What boards/OSes does PiVPN support?
PiVPN runs at least on the following boards:
- Raspberry Pi 1/2/3/4 running Raspbian Stretch, Raspbian Buster Lite.
- All SBC's running DietPi. This is currently: Odroid C1, Odroid C2 (arm64), Odroid XU3/4, Pine A64, NanoPi NEO, NanoPi NEO Air, NanoPi M1, Nan>
- Most servers running a Debian or Ubuntu based distro.
What About Octopi?
https://github.com/guysoft/OctoPi/issues/373 OctoPi doesn't play well with PiVPN installer as they use a git wrapper that blocks it from running as root user. To disable the git wrapper please do:
sudo rm /root/bin/git
You can install from test branch via
curl -L https://test.pivpn.io | TESTING= bash
You can run the PiVPN installer from within scripts using the
--unattended command line option provided with a .conf file. You can find examples here.
curl -L https://install.pivpn.io > install.sh chmod +x install.sh ./install.sh --unattended options.conf
It's not required to specify all options. If some of them are missing, they will be filled with defaults or generated at runtime if it can be done unambiguously. For example if you have just one network interface, such interface will be used but if you have more, the script will stop.
If not specified,
IPv4gw default to the current network settings,
pivpnHOST to the public IP,
pivpnSEARCHDOMAIN to empty. Rest of the default options are in the examples.
The options provided must make sense in relation to each other, for example you can't use
Latest changes into master branch?
To know what has changed in the master branch read: https://github.com/pivpn/pivpn/blob/master/LatestUpdate.md
My ISP doesn't give me a static external IP address, so my servers IP address keeps changing!
You will need a dynamic DNS service and a hostname. If your IP address changes, your hostname will then automatically point to the new IP address. Some free dynamic DNS services are http://noip.com, http://freedns.afraid.org/ or https://www.duckdns.org/.
Refer to: https://help.dyn.com/ddclient/
apt-get install ddclient
and then this is my example conf in /etc/ddclient.conf
# Configuration file for ddclient generated by debconf # # /etc/ddclient.conf ssl=yes protocol=dyndns2 use=web, web=checkip.dyndns.com, web-skip='IP Address' server=members.dyndns.org login=username password='password' mydyn.domain.com
If you use a namecheap domain your ddclient setup can be found here.
OpenVPN Technical Information
Info on TLS
'Modern' OpenVPN (2.x, using the TLS mode) basically sets up two connections:
The 'control channel'. This is a low bandwidth channel, over which e.g. network parameters and key material for the 'data channel' is exchanged'. OpenVPN uses TLS to protect control channel packets. The 'data channel'. This is the channel over which the actual VPN traffic is sent. This channel is keyed with key material exchanged over the control channel. Both these channels are duplexed over a single TCP or UDP port.
--tls-cipher controls the cipher used by the control channel. --cipher together with --auth control the protection of the data channel.
And regarding security, OpenVPN uses encrypt-then-mac for its data channel, rather than mac-then-encrypt like TLS. All the CBC-related issues you hear about are due to the combination mac-then-encrypt + CBC. This means that AES-CBC for the data channel is perfectly fine from a security perspective.
(And there is no GCM support for the data channel yet. That will arrive in OpenVPN 2.4.)
If I wanted to specify ciphers, this is the list I'd use (I think):
TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384 TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384 TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
Here is a decent video tutorial. Note: I don't think you'd have to do anything with iptables as he shows. This shows connecting with Windows client.
Check any closed issues with the information label!