Linux: PrivateInternetAccess Using OpenVPN and Squid Proxy – Part 4

This entry is part 4 of 4 in the series PrivateInternetAccess Using Squid Proxy and OpenVPN

PrivateInternetAccess Using OpenVPN and Squid Proxy – OpenVPN Configuration

This article in the series deals with getting the OpenVPN service up and running with PrivateInternetAccess and how to configure our routes to allow us to selectively channel our traffic through it.

As we already installed OpenVPN previously, we can jump straight in: we will need to download the PrivateInternetAccess-specific config files and then set up the software to use these; we’ll also set up a username / password file for the service to use so that we don’t have to enter them every time we want to connect.

1. Download the PrivateInternetAccess VPN config files from the website

The files can be found at the following link, all zipped up and ready to download: https://www.privateinternetaccess.com/openvpn/openvpn.zip

Fetch these into the /etc/openvpn directory using wget:

ScreenClip

Unzip the files using the “unzip” command:

ScreenClip

Tip: if the unzip command is not found, you may need to install it using: “apt-get install unzip"

 2. Select the Config File You Wish to Use

The OpenVPN service looks for a file called “server.conf” in the /etc/openvpn directory; the config files above are completed config files so we can either:

a) Rename one of them to server.conf OR much preferably

b) Create a shortcut called server.conf and link it to whichever config file we want to use. This is much better as the name of the config file relates to where your VPN traffic is going to “break out”: i.e. if you link server.conf to “UK London.ovpn” then your traffic will appear with a London IP address. If, however, you want to use something like Hulu which is only available in the US then you would like server.conf to e.g. “US West.ovpn.”

This is very simply done by using the “ln” command as follows:

ln -s <file-to-link-to> <name-of-your-shortcut>

 If we wanted to break out in US West then we would use the following command:

ln -s “/etc/openvpn/US West.ovpn” /etc/openvpn/server.conf

which would create a shortcut called server.conf in the /etc/openvpn directory pointing to the “/etc/openvpn/US West.ovpn” configuration file.

ScreenClip

3. Configure the Username / Password File

The configuration above as it is will work but you will be prompted every time you want to connect for a username and password. To get around this for convenience (and also if you want your VPN to connect automatically) then we need to do the following:

a) Create a simple file with two lines – the first line should contain the username, the second the password. In this example, we echo the username and password into a file called “.pia” in the /root directory:

ScreenClip

Note the first command has one angle bracket “>” and the second one has two “>>” – the first one creates the empty file or blanks it if it already exists and copies the text into it. The second one appends the text to it. Use the “cat” command to view the contents of the file as shown above.

For security, set the permissions on the /root/.pia file to 400 – this means that only root can access it and it will be read-only :

chmod 400 /root/.pia

b) Change the configuration files to use the password file we just created: to do this we need to open each configuration file we want to use, locate the line reading:

auth-user-pass

and change it to:

auth-user-pass /root/.pia

and then save the file. We’re nearly ready to go but first:

4. Configure Static Routes Back to Your Internal Networks!!!

This is only applicable if your proxy is in a different subnet than the one your client is in. In our example, we are connecting from our LAN (172.16.16.0/24) to the proxy in our DMZ (192.168.101.0/24). Once the VPN comes up on our proxy machine, it will become the default gateway meaning that suddenly you won’t be able to access it over the network!

To bypass this, we need to add static routes back to our internal networks, so going with our example network diagram we would need to add a route to 172.16.16.0/24 via 192.168.101.1:

route add -net 172.16.16.0 netmask 255.255.255.0 gateway 192.168.101.1

Now that our communication channels are sorted, let’s get going!

5. Restart the OpenVPN Service

Using the “service openvpn restart” command, you should see the following – we’re sorted!

ScreenClip

Check your routing table with “route -n”:

ScreenClip

  • The first entry in red shows our default VPN gateway – going out of “tun0” – our virtual VPN network interface.
  • The second entry is our standard default gateway for our local subnet.
  • The third is the static route we entered to allow the proxy in the DMZ to talk back to our client’s network.

If you do a traceroute, you’ll see that the first hop is going through the VPN instead of your standard gateway:

ScreenClip

6. Configure Your Browser / Torrent Application to Use the Proxy

You will need to configure your browser or other application to use the proxy – there are many tutorials out there already so a swift google for your particular browser will have you on your way quickly. You simply need to set the parameters to use the IP of the proxy and port 3128!

Please comment below if you run into any problems and we’ll do all we can to help!

Series Navigation<< Linux: PrivateInternetAccess Using OpenVPN and Squid Proxy – Part 3

7 Replies to “Linux: PrivateInternetAccess Using OpenVPN and Squid Proxy – Part 4”

  1. Your Howto is concise and it works! I just finished configuring an Apple Xserve G5 (Powermac) with debian linux and followed the instructions and no problem… Configured a Safari client to connect to the proxy and bingo! But when I tried another client, it was not anonymized… Any idea why?? Thanks.

    1. Hi Joe, the only reason that would be is that the proxy was not configured properly: once it goes through there then it is 100% anonymised. Check your client settings and if using FoxyProxy, check that you have set this as default for all URLs. Cheers K

  2. krrunch,

    Thanks for the write-up. I’ve had my connection up for awhile, but I’m digging down into the weeds a bit more to keep learning about VPN tunnels. Do you mind showing me the output of “ethtool tun0”?

    Thanks in advance.

  3. I cant create the .pia file in the root directory. I keep getting this whenever I eneter my username and password: “bash: /root/: Is a directory” and nothing happens. When I use cat i get the same message
    and also a message saying “cat: .pia: No such file or directory”. I tried with sudo a nothing works.

    Any idea on what’s going on and what I could do to fix it?

    1. Hi there,

      Are you executing this command as root? Or at least using sud?

      Are you executing the exact line “echo myusername > /root/.pia” ?

      (Obviously without the quote marks and substituting your own username for myusername)

      Also important is that there are no spaces in the file path: /root/.pia

      Let me know!
      Cheers
      K

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.