Set Up an OpenVPN Server on a Raspberry Pi

April 28, 2021May 5, 2021

Setting Up a VPN at home is one of those things that sounds terribly complicated, but in reality, it is not.

Don’t worry follow this tutorial On this Raspberry Pi VPN tutorial, I will explain to you step-by-step how to set up an OpenVPN Server on a Raspberry Pi.

What is a VPN?
1. Types of VPNs
2. Different VPN Protocols.
Setting Up Open VPN in Raspberry Pi
Setting Up VPN Client and connect

What Is a VPN?

VPN stands for Virtual Private Network and it is just that, a secure network that is not restricted to one geographical location. Instead, it can communicate with buildings in distant corners of the world.

Traditionally, VPNs were mostly used by companies to communicate with different buildings by adding a degree of privacy and security. This is the past. VPN’s are now gaining popularity among regular users looking to browse with more privacy and security.

This is not a surprise. The number of transactions with sensitive information (credit cards, tax id, documentation) that we do over the Internet has increased significantly over the past few years, and we are not going to stop now. Doing stuff from the couch is just too convenient.

The Internet is awesome, but let’s be frank; there are tons of people out there with the necessary skills to snoop into your communications while you are buying home automation gadgets connected to public Wi-Fi. This is where a VPN comes into play.

A Virtual Private Network provides you with two major features:

Encryption: The data is encrypted when it leaves your device and decrypted once it reaches the destination. This is called the VPN tunnel, and it is what keeps your data private and secure. Once you are connected to the VPN, all the Internet traffic is routed through this tunnel.
Authentication: In order to access the VPN, you need to authenticate with the user and password.

A few use cases for a VPN could be:

Access all the devices in your home network from the outside.
Browse with privacy on unsecured networks.
Avoid geoblocking for apps like Netflix while you are traveling.

Types of VPN’s

There are primarily two types of VPNs, and although this tutorial only focuses on the first one, I want you to have an idea of both of them.

Remote Access VPN

If you work in the corporate environment and get to work remotely every once in a while, you will be very familiar with this concept.

On a Remote Access VPN, the user (you) configures his device to connect to a remote network and use its services. That is what allows you to connect remotely to your office and use all the tools as if you were there. It is a pretty cool concept.

The main caveat is that this method is not completely transparent to the user since there is some configuration to be done on the client-side.

Site-to-Site VPN

A site-to-site VPN, also known as router-to-router VPN, is more suitable for the corporate environment. The connectivity is established between two networks and the encryption and security are added at the router level rather than the user’s computer.

This is very interesting because a site-to-site VPN can act as a virtual bridge between two buildings that are geographically apart.

This allows companies to communicate privately through the Internet.

Different VPN Protocols

Regardless of the VPN type that you use, the communication can leverage different protocols or a combination of them. I am not going to cover all of them, but I will mention the three most popular ones.

Point–to–Point Tunneling Protocol (PPTP): PPTP has been around for the longest time, and it is supported for all the major OS’s out there. It is widely extended, but its security has been called to question in the past few years. It is very fast because it uses very basic encryption, however, it is not recommended from a security standpoint.
L2TP/IPSec: L2TP was the result of a partnership between Cisco and Microsoft in an intent to create a more secure version of PPTP. It uses IPSec to implement the end-to-end encryption during the communication.
OpenVPN is an open-source product created back in 2001 that is becoming a standard. It is based on OpenSSL and is considered one of the most secure options when it comes to VPN communication. OpenVPN is supported by all the major OS’s and is easy to implement. It is one of the best options for a domestic VPN like ours.

Our Raspberry Pi VPN will be be using a Remote Access OpenVPN.

Raspberry Pi VPN: Setup an OpenVPN Server

For this tutorial, I assume that you already have a Raspberry Pi with a Linux distribution installed, preferably Raspbian or any of its derivatives.

PiVPN is optimized for Raspberry Pi, but it should run fine in most of the Linux distributions.

Download and Install Required Packages

Let’s start by downloading the PiVPN Script.

It is available for you to go through it, but once you execute the following command, it will kick off.

SSH into your Raspberry Pi and run the following command:

curl -L https://install.pivpn.io | bash

Once it is downloaded, PiVPN will look for updates in the system and start installing the required packages.

If the installation process shows that there are pending updates, you should consider updating the system once the process is finished.

I will add a step for this at the end of the tutorial.

The download will be done in no time, and soon after, it will ask you for your password. This is required to install the new packages.

The installation process for the Raspberry Pi VPN shouldn’t take more than a couple of minutes, but it depends on your Internet connection and version of Raspberry Pi. When you see this message on the screen, you are ready to proceed.

Hit enter to start with the installation.

Assign Static IP Address

The VPN server requires a static IP to function correctly, but don’t worry if you haven’t set up one yet, PiVPN will do that for you.

As you probably know, your router assigns IPs to the different devices connected to the network. When you restart your router, the IP’s assigned to the different devices can change, which is the reason to assign a static ip in this case.

Your clients need to know where to find you.

You can leave the IP that is currently assigned to your Raspberry Pi. I am going to click on No because I want to assign a different one.

Once you have assigned an IP that you like to your Raspberry Pi, you are ready to move on to the next step.

Select Your Default Gateway

The default gateway is the device your Raspberry Pi connects to the Internet, which is your router in most cases.

The script should be able to find it automatically, but you may want to verify that the IP shown in the screen does indeed correspond to your router’s IP.

It will usually be http://192.168.1.1 or http://192.168.0.1 One of those should take you to your router configuration page.

Verify that all the settings look correct and let’s keep rolling.

User That Will Hold OVPN Configurations

This step is not terribly relevant. You just need to specify a user that is going to hold the ovpn configuration for your Raspberry Pi VPN.

When you create new client profiles, the files will be generated on this user’s home directory.

Don’t worry too much about this now, we will get to this step late in the tutorial.

You will be prompted with a list of users to choose from. I am going to select the service account for my openHAB server, but it doesn’t make much of a difference provided that you can login with that user account.

Be careful here. When you hit enter, it will take you directly to the next screen, and if you made a mistake, you will have to start over.

Not fun!

Unattended Upgrades

Having a Raspberry Pi VPN means that one of the external ports of your router will have to exposed to the internet.

There are some security concerns with that and you want to make sure that you have all the fixes and updates related to security.

This step enables unattended-upgrades to keep you up to date, I would suggest you do it for your own peace of mind.

TCP Vs. UDP: What Is This?

Now, you have to choose between TCP and UDP as the communication protocol for OpenVPN. The recommended approach here is UDP and the reason is speed.

TCP it is what is called a stateful protocol. This means that every time it sends a package it waits for confirmation.

This feature, although very reliable, slows down the communication.

UDP, on the other hand, is a stateless protocol. It sends the information without waiting for a response. This protocol is suitable for the majority of the applications of a VPN and it will boost your performance.

Choosing an OpenVPN Port

This is the port that will wait for external connections; choose whichever you like, just make sure it is over 1024.

Confirm the settings and move forward.

Select the Encryption Level

This is for the number of bits used in the encryption process. The higher the number, the more secure it is.

Let’s pick 4096-bit you might be thinking.

While it is totally fine to do so, it will slow down the key generation and the processing itself. 2048-bit is more than enough IMHO and it will give you a nice performance.

Confirm and go for it.

The key generation is the longest part of the process. It takes quite a while, but you don’t have to actively do anything. So, go get yourself a drink and read some other post in the blog.

Public IP or DNS

Once the key generation process is done, the script will propt you to chose a public IP or a dynamic DNS.

The whole point of having a VPN is to access your network from the outside. The only issue is that most ISP’s assign different IP’s when you restart your router.

For this reason, it is best to pick a Dynamic DNS, like DuckDNS. There are several options, but I use DuckDNS myself; it is free and blazing fast.

Select a DNS Provider

You need to use a DNS provider to handle your requests. Be aware that the DNS provider will be able to see all your requests. I am fine with that, so I have selected Google.

The Raspberry Pi VPN Installation Is Complete!

That’s it! Your Raspberry Pi VPN Server is ready to be used.

You will now be prompted to reboot your Raspberry Pi, which I think you should while you get another drink.

Update the OS

Don’t forget to update the system after your Raspberry Pi is back up.

sudo apt-get upgrade

This may take a few minutes, depending on how far behind are you.

Raspberry Pi VPN: Setup your First Client

Now that your Raspberry Pi VPN server is up and running, it is time to set up your first client.

Creating the OVPN File

The OVPN file contains the private key and the details to connect to the server. It is a necessary requirement for your clients to connect to the VPN.

You can generate as many as you want, and ideally, you will want to create one per user. In this way, you can revoke the access for some users if you need to.

In order to generate the OVPN file, you will use the magic command:

pivpn add

The add function will ask you for a client name and password. The client name can be whatever you want, just make sure that you remember the password that you have used. Your client will need it to connect to the Raspberry Pi VPN.

The OVPN file is generated, and PiVPN is showing you the location where you can find it.

Port Forwarding

To be able to connect to the VPN server from outside of your network, you will need to do port forwarding to the IP and port that you have configured during the installation process.

Unfortunately, I can’t help you with that because every router is different, but it should be a simple process.

Connecting to the VPN Server Using a Windows Client

In order to connect to the VPN server, you will need an OpenVPN client installed on your computer, there are many options but I personally use the one provided by OpenVPN.

Just head to the OpenVPN website and download it for free:

Once it is downloaded, go ahead with the installation. You can go with the default options, it just takes a couple of minutes.

Once you have the client installed, you will need to bring over to your computer the OVPN file that PiVPN created. I am using OpenHABIAN, so the directory is already mounted:

\\OPENHABIANPI\openhabian\ovpns

If you don’t have that, you can use an FTP client, like Filezilla, to copy the file.

Open the OpenVPN client to import the configuration.

Once the configuration is imported, hit connect to open a connection to the VPN server.

And, voila! After typing the password, you should be connected to your very own Raspberry Pi VPN server.

Start browsing with privacy!