey": "pubkey",
    "dns_servers": [
        "10.0.0.242",
        "10.0.0.244"
    ]
}
OK!

Now the problematic part ... I want to use all these informations to get my port-forward, so I run this but I get error

curl -k "https://10.5.128.1:19999/getSignature?token=mytoken"
curl: (7) Failed to connect to 10.5.128.1 port 19999: Operation timed out

What I miss?

[g00nix]

This actually looks correct: curl -k "https://10.5.128.1:19999/getSignature?token=mytoken"

I am assuming the following:

1. after getting the JSON from the WG API, you did create a WireGuard connection (to be inspected via wg show)
2. you checked that the WireGuard connection is up by trying to ping 9.9.9.9 and maybe running curl -4 ifconfig.io to be sure you are reaching internet via VPN
3. you pinged 10.5.128.1 to make sure the address is reachable

If all of the above is true, I am not sure what might have caused the issue. Considering you already generated a token, can you please try this out?

PIA_TOKEN="the_token_you_got" \
WG_SERVER_IP=156.146.41.6 WG_HOSTNAME=milano402 \
PIA_PF=true ./connect_to_wireguard_with_token.sh

This will use the existing scripts we created to create enable PF. I think this would be a good point to start troubleshooting.

[Jorman]

Hi, thanks for your reply.
Maybe I'm on the right way but on the wrong binary!
I also tried with this piece of code inside port_forward script, but without luck

	payload_and_signature="$(curl -s -m 5 \
	--connect-to "$bestServer_WG_hostname::$SERVER_VIP:" \
	--cacert "$PIA_CERT" \
	-G --data-urlencode "token=${token}" \
	"https://${bestServer_WG_hostname}:19999/getSignature")"

First let me explain what is my condition.
I do a connection from my openwrt router, so the wg connection is already done when I try to get the port-forward, can be this the "problem"?
Maybe these are a stupid questions, but:
I've to ask the port-forward within some time like the old openvpn?
I've to ask the port-forward from the same devices that did the connection and from the same server? For example if I'm connected under milano402, can I ask the porf-forward to milano403?
I've to ask the port-forward from the same interface? I establish the connection within my router, but the default route is always my ISP, only one specific device is actually under wg connection. So, my router establish wg connection and the interface for this connection is WG0, so curl give me this

root@OpenWrt:~# curl -4 ifconfig.io
my ISP IP
root@OpenWrt:~# curl --interface WG0 -4 ifconfig.io
156.146.41.57 (wg IP)

So, to answer to your questions:

1. After a connection I can navigate and wg show show me right data

2. I've access to internet

3. If I ping it from the correct interface I get reply

Btw, I just tried a manual curl, with update data

curl --interface TEST_WG_PIA -m 5 -k "https://10.56.128.1:19999/ge
tSignature?token=mytoken"
{
    "status": "ERROR",
    "message": "Login failed!"

Now I'm getting one error!!!

J

[g00nix]

I do a connection from my openwrt router, so the wg connection is already done when I try to get the port-forward, can be this the "problem"?

You can get PF only AFTER you have a VPN connection.

I've to ask the port-forward within some time like the old openvpn?

No. As soon as you have a signature and a payload, you can bind that port any time you want. It will be active for about 20 minutes, so you should refresh it every 15 minutes. The payload+signature can be used for two months. Within those two months, you can ask for that port on any server you connect to.

I've to ask the port-forward from the same devices that did the connection and from the same server? For example if I'm connected under milano402, can I ask the porf-forward to milano403?

The port forwarding API exists on the server you connected to. This means you can access it only after creating a VPN connection. This means you can not access the PF API from milano403 if you are connected to milano402.

I've to ask the port-forward from the same interface? I establish the connection within my router, but the default route is always my ISP, only one specific device is actually under wg connection.

That might actually be the reason you are not getting a reply. Make sure you are sending a curl request to your server_vip from the correct interface. I did have similar troubles with OpenWRT in the past. We have ticket #5 for this as we are hoping to get full support for OpenWRT.

At this point, I think we should have a script just to enable port forwarding on OpenWRT, however even if we do, your case probably wouldn't be supported by the official script, as you are trying to enable split tunneling (you want some traffic to go through your ISP and other traffic to go through the PIA VPN). For split tunneling we suggest that people use the PIA apps, as it takes a lot of effort to make sure you get it right. We would love to provide support for split tunneling for manual connections for each platform, however documenting, automating and maintaining that would be impossible as there are too many platforms.

Now I'm getting one error!!!

Good, so you actually got the connection going through the correct interface. This means you manage to work through the split tunneling to contact the PF API. What you need to do now is use the same token you used to access the WG API on port 1337 to also get your signature+payload.

[Jorman]

No. As soon as you have a signature and a payload, you can bind that port any time you want. It will be active for about 20 minutes, so you should refresh it every 15 minutes. The payload+signature can be used for two months. Within those two months, you can ask for that port on any server you connect to

But first I've to request the port, then I've to rebind that port every 15 minutes, am I right?
And in these 2 months I can ask the port, within the same server that I'm connected too. But how many times I can ask for the port within 2 months with the same payload+signature? For example, I ask the port now, but for some reasons the port expire, if I ask the port again, I've to "curl and getSignature" again? So in this case I'll get another signature and another payload.

The port forwarding API exists on the server you connected to. This means you can access it only after creating a VPN connection. This means you can not access the PF API from milano403 if you are connected to milano402.

Got it, make sense

That might actually be the reason you are not getting a reply. Make sure you are sending a curl request to your server_vip from the correct interface. I did have similar troubles with OpenWRT in the past. We have ticket #5 for this as we are hoping to get full support for OpenWRT.

Yep, I know, is mine! But I've a working split tunnel already, no problem here. I'm working a script to update the connection details for openwrt, to cron it and to obtain a port-forward.
In your opinion, make sense to check if I'm connected to the "best" server, maybe, every 6 hours? Just to be sure that the server I'm connected is the low-latency one.

Two last questions:
I've to use the same token that I used for the connection or I can create a new one to request the port-forward?
I've to use the same private/public key or I can generate a different key pair every time?

I'll try again with all this information to see if that works

J

[g00nix]

And in these 2 months I can ask the port, within the same server that I'm connected too. But how many times I can ask for the port within 2 months with the same payload+signature? For example, I ask the port now, but for some reasons the port expire, if I ask the port again, I've to "curl and getSignature" again? So in this case I'll get another signature and another payload.

getSignature gives you a random port available for 2 months. You can bind it as many times as you want for 2 months. After that, you will have to ask for another random port.

In your opinion, make sense to check if I'm connected to the "best" server, maybe, every 6 hours?

There is no need for that. The latency is region-based, not server-based. So you will already be connected to the region with the best latency for you. There is no reason to change the server before it gets rebooted for upgrades (server normally get upgraded every 3 months).

I've to use the same token that I used for the connection or I can create a new one to request the port-forward?

That is your choice. You can use the same token, or get a new one.

I've to use the same private/public key or I can generate a different key pair every time?

This is again your choice. I think it depends what is more comfortable for you.

[Jorman]

Ok, but I can request the port within 2 months? So I establish a connection now and I ask for the port after 1 week? If the port is not bound for 20 minutes, I only have to ask the new port, right?

Btw I tried again, this's what I did:

1. I use the script to find out the best server
2. I use these data to generate the tokenresponse
3. I use the tokenresponse to get the wireguard_json
4. From the wireguard_json I extract all information that I need
5. I make a new connection with all the information that I've
6. I try to request a port-forward but I get the same error

I prepared a little log:

--> The closest region is Italy (italy)

The script found the best servers from the region closest to you.
When connecting to an IP (no matter which protocol), please verify
the SSL/TLS certificate actually contains the hostname so that you
are sure you are connecting to a secure server, validated by the
PIA authority. Please find bellow the list of best IPs and matching
hostnames for each protocol:

  Meta Services:  156.146.41.65 milano403
  WireGuard:  156.146.41.105 milano403
  OpenVPN TCP:  156.146.41.115 milano403
  OpenVPN UDP:  156.146.41.105 milano403

The script got started with PIA_USER and PIA_PASS,
now using the meta service to get a new VPN token.

--> Trying to get a new token by authenticating with the meta service...
{
    "status": "OK",
    "token": "mytoken"
}
OK! This token will expire in 24 hours.

--> Trying to connect to the PIA WireGuard API on 156.146.41.105...
wireguard_json -> {
    "status": "OK",
    "server_key": "server_key",
    "server_port": 1337,
    "server_ip": "156.146.41.105",
    "server_vip": "10.40.128.1",
    "peer_ip": "10.40.246.156",
    "peer_pubkey": "peer_pubkey",
    "dns_servers": [
        "10.0.0.242",
        "10.0.0.244"
    ]
}
OK!

--> Generating OpenWRT /etc/config/network settings...

config interface 'TEST_WG_PIA'
  option proto 'wireguard'
  option auto '1'
  option private_key 'private_key'
  list addresses '10.40.246.156/32'

config wireguard_TEST_WG_PIA
  option route_allowed_ips '0'
  option endpoint_port '1337'
  option persistent_keepalive '25'
  list allowed_ips '0.0.0.0/0'
  list allowed_ips '128.0.0.0/0'
  option endpoint_host '156.146.41.105'
  option description 'PIA_italy'
  option public_key 'public_key'

Press any key to resume ...
testing pf ...
----------
bestServer_WG_hostname -> milano403
----------
SERVER_VIP -> 10.40.128.1
----------
token -> mytoken

I'll curl this -> curl --interface TEST_WG_PIA -m 5 -k https://10.40.128.1:19999/getSignature?token=mytoken
{
    "status": "ERROR",
    "message": "Login failed!"
}

root@OpenWrt:~# curl --interface TEST_WG_PIA ipinfo.io
{
  "ip": "156.146.41.105",
  "hostname": "unn-156-146-41-105.cdn77.com",
  "city": "Milan",
  "region": "Lombardy",
  "country": "IT",
  "loc": "45.4643,9.1895",
  "org": "AS60068 Datacamp Limited",
  "postal": "20121",
  "timezone": "Europe/Rome",
  "readme": "https://ipinfo.io/missingauth"

I think I miss some, some very stupid ...
What do you think?

[Jorman]

Wait, we've a winner!
If I curl with curl -k "https://10.4.128.1:19999/getSignature?token=$TOKEN"
I get the error but if I curl with the payload_and_signature method that is inside port_forwarding.sh with the interface specification, this one:

	payload_and_signature="$(curl --interface $PIA_INTERFACE -m 5 \
	--connect-to "$WG_HOSTNAME::$SERVER_VIP:" \
	--cacert "$PIA_CERT" \
	-G --data-urlencode "token=${token}" \
	"https://${WG_HOSTNAME}:19999/getSignature")"

I get the payload!

[g00nix]

I get the payload!

So this means I can close this ticket? 😆

[Jorman]

Yepppppppppppppppppp

Thank you for your support!