{"id":9,"date":"2022-03-05T14:39:17","date_gmt":"2022-03-05T13:39:17","guid":{"rendered":"https:\/\/steambot.ch\/blog\/?p=9"},"modified":"2024-06-22T18:06:56","modified_gmt":"2024-06-22T17:06:56","slug":"route-your-entire-home-network-through-a-vpn","status":"publish","type":"post","link":"https:\/\/steambot.ch\/blog\/?p=9","title":{"rendered":"Route your entire home network through a VPN"},"content":{"rendered":"\n

You will need a device to use as a gateway for your network. A Raspberry Pi is good enough for this job. You will also need a valid account with a VPN provider such as ProtonVPN<\/a> or NordVPN<\/a>. ProtonVPN has the advantage of letting you connect to a few nodes, without bandwidth limit, if you subscribe to their free plan.<\/p>\n\n\n\n

For this tutorial, I will assume you use a Raspberry Pi 4 with the Raspberry Pi OS (formerly known as Raspbian) and have an account with ProtonVPN<\/a>.<\/p>\n\n\n\n

Install your favorite OS and connect the device to your network, preferably using an ethernet cable.<\/p>\n\n\n\n

Setup a fix IP address for your future gateway<\/h2>\n\n\n\n

First of all don’t forget to update your OS:<\/p>\n\n\n\n

sudo apt update\nsudo apt upgrade<\/code><\/pre>\n\n\n\n
note the current device IP address with the command<\/p>\n\n\n\n
hostname -I<\/code><\/pre>\n\n\n\n
Then, open a terminal on the Raspberry Pi and open the file called dhcpcd.conf<\/p>\n\n\n\n
sudo vim \/etc\/dhcpcd.conf<\/code><\/pre>\n\n\n\n
add the following lines to the file (replace XX with the actual address):<\/p>\n\n\n\n
interface eth0\nstatic ip_address=192.168.1.XX\/24\n# this is the IP address of your default gateway\nstatic routers=192.168.2.1\nstatic domain_name_servers=192.168.1.1 9.9.9.9<\/code><\/pre>\n\n\n\n
Then reboot the system for the changes to take effect<\/p>\n\n\n\n
sudo reboot<\/code><\/pre>\n\n\n\n
Install OpenVPN<\/h2>\n\n\n\n
You will need OpenVPN to establish the VPN connection between your gateway and your VPN provider. Install it using the package distribution<\/p>\n\n\n\n
sudo apt-get install openvpn<\/code><\/pre>\n\n\n\n
then activate the OpenVPN daemon<\/p>\n\n\n\n
sudo systemctl enable openvpn<\/code><\/pre>\n\n\n\n
Setup the OpenVPN ProtonVPN configuration<\/h2>\n\n\n\n
Go to ProtonVPN<\/a> and login to access your personal dashboard. Then, on the side menu, click on the OpenVPN\/IKEv2 item.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
On this page, note the OpenVPN username and password (they are different from your regular ProtonVPN credentials) as you will need them later on in your configuration file.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
To generate a configuration file, choose GNU\/Linux as your platform, UDP as the protocol, and then choose a country or a specific server in the list where you want to route your gateway traffic (and therefore your entire network). Then click on download to get the .ovpn configuration file. (Note that you can also choose a TOR node for even more privacy.)<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Go back to your Raspberry Pi terminal and navigate to the OpenVPN configuration folder and create a new configuration file<\/p>\n\n\n\n
cd \/etc\/openvpn<\/code><\/pre>\n\n\n\n
Create a new login file that will contain your ProtonVPN credential<\/p>\n\n\n\n
vim login.txt<\/code><\/pre>\n\n\n\n
and past on the 1st line your username and on the 2nd your password so it looks like<\/p>\n\n\n\n
<your_ovpn_username>\n<your_ovpn_password><\/code><\/pre>\n\n\n\n
then, still in this same folder, create a server configuration file:<\/p>\n\n\n\n
vim server.conf<\/code><\/pre>\n\n\n\n
copy the content of the configuration file you just downloaded from Proton VPN and the line containing the auth-user-pass instruction to point to your login.txt file you just created:<\/p>\n\n\n\n
auth-user-pass \/etc\/openvpn\/login.txt<\/code><\/pre>\n\n\n\n
Add the following lines below to add additional routes and force the traffic through your pihole instance<\/p>\n\n\n\n
# replace with the IP of your pihole instance\npush \"dhcp-option DNS 192.168.1.XX\"\n# replace with the IP of your gateway\npush \"route 192.168.1.0 255.255.255.0 192.168.1.XX 1\"\n\nscript-security 2\nup \/etc\/openvpn\/update-resolv-conf\ndown \/etc\/openvpn\/update-resolv-conf<\/code><\/pre>\n\n\n\n
Now start the OpenVPN client by establishing a new VPN connection<\/p>\n\n\n\n
sudo systemctl restart openvpn@server<\/code><\/pre>\n\n\n\n
check that your public IP address now matches a ProtonVPN exit IP for the country of your choice. For this, you can either navigate to https:\/\/dnsleaktest.com\/<\/a> or issue the following command in the terminal<\/p>\n\n\n\n
curl ifconfig.me<\/code><\/pre>\n\n\n\n
Setting up the network routes and firewall<\/h2>\n\n\n\n
We need to let the Raspberry Pi forward the network traffic to act as a router:<\/p>\n\n\n\n
sudo \/bin\/su -c \"echo -e '\\n#Enable IP Routing\\nnet.ipv4.ip_forward = 1' > \/etc\/sysctl.conf\"<\/code><\/pre>\n\n\n\n
To verify that the changes have taken place, issue the following command:<\/p>\n\n\n\n
sudo sysctl -p<\/code><\/pre>\n\n\n\n
it should return<\/p>\n\n\n\n
net.ipv4.ip_forward = 1<\/code><\/pre>\n\n\n\n
Then we can start setting up the iptables firewall to channel all of the network traffic into the VPN tunnel. If necessary, install the iptables package:<\/p>\n\n\n\n
sudo apt install iptables<\/code><\/pre>\n\n\n\n
Setting up iptables, especially for users less familiar with networking is not an easy task and wrong manipulations can easily break your entire network or deny access to some services or devices. So be careful when editing those rules. If you want to better understand what happens or tweak the iptables configuration further, I can recommend this post by DigitalOcean<\/a> to get a better understanding of what is happening.<\/p>\n\n\n\n
So let’s go back at our Raspberry Pi and add a NAT rule so that the traffic gets redirected to the correct devices:<\/p>\n\n\n\n
sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE<\/code><\/pre>\n\n\n\n
Then we let the traffic go from eth0 to the VPN (tun0) interface and back<\/p>\n\n\n\n
sudo iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT\nsudo iptables -A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT<\/code><\/pre>\n\n\n\n
We allow the traffic on the loopback interface:<\/p>\n\n\n\n
sudo iptables -A INPUT -i lo -j ACCEPT<\/code><\/pre>\n\n\n\n
We also need to allow traffic on specific ports for communication (ssh, ping, OpenVPN). Edit the following list as needed:<\/p>\n\n\n\n
sudo iptables -A INPUT -i eth0 -p icmp -j ACCEPT\nsudo iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT<\/code><\/pre>\n\n\n\n
Allow return traffic for outgoing connections initiated by the Raspberry Pi:<\/p>\n\n\n\n
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<\/code><\/pre>\n\n\n\n
Next, in preparation for the setup with PiHole, we need to enable a few more ports for the local network so that DHCP, DNS, any VPN connections and the PiHole web interface will also work:<\/p>\n\n\n\n
sudo iptables -I INPUT -i eth0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT\nsudo iptables -A INPUT -i eth0 -p tcp --destination-port 53 -j ACCEPT\nsudo iptables -A INPUT -i eth0 -p udp --destination-port 53 -j ACCEPT\nsudo iptables -A INPUT -i eth0 -p udp --destination-port 1194 -j ACCEPT\nsudo iptables -A INPUT -i eth0 -p tcp --destination-port 1194 -j ACCEPT\nsudo iptables -A INPUT -i eth0 -p tcp --destination-port 80 -j ACCEPT<\/code><\/pre>\n\n\n\n
Then, we block all other network traffic that does not comply with any of the previously mentioned rules:<\/p>\n\n\n\n
sudo iptables -P FORWARD DROP\nsudo iptables -P INPUT DROP<\/code><\/pre>\n\n\n\n
When this is done, we can print the rules to get a global picture:<\/p>\n\n\n\n
sudo iptables -t nat -L -v --line-numbers\nsudo iptables -t mangle -L -v --line-numbers\nsudo iptables -L -v --line-numbers<\/code><\/pre>\n\n\n\n
Changes to the iptables will not persist after a system reboot. In order to keep the Iptables after the reboot, we need to install a small utility and save the settings we just made:<\/p>\n\n\n\n
sudo apt-get install iptables-persistent\nsudo systemctl enable netfilter-persistent\nsudo netfilter-persistent save<\/code><\/pre>\n\n\n\n
Edit your pihole configuration to set your default network gateway<\/h2>\n\n\n\n
(See this post<\/a> for the details on installing pihole).<\/p>\n\n\n\n
Go to pihole’s web interface and login to navigate to the settings menu. From there, you can define the gateway for all your connected devices.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now try disconnecting a device from your home network (by disabling the wifi for example) and reconnect. Then navigate to  https:\/\/dnsleaktest.com\/<\/a> and check that your new public IP matches the ProtonVPN exit node.<\/p>\n\n\n\n
Optional: Add rules to forward a second OpenVPN traffic<\/h2>\n\n\n\n
I you have deployed your own private OpenVPN server on a machine sitting in your home network (see this post<\/a>), you will need to make some adjustments to redirect your home VPN traffic to the correct gateways.<\/p>\n\n\n\n
First of all, you need to allow your OpenVPN traffic through the gateway by modifying the iptables rules:<\/p>\n\n\n\n
# do port forwarding to the VPN 2 server and allow forward traffic\niptables -t nat -A PREROUTING -p tcp --dport 1194 -j DNAT --to-destination 192.168.1.45:1194\niptables -I FORWARD -i eth0 -o eth0 -p tcp --dport 1194 -j ACCEPT\niptables -I FORWARD -i eth0 -o eth0 -p tcp --sport 1194 -j ACCEPT<\/code><\/pre>\n\n\n\n
Then you need to mark all OpenVPN incoming traffic so that it can be redirected to your home VPN server (and not be redirected to your ProtonVPN tunnel):<\/p>\n\n\n\n
# mark all packets that have to be routed through the 192.168.1.1 gateway\niptables -t mangle -A PREROUTING -p tcp --sport 1194 -j MARK --set-mark 1<\/code><\/pre>\n\n\n\n
Then we add a new route for your marked packets to let them go back through your default network gateway so that they can go back the way they came:<\/p>\n\n\n\n
# define desired specific route for marked packets\necho 201 openvpn1194.out | tee --append \/etc\/iproute2\/rt_tables\nip rule add fwmark 1 table openvpn1194.out\nip route add default via 192.168.1.1 dev eth0 table openvpn1194.out<\/code><\/pre>\n\n\n\n
Bonus: Survey your traffic using Monitorix<\/h2>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n
Install the monitorix<\/a> package<\/p>\n\n\n\n
sudo apt install monitorix<\/code><\/pre>\n\n\n\n
Then edit the monitorix configuration file<\/p>\n\n\n\n
vim \/etc\/monitorix\/monitorix.conf<\/code><\/pre>\n\n\n\n
Adapt the configuration to your needs, in the net<\/code> field, set your gateway to tun0<\/code> and enable the traffacct<\/code> reporting and list the clients you wish to monitor with their ip-addresses. Note that this requires your devices to have fix ip addresses — you can set them up in the pihole interface<\/em>.<\/p>\n\n\n\n
# NET graph\n# -----------------------------------------------------------------------------\n<net>\n        max = 10\n        list = eth0, tun0\n        <desc>\n                eth0 = FastEthernet LAN, 0, 10000000\n                tun0 = FastEthernet LAN, 0, 10000000\n        <\/desc>\n        gateway = tun0\n<\/net>\n\n\n# TRAFFACCT graph\n# -----------------------------------------------------------------------------\n<traffacct>\n        enabled = y\n        max = 20\n        graphs_per_row = 2\n        list = john-laptop, smart-tv, bob-ipad, alice-laptop, raspberrypi\n        <desc>\n                0 = 192.168.1.XX\/32, 0@example.com\n                1 = 192.168.1.XX\/32, 1@example.com\n                2 = 192.168.1.XX\/32, 2@example.com\n                3 = 192.168.1.XX\/32, 3@example.com\n                4 = 192.168.1.XX\/32, 4@example.com\n\n\n        <\/desc>\n        <reports>\n                enabled = n\n                language = en\n                default_mail = root@localhost\n                url_prefix = http:\/\/localhost:8080\n                smtp_hostname = localhost\n                from_address = noreply@example.com\n        <\/reports>\n        rigid = 0\n        limit = 100\n<\/traffacct>\n<\/code><\/pre>\n\n\n\n
restart monitorix and check that monitorix is running and that no errors are present by issuing the command<\/p>\n\n\n\n
sudo service monitorix restart\nsudo service monitorix status<\/code><\/pre>\n\n\n\n
then navigate to the monitorix homepage below to have a live overview of your gateway status and a report of your devices network activity<\/p>\n\n\n\n
http://<ip_or_gateway_hostname>:8080\/monitorix<\/code><\/pre>\n\n\n\n
Acknowledgments<\/h2>\n\n\n\n
This tutorial is heavily inspired by a Github page<\/a> (in German) detailing the steps to create a NordVPN gateway integrated with pihole.<\/p>\n","protected":false},"excerpt":{"rendered":"
You will need a device to use as a gateway for your network. A Raspberry Pi is good enough for this job. You will also need a valid account with a VPN provider such as ProtonVPN or NordVPN. ProtonVPN has the advantage of letting you connect to a few nodes, without bandwidth limit, if you […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[8,9,7,5,4],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry","category-vpn","tag-monitorix","tag-networking","tag-proton","tag-raspberrypi","tag-vpn"],"_links":{"self":[{"href":"https:\/\/steambot.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/steambot.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/steambot.ch\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/steambot.ch\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/steambot.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9"}],"version-history":[{"count":37,"href":"https:\/\/steambot.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/9\/revisions"}],"predecessor-version":[{"id":133,"href":"https:\/\/steambot.ch\/blog\/index.php?rest_route=\/wp\/v2\/posts\/9\/revisions\/133"}],"wp:attachment":[{"href":"https:\/\/steambot.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/steambot.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/steambot.ch\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}