{"id":23491,"date":"2024-08-07T10:00:00","date_gmt":"2024-08-07T08:00:00","guid":{"rendered":"https:\/\/monraspberry.com\/?p=23491"},"modified":"2024-07-17T11:43:09","modified_gmt":"2024-07-17T09:43:09","slug":"creating-a-vpn-server-on-raspberry-pi","status":"publish","type":"post","link":"https:\/\/monraspberry.com\/en\/creer-un-serveur-vpn-sur-raspberry-pi\/","title":{"rendered":"Creating a VPN server on Raspberry Pi"},"content":{"rendered":"<p>Setting up a VPN server with your Raspberry Pi is an excellent way of ensuring secure, private Internet browsing. Here's a detailed guide to help you get started using OpenVPN.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Contents<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Introduction<\/li>\n\n\n\n<li>Equipment required<\/li>\n\n\n\n<li>Preparing the Raspberry Pi<\/li>\n\n\n\n<li>OpenVPN installation<\/li>\n\n\n\n<li>OpenVPN configuration<\/li>\n\n\n\n<li>Certificate and key generation<\/li>\n\n\n\n<li>VPN Client configuration<\/li>\n\n\n\n<li>Testing and adjustment<\/li>\n\n\n\n<li>Conclusion<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">1. Introduction<\/h3>\n\n\n\n<p>A VPN (Virtual Private Network) creates a secure, encrypted connection between your device and a server. Using a Raspberry Pi as a VPN server, you can browse the Internet in complete security and access geographically restricted content.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Materials required<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/monraspberry.com\/en\/cat\/raspberry-pi-4\/raspberry-pi-4-board\/\">Raspberry Pi<\/a> (model 3 or higher)<\/li>\n\n\n\n<li><a href=\"https:\/\/monraspberry.com\/en\/product\/sandisk-ultra-micro-sd-card\/\">microSD card<\/a> (minimum 16 GB) with Raspbian installed<\/li>\n\n\n\n<li>Ethernet cable or Wi-Fi connection<\/li>\n\n\n\n<li><a href=\"https:\/\/monraspberry.com\/en\/product\/alimentation-raspberry-pi-15-3w-usb-c\/\">Power supply<\/a> for Raspberry Pi<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3. Preparing the Raspberry Pi<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Install Raspbian :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Download the Raspbian image from the official website.<\/li>\n\n\n\n<li>Use a tool like balenaEtcher to burn the image onto the microSD card.<\/li>\n\n\n\n<li>Insert the microSD card into the Raspberry Pi and start it up.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Configuring the Raspberry Pi :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Log in with the default credentials (user : <code>pi<\/code>password : <code>raspberry<\/code>).<\/li>\n\n\n\n<li>Update the system with the following commands:\n<ul class=\"wp-block-list\">\n<li><code>sudo apt update <\/code><\/li>\n\n\n\n<li><code>sudo apt upgrade<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">4. OpenVPN installation<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Installing OpenVPN and Easy-RSA :<\/strong>\n<ul class=\"wp-block-list\">\n<li>OpenVPN is an open-source VPN server software and Easy-RSA is a PKI (Public Key Infrastructure) management tool:\n<ul class=\"wp-block-list\">\n<li><code>sudo apt install openvpn easy-rsa<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Configuring Easy-RSA :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Copy the Easy-RSA files to the OpenVPN directory:\n<ul class=\"wp-block-list\">\n<li><code>make-cadir ~\/openvpn-ca <\/code><\/li>\n\n\n\n<li><code>cd ~\/openvpn-ca<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">5. OpenVPN configuration<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Modifying Easy-RSA variables :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Edit file <code>vars<\/code> to configure your CA (Certificate Authority) settings:\n<ul class=\"wp-block-list\">\n<li><code>nano ~\/openvpn-ca\/vars<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Modify the following lines according to your information:\n<ul class=\"wp-block-list\">\n<li><code>set_var EASYRSA_REQ_COUNTRY \"FR\" <\/code><\/li>\n\n\n\n<li><code>set_var EASYRSA_REQ_PROVINCE \"Ile-de-France\" (France) <\/code><\/li>\n\n\n\n<li><code>set_var EASYRSA_REQ_CITY \"Paris\" \"Paris\" \"Paris <\/code><\/li>\n\n\n\n<li><code>set_var EASYRSA_REQ_ORG \"MyOrganization <\/code><\/li>\n\n\n\n<li><code>set_var EASYRSA_REQ_EMAIL \"email@example.com\" <\/code><\/li>\n\n\n\n<li><code>set_var EASYRSA_REQ_OU \"MonUnit\"<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Build the CA :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Initialize the PKI and build the CA :\n<ul class=\"wp-block-list\">\n<li><code>.\/easyrsa init-pki <\/code><\/li>\n\n\n\n<li><code>.\/easyrsa build-ca<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Generate certificate and key for Server :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Create the certificate signing request (CSR) and sign the certificate:\n<ul class=\"wp-block-list\">\n<li><code>.\/easyrsa gen-req server nopass <\/code><\/li>\n\n\n\n<li><code>.\/easyrsa sign-req server server<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Generate Diffie-Hellman and HMAC keys :<\/strong>\n<ul class=\"wp-block-list\">\n<li>These keys add an extra layer of security:\n<ul class=\"wp-block-list\">\n<li><code>.\/easyrsa gen-dh <\/code><\/li>\n\n\n\n<li><code>openvpn --genkey --secret ta.key<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Configure the<\/strong> s<strong>OpenVPN server :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Create a configuration file for the VPN server:\n<ul class=\"wp-block-list\">\n<li><code>sudo nano \/etc\/openvpn\/server.conf<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Add the following content:<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n<div class=\"wp-block-syntaxhighlighter-code\"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nport 1194\nproto udp\ndev tun\nca ca.crt\ncert server.crt\nkey server.key\ndh dh.pem\nauth SHA256\ntls-auth ta.key 0\ntopology subnet\nserver 10.8.0.0 255.255.255.0\nifconfig-pool-persist ipp.txt\npush \"redirect-gateway def1 bypass-dhcp\"\npush \"dhcp-option DNS 1.1.1.1\"\npush \"dhcp-option DNS 1.0.0.1\"\nkeepalive 10 120\ncipher AES-256-CBC\nuser nobody\ngroup nogroup\npersist-key\npersist-tun\nstatus openvpn-status.log\nlog-append \/var\/log\/openvpn.log\nverb 3\ncrl-verify crl.pem\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\">6. Certificate and key generation<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Create certificates and keys for customers :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Generate a key and certificate for each customer:\n<ul class=\"wp-block-list\">\n<li><code>.\/easyrsa gen-req client1 nopass <\/code><\/li>\n\n\n\n<li><code>.\/easyrsa sign-req client client1<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Create a configuration file for the client :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Create a file <code>client.ovpn<\/code> with the following content:<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n<div class=\"wp-block-syntaxhighlighter-code\"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\ncustomer\ndev tun\nproto udp\nremote your_domain_or_ip 1194\nresolv-retry infinite\nnobind\nuser nobody\ngroup nogroup\npersist-key\npersist-tun\nremote-cert-tls server\nauth SHA256\ncipher AES-256-CBC\nverb 3\n\n-----BEGIN CERTIFICATE-----\n# Copy contents of ca.crt\n-----END CERTIFICATE-----\n\n\n-----BEGIN CERTIFICATE-----\n# Copy contents of client1.crt\n-----END CERTIFICATE-----\n\n\n-----BEGIN PRIVATE KEY-----\n# Copy contents of client1.key\n-----END PRIVATE KEY-----\n\n\n-----BEGIN OpenVPN Static key V1-----\n# Copy the contents of ta.key\n-----END OpenVPN Static key V1-----\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\">7. VPN client configuration<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Configuring the VPN client :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Install an OpenVPN client on your devices (Windows, macOS, Android, iOS) and import the file <code>client.ovpn<\/code>.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">8. Tests and adjustments<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Testing the VPN connection :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Connect to your VPN server from a client device to check that everything is working properly.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Adjust parameters :<\/strong>\n<ul class=\"wp-block-list\">\n<li>Adjust security and performance parameters to your specific needs.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">9. Conclusion<\/h3>\n\n\n\n<p>By following this guide, you now have a working VPN server with a Raspberry Pi. You can surf the Internet safely and access geographically restricted content. Enjoy your VPN server, and don't hesitate to add extra features to make it even more powerful!<\/p>","protected":false},"excerpt":{"rendered":"<p>Cr\u00e9er un serveur VPN avec votre Raspberry Pi est un excellent moyen de garantir une navigation s\u00e9curis\u00e9e et priv\u00e9e sur Internet. Voici un guide d\u00e9taill\u00e9 pour vous aider \u00e0 r\u00e9aliser ce projet en utilisant OpenVPN. Sommaire 1. Introduction Un VPN (Virtual Private Network) permet de cr\u00e9er une connexion s\u00e9curis\u00e9e et crypt\u00e9e entre votre appareil et [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":23492,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[308],"tags":[],"class_list":["post-23491","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutos"],"featured_image_src":{"landsacpe":["https:\/\/monraspberry.com\/wp-content\/uploads\/2024\/07\/Serveur-VPN-Raspberry-Pi.png",791,445,false],"list":["https:\/\/monraspberry.com\/wp-content\/uploads\/2024\/07\/Serveur-VPN-Raspberry-Pi.png",463,260,false],"medium":["https:\/\/monraspberry.com\/wp-content\/uploads\/2024\/07\/Serveur-VPN-Raspberry-Pi-300x169.png",300,169,true],"full":["https:\/\/monraspberry.com\/wp-content\/uploads\/2024\/07\/Serveur-VPN-Raspberry-Pi.png",1920,1080,false]},"jetpack_featured_media_url":"https:\/\/monraspberry.com\/wp-content\/uploads\/2024\/07\/Serveur-VPN-Raspberry-Pi.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/monraspberry.com\/en\/wp-json\/wp\/v2\/posts\/23491","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/monraspberry.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/monraspberry.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/monraspberry.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/monraspberry.com\/en\/wp-json\/wp\/v2\/comments?post=23491"}],"version-history":[{"count":0,"href":"https:\/\/monraspberry.com\/en\/wp-json\/wp\/v2\/posts\/23491\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/monraspberry.com\/en\/wp-json\/wp\/v2\/media\/23492"}],"wp:attachment":[{"href":"https:\/\/monraspberry.com\/en\/wp-json\/wp\/v2\/media?parent=23491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/monraspberry.com\/en\/wp-json\/wp\/v2\/categories?post=23491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/monraspberry.com\/en\/wp-json\/wp\/v2\/tags?post=23491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}