Creating a VPN server on Raspberry Pi

Setting up a VPN server with your Raspberry Pi is an excellent way of ensuring secure, private Internet browsing. Here's a detailed guide to help you get started using OpenVPN.

Contents

1. Introduction
2. Equipment required
3. Preparing the Raspberry Pi
4. OpenVPN installation
5. OpenVPN configuration
6. Certificate and key generation
7. VPN Client configuration
8. Testing and adjustment
9. Conclusion

1. Introduction

A VPN (Virtual Private Network) creates a secure, encrypted connection between your device and a server. Using a Raspberry Pi as a VPN server, you can browse the Internet in complete security and access geographically restricted content.

2. Materials required

• Raspberry Pi (model 3 or higher)
• microSD card (minimum 16 GB) with Raspbian installed
• Ethernet cable or Wi-Fi connection
• Power supply for Raspberry Pi

3. Preparing the Raspberry Pi

1. Install Raspbian :
   • Download the Raspbian image from the official website.
   • Use a tool like balenaEtcher to burn the image onto the microSD card.
   • Insert the microSD card into the Raspberry Pi and start it up.
2. Configuring the Raspberry Pi :
   • Log in with the default credentials (user : pipassword : raspberry).
   • Update the system with the following commands:
     • sudo apt update
     • sudo apt upgrade

4. OpenVPN installation

1. Installing OpenVPN and Easy-RSA :
   • OpenVPN is an open-source VPN server software and Easy-RSA is a PKI (Public Key Infrastructure) management tool:
     • sudo apt install openvpn easy-rsa
2. Configuring Easy-RSA :
   • Copy the Easy-RSA files to the OpenVPN directory:
     • make-cadir ~/openvpn-ca
     • cd ~/openvpn-ca

5. OpenVPN configuration

1. Modifying Easy-RSA variables :
   • Edit file vars to configure your CA (Certificate Authority) settings:
     • nano ~/openvpn-ca/vars
   • Modify the following lines according to your information:
     • set_var EASYRSA_REQ_COUNTRY "FR"
     • set_var EASYRSA_REQ_PROVINCE "Ile-de-France" (France)
     • set_var EASYRSA_REQ_CITY "Paris" "Paris" "Paris
     • set_var EASYRSA_REQ_ORG "MyOrganization
     • set_var EASYRSA_REQ_EMAIL "email@example.com"
     • set_var EASYRSA_REQ_OU "MonUnit"
2. Build the CA :
   • Initialize the PKI and build the CA :
     • ./easyrsa init-pki
     • ./easyrsa build-ca
3. Generate certificate and key for Server :
   • Create the certificate signing request (CSR) and sign the certificate:
     • ./easyrsa gen-req server nopass
     • ./easyrsa sign-req server server
4. Generate Diffie-Hellman and HMAC keys :
   • These keys add an extra layer of security:
     • ./easyrsa gen-dh
     • openvpn --genkey --secret ta.key
5. Configure the sOpenVPN server :
   • Create a configuration file for the VPN server:
     • sudo nano /etc/openvpn/server.conf
   • Add the following content:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA256
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
crl-verify crl.pem

6. Certificate and key generation

1. Create certificates and keys for customers :
   • Generate a key and certificate for each customer:
     • ./easyrsa gen-req client1 nopass
     • ./easyrsa sign-req client client1
2. Create a configuration file for the client :
   • Create a file client.ovpn with the following content:

customer
dev tun
proto udp
remote your_domain_or_ip 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
remote-cert-tls server
auth SHA256
cipher AES-256-CBC
verb 3

-----BEGIN CERTIFICATE-----
# Copy contents of ca.crt
-----END CERTIFICATE-----


-----BEGIN CERTIFICATE-----
# Copy contents of client1.crt
-----END CERTIFICATE-----


-----BEGIN PRIVATE KEY-----
# Copy contents of client1.key
-----END PRIVATE KEY-----


-----BEGIN OpenVPN Static key V1-----
# Copy the contents of ta.key
-----END OpenVPN Static key V1-----

7. VPN client configuration

1. Configuring the VPN client :
   • Install an OpenVPN client on your devices (Windows, macOS, Android, iOS) and import the file client.ovpn.

8. Tests and adjustments

1. Testing the VPN connection :
   • Connect to your VPN server from a client device to check that everything is working properly.
2. Adjust parameters :
   • Adjust security and performance parameters to your specific needs.

9. Conclusion

By following this guide, you now have a working VPN server with a Raspberry Pi. You can surf the Internet safely and access geographically restricted content. Enjoy your VPN server, and don't hesitate to add extra features to make it even more powerful!