From b87252141aab5a3df1e48337e030bf8269e2d97c Mon Sep 17 00:00:00 2001 From: RamSet Date: Thu, 31 May 2018 12:58:57 -0600 Subject: [PATCH 01/20] Create dual-VPN.md Moved guide to new file. --- docs/guides/vpn/dual-VPN.md | 41 +++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 docs/guides/vpn/dual-VPN.md diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md new file mode 100644 index 0000000..73eb472 --- /dev/null +++ b/docs/guides/vpn/dual-VPN.md @@ -0,0 +1,41 @@ +If you however want to run two VPN servers, one that routes the traffic and one that answers only to DNS requests, you would have to create another instance of OpenVPN. + +Why would you want to do this? + +Because DNS is restricted to port 53 only, you cannot use it as your own DNS outside your network unless you make it public and making a DNS server a public server, is not always the best idea and it comes with some risks. + +So why not use the VPN tunnel to answer to DNS queries only? No traffic goes through it, except for the DNS queries, that are answered (and tracked if you have the Admin interface installed) by your Pi-hole. + +You can even use the same .ovpn file, with minor modifications (no need to generate it again). + +We're going to use the original configuration file and copy it and then, edit the second file: + +sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf sudo nano /etc/openvpn/server2.conf + +We'll need to change the port to a diferent one from the original, so that it does not conflict with the first instance of OpenVPN + +Assuming you used default port configuration, you should have 1194 as the port. You need to change this do a different value (make sure the port is available - 1195 should be) and if needed, port forward it from your router into your device. You also need to assign a different class of IPs that will server for this connection only (server line). + +`server 10.9.0.0 255.255.255.0` + +And make sure that the DNS requests go though the instance of OpenVPN: push "dhcp-option DNS 10.9.0.1" + +One other setting that we need to change is comment out (the already existing line) `# push "redirect-gateway def1 bypass-dhcp"`. +Save the file and run the second instance of VPN: + +`systemctl start openvpn@server2.service` + +If your distro doesn’t have “Systemctl” you may use commands like below to start your OpenVPN with your second configuration as a daemon: +`/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2` + +The next step is to edit the exisitng .ovpn file that is used for this connection. + +When editing the file, update the port from the provious value, to the port you set-up for the second instance of OpenVPN configuration file. + +Before testing, make sure you: + +1. have the port forwarded to the second instance of VPN +2. ps ax | grep openvpn should show you two instances of openvpn running (with different configs) +3. you modified the ovpn file and loaded it onto the client. + +**Note, when connected to your secondary VPN connection (the DNS only one), you will not get a pi-hole splash page when accessing a blocked domain directly. The page will not load or it will load with an error, and that's because we didn't route the traffic through the vpn and we didn't create an iptables rule for masquerading, so the return packets (since they are not part of the same LAN subset as your VPN-CLient-AssignedIps) get lost. From ae1f6b46b383a823879ad09d9329906b2ae68f98 Mon Sep 17 00:00:00 2001 From: RamSet Date: Thu, 31 May 2018 13:01:31 -0600 Subject: [PATCH 02/20] Update dual-VPN.md --- docs/guides/vpn/dual-VPN.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index 73eb472..3131343 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -1,4 +1,4 @@ -If you however want to run two VPN servers, one that routes the traffic and one that answers only to DNS requests, you would have to create another instance of OpenVPN. +If you want to run two VPN servers, one that routes the traffic and one that answers only to DNS requests, you would have to create another instance of OpenVPN. Why would you want to do this? From c2bc5d23040422207bfe0ce64cc9b0d90a1e9cd2 Mon Sep 17 00:00:00 2001 From: RamSet Date: Thu, 31 May 2018 13:50:02 -0600 Subject: [PATCH 03/20] Update mkdocs.yml added - 'Optional: Dual VPN (Masked and DNS only)': 'guides/vpn/dual-VPN.md' entry. --- mkdocs.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/mkdocs.yml b/mkdocs.yml index 44d1c0c..844bc77 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -61,6 +61,7 @@ pages: - 'Connecting clients': - 'General': 'guides/vpn/clients.md' - 'Android': 'guides/vpn/android-client.md' + - 'Optional: Dual VPN (Masked and DNS only)': 'guides/vpn/dual-VPN.md' - 'Optional: Only route DNS via VPN': 'guides/vpn/only-dns-via-vpn.md' - 'Optional: Dual operation: LAN & VPN at the same time': 'guides/vpn/dual-operation.md' - 'Optional: Dynamic DNS': 'guides/vpn/dynDNS.md' From 680457d36de34218c85c59080e0d5bd6b24772d6 Mon Sep 17 00:00:00 2001 From: RamSet Date: Fri, 8 Jun 2018 18:09:00 -0600 Subject: [PATCH 04/20] Re-arranged Menu options. --- mkdocs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkdocs.yml b/mkdocs.yml index 844bc77..a5a1a27 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -61,9 +61,9 @@ pages: - 'Connecting clients': - 'General': 'guides/vpn/clients.md' - 'Android': 'guides/vpn/android-client.md' - - 'Optional: Dual VPN (Masked and DNS only)': 'guides/vpn/dual-VPN.md' - 'Optional: Only route DNS via VPN': 'guides/vpn/only-dns-via-vpn.md' - 'Optional: Dual operation: LAN & VPN at the same time': 'guides/vpn/dual-operation.md' + - 'Optional: Dual VPN (Masked and DNS only)': 'guides/vpn/dual-VPN.md' - 'Optional: Dynamic DNS': 'guides/vpn/dynDNS.md' extra: social: From c7a7a7f61fd263d53fb50a85b578a180f6391b66 Mon Sep 17 00:00:00 2001 From: RamSet Date: Fri, 8 Jun 2018 18:13:57 -0600 Subject: [PATCH 05/20] Update dual-VPN.md Added sections/Titles for better page layout and reading. --- docs/guides/vpn/dual-VPN.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index 3131343..f878028 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -1,13 +1,14 @@ +### Advanced use of VPN and Pi-hole If you want to run two VPN servers, one that routes the traffic and one that answers only to DNS requests, you would have to create another instance of OpenVPN. -Why would you want to do this? - +### Why would you want to do this? Because DNS is restricted to port 53 only, you cannot use it as your own DNS outside your network unless you make it public and making a DNS server a public server, is not always the best idea and it comes with some risks. So why not use the VPN tunnel to answer to DNS queries only? No traffic goes through it, except for the DNS queries, that are answered (and tracked if you have the Admin interface installed) by your Pi-hole. You can even use the same .ovpn file, with minor modifications (no need to generate it again). +### Prerequisites and Configuration We're going to use the original configuration file and copy it and then, edit the second file: sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf sudo nano /etc/openvpn/server2.conf @@ -32,6 +33,7 @@ The next step is to edit the exisitng .ovpn file that is used for this connectio When editing the file, update the port from the provious value, to the port you set-up for the second instance of OpenVPN configuration file. +### Testing Before testing, make sure you: 1. have the port forwarded to the second instance of VPN From 932b5420de87790feb162d19178b677538f7c99e Mon Sep 17 00:00:00 2001 From: RamSet Date: Wed, 20 Jun 2018 10:52:29 -0600 Subject: [PATCH 06/20] Update dual-VPN.md --- docs/guides/vpn/dual-VPN.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index f878028..d193be4 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -1,4 +1,4 @@ -### Advanced use of VPN and Pi-hole +### Dual VPN setup - separate adblock and traffic If you want to run two VPN servers, one that routes the traffic and one that answers only to DNS requests, you would have to create another instance of OpenVPN. ### Why would you want to do this? @@ -8,7 +8,7 @@ So why not use the VPN tunnel to answer to DNS queries only? No traffic goes thr You can even use the same .ovpn file, with minor modifications (no need to generate it again). -### Prerequisites and Configuration +```Prerequisites and Configuration``` We're going to use the original configuration file and copy it and then, edit the second file: sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf sudo nano /etc/openvpn/server2.conf @@ -17,7 +17,7 @@ We'll need to change the port to a diferent one from the original, so that it do Assuming you used default port configuration, you should have 1194 as the port. You need to change this do a different value (make sure the port is available - 1195 should be) and if needed, port forward it from your router into your device. You also need to assign a different class of IPs that will server for this connection only (server line). -`server 10.9.0.0 255.255.255.0` +```server 10.9.0.0 255.255.255.0``` And make sure that the DNS requests go though the instance of OpenVPN: push "dhcp-option DNS 10.9.0.1" @@ -26,7 +26,7 @@ Save the file and run the second instance of VPN: `systemctl start openvpn@server2.service` -If your distro doesn’t have “Systemctl” you may use commands like below to start your OpenVPN with your second configuration as a daemon: +If your distro doesn’t have “systemctl” you may use commands like below to start your OpenVPN with your second configuration as a daemon: `/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2` The next step is to edit the exisitng .ovpn file that is used for this connection. @@ -34,10 +34,10 @@ The next step is to edit the exisitng .ovpn file that is used for this connectio When editing the file, update the port from the provious value, to the port you set-up for the second instance of OpenVPN configuration file. ### Testing -Before testing, make sure you: +`Before testing, make sure you:` 1. have the port forwarded to the second instance of VPN 2. ps ax | grep openvpn should show you two instances of openvpn running (with different configs) 3. you modified the ovpn file and loaded it onto the client. -**Note, when connected to your secondary VPN connection (the DNS only one), you will not get a pi-hole splash page when accessing a blocked domain directly. The page will not load or it will load with an error, and that's because we didn't route the traffic through the vpn and we didn't create an iptables rule for masquerading, so the return packets (since they are not part of the same LAN subset as your VPN-CLient-AssignedIps) get lost. +**Note, when connected to your secondary VPN connection (the DNS only one), you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it will load with an error, and that's because we didn't route the traffic through the VPN and we didn't create an iptables rule for masquerading, so the return packets (since they are not part of the same LAN subset as your VPN-CLient-AssignedIps) get lost.** From 0d09c6171e9f6e6438b1aa67cce4a3f8bba8aa25 Mon Sep 17 00:00:00 2001 From: RamSet Date: Wed, 20 Jun 2018 12:25:13 -0600 Subject: [PATCH 07/20] Update dual-VPN.md fixed --- docs/guides/vpn/dual-VPN.md | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index d193be4..f457612 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -8,36 +8,47 @@ So why not use the VPN tunnel to answer to DNS queries only? No traffic goes thr You can even use the same .ovpn file, with minor modifications (no need to generate it again). -```Prerequisites and Configuration``` +###Prerequisites and Configuration We're going to use the original configuration file and copy it and then, edit the second file: -sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf sudo nano /etc/openvpn/server2.conf +```sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf sudo nano /etc/openvpn/server2.conf``` We'll need to change the port to a diferent one from the original, so that it does not conflict with the first instance of OpenVPN Assuming you used default port configuration, you should have 1194 as the port. You need to change this do a different value (make sure the port is available - 1195 should be) and if needed, port forward it from your router into your device. You also need to assign a different class of IPs that will server for this connection only (server line). -```server 10.9.0.0 255.255.255.0``` +``` +server 10.9.0.0 255.255.255.0 +``` -And make sure that the DNS requests go though the instance of OpenVPN: push "dhcp-option DNS 10.9.0.1" +And make sure that the DNS requests go though the instance of OpenVPN: + +``` +push "dhcp-option DNS 10.9.0.1" +``` One other setting that we need to change is comment out (the already existing line) `# push "redirect-gateway def1 bypass-dhcp"`. Save the file and run the second instance of VPN: -`systemctl start openvpn@server2.service` +``` +systemctl start openvpn@server2.service +``` If your distro doesn’t have “systemctl” you may use commands like below to start your OpenVPN with your second configuration as a daemon: -`/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2` + +``` +/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2 +``` The next step is to edit the exisitng .ovpn file that is used for this connection. When editing the file, update the port from the provious value, to the port you set-up for the second instance of OpenVPN configuration file. ### Testing -`Before testing, make sure you:` +Before testing, make sure you: 1. have the port forwarded to the second instance of VPN -2. ps ax | grep openvpn should show you two instances of openvpn running (with different configs) +2. ```ps ax | grep openvpn``` should show you two instances of openvpn running (with different configs) 3. you modified the ovpn file and loaded it onto the client. **Note, when connected to your secondary VPN connection (the DNS only one), you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it will load with an error, and that's because we didn't route the traffic through the VPN and we didn't create an iptables rule for masquerading, so the return packets (since they are not part of the same LAN subset as your VPN-CLient-AssignedIps) get lost.** From f34ca46eb75b926ed2eb55bd2d71b6c6e7f01b18 Mon Sep 17 00:00:00 2001 From: RamSet Date: Wed, 20 Jun 2018 12:25:29 -0600 Subject: [PATCH 08/20] Update mkdocs.yml --- mkdocs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkdocs.yml b/mkdocs.yml index a5a1a27..476b9ec 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -63,7 +63,7 @@ pages: - 'Android': 'guides/vpn/android-client.md' - 'Optional: Only route DNS via VPN': 'guides/vpn/only-dns-via-vpn.md' - 'Optional: Dual operation: LAN & VPN at the same time': 'guides/vpn/dual-operation.md' - - 'Optional: Dual VPN (Masked and DNS only)': 'guides/vpn/dual-VPN.md' + - 'Optional: Dual VPN (Full and DNS only)': 'guides/vpn/dual-VPN.md' - 'Optional: Dynamic DNS': 'guides/vpn/dynDNS.md' extra: social: From 5240094f2b45baab8e97dbe22908353b94b4f72a Mon Sep 17 00:00:00 2001 From: RamSet Date: Mon, 25 Jun 2018 10:39:10 -0600 Subject: [PATCH 09/20] Update dual-VPN.md --- docs/guides/vpn/dual-VPN.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index f457612..9caec47 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -8,7 +8,7 @@ So why not use the VPN tunnel to answer to DNS queries only? No traffic goes thr You can even use the same .ovpn file, with minor modifications (no need to generate it again). -###Prerequisites and Configuration +### Prerequisites and Configuration We're going to use the original configuration file and copy it and then, edit the second file: ```sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf sudo nano /etc/openvpn/server2.conf``` @@ -48,7 +48,7 @@ When editing the file, update the port from the provious value, to the port you Before testing, make sure you: 1. have the port forwarded to the second instance of VPN -2. ```ps ax | grep openvpn``` should show you two instances of openvpn running (with different configs) +2. `ps ax | grep openvpn` should show you two instances of openvpn running (with different configs) 3. you modified the ovpn file and loaded it onto the client. **Note, when connected to your secondary VPN connection (the DNS only one), you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it will load with an error, and that's because we didn't route the traffic through the VPN and we didn't create an iptables rule for masquerading, so the return packets (since they are not part of the same LAN subset as your VPN-CLient-AssignedIps) get lost.** From 5b6b3bfba6d54386bf0309e9ea4583b8eb79d0ef Mon Sep 17 00:00:00 2001 From: RamSet Date: Mon, 25 Jun 2018 15:55:37 -0600 Subject: [PATCH 10/20] Update dual-VPN.md --- docs/guides/vpn/dual-VPN.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index 9caec47..e2df7f9 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -11,7 +11,9 @@ You can even use the same .ovpn file, with minor modifications (no need to gener ### Prerequisites and Configuration We're going to use the original configuration file and copy it and then, edit the second file: -```sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf sudo nano /etc/openvpn/server2.conf``` +``` +sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf sudo nano /etc/openvpn/server2.conf +``` We'll need to change the port to a diferent one from the original, so that it does not conflict with the first instance of OpenVPN From f7de8e7219da1ff07d1969fd6af585ffd01ac127 Mon Sep 17 00:00:00 2001 From: RamSet Date: Mon, 25 Jun 2018 16:54:11 -0600 Subject: [PATCH 11/20] Update dual-VPN.md --- docs/guides/vpn/dual-VPN.md | 33 ++++++++++++++------------------- 1 file changed, 14 insertions(+), 19 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index e2df7f9..1120c6c 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -1,23 +1,18 @@ ### Dual VPN setup - separate adblock and traffic -If you want to run two VPN servers, one that routes the traffic and one that answers only to DNS requests, you would have to create another instance of OpenVPN. - -### Why would you want to do this? -Because DNS is restricted to port 53 only, you cannot use it as your own DNS outside your network unless you make it public and making a DNS server a public server, is not always the best idea and it comes with some risks. - -So why not use the VPN tunnel to answer to DNS queries only? No traffic goes through it, except for the DNS queries, that are answered (and tracked if you have the Admin interface installed) by your Pi-hole. - -You can even use the same .ovpn file, with minor modifications (no need to generate it again). +If you want to run two VPN servers, one that routes the traffic and one that answers only to DNS requests, you will have to create another instance of OpenVPN. ### Prerequisites and Configuration -We're going to use the original configuration file and copy it and then, edit the second file: +We're going to use the original configuration file (`/etc/openvpn/server.conf`) and copy it, and then, edit the second file: ``` -sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf sudo nano /etc/openvpn/server2.conf +sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf +sudo nano /etc/openvpn/server2.conf ``` We'll need to change the port to a diferent one from the original, so that it does not conflict with the first instance of OpenVPN -Assuming you used default port configuration, you should have 1194 as the port. You need to change this do a different value (make sure the port is available - 1195 should be) and if needed, port forward it from your router into your device. You also need to assign a different class of IPs that will server for this connection only (server line). +Assuming you used the default port configuration, you should have 1194 as the port. You need to change this to a different value (make sure the port is available - 1195 should be) and if needed, port forward it from your router to your device. You also need to assign a different class of IPs that will serve this connection only. +Your server line should look like this: ``` server 10.9.0.0 255.255.255.0 @@ -29,28 +24,28 @@ And make sure that the DNS requests go though the instance of OpenVPN: push "dhcp-option DNS 10.9.0.1" ``` -One other setting that we need to change is comment out (the already existing line) `# push "redirect-gateway def1 bypass-dhcp"`. -Save the file and run the second instance of VPN: +One other setting that we need to change is to comment out `# push "redirect-gateway def1 bypass-dhcp"`. +Save the file and run the second instance of OpenVPN: ``` systemctl start openvpn@server2.service ``` -If your distro doesn’t have “systemctl” you may use commands like below to start your OpenVPN with your second configuration as a daemon: +If the distro doesn’t have `systemctl` you may use commands like below to start your OpenVPN with your second configuration as a daemon: ``` /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2 ``` -The next step is to edit the exisitng .ovpn file that is used for this connection. +The next step is to edit the existing .ovpn file that is used for this connection. -When editing the file, update the port from the provious value, to the port you set-up for the second instance of OpenVPN configuration file. +When editing the file, update the port from the previous value to the port you used for the second instance of OpenVPN. ### Testing -Before testing, make sure you: +Before testing, make sure: -1. have the port forwarded to the second instance of VPN +1. you have the port forwarded to the second instance of OpenVPN 2. `ps ax | grep openvpn` should show you two instances of openvpn running (with different configs) 3. you modified the ovpn file and loaded it onto the client. -**Note, when connected to your secondary VPN connection (the DNS only one), you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it will load with an error, and that's because we didn't route the traffic through the VPN and we didn't create an iptables rule for masquerading, so the return packets (since they are not part of the same LAN subset as your VPN-CLient-AssignedIps) get lost.** +**Note, when connected to your secondary VPN connection (the DNS only one), you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it will load with an error, and that's because we didn't route the traffic through the VPN and we didn't create an iptables rule for masquerading, so the return packets (since they are not part of the same LAN subset as your VPN CLient) get lost.** From 41d5ccbc7b60364854fd0bff8e4f367952b7d0bd Mon Sep 17 00:00:00 2001 From: RamSet Date: Fri, 13 Jul 2018 19:03:48 -0600 Subject: [PATCH 12/20] Update dual-VPN.md --- docs/guides/vpn/dual-VPN.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index 1120c6c..b9fdabf 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -31,7 +31,7 @@ Save the file and run the second instance of OpenVPN: systemctl start openvpn@server2.service ``` -If the distro doesn’t have `systemctl` you may use commands like below to start your OpenVPN with your second configuration as a daemon: +If your distro doesn’t have `systemctl` you may use commands like below to start OpenVPN with your second configuration as a daemon: ``` /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2 From 2bf7b3a59d68f479c99eaac687799ae2a2fd5948 Mon Sep 17 00:00:00 2001 From: Dan Schaper Date: Sat, 14 Jul 2018 07:10:50 -0700 Subject: [PATCH 13/20] Cleanup of verbiage and formatting. Signed-off-by: Dan Schaper --- docs/guides/vpn/dual-VPN.md | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index b9fdabf..9a1f0bb 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -1,37 +1,39 @@ -### Dual VPN setup - separate adblock and traffic -If you want to run two VPN servers, one that routes the traffic and one that answers only to DNS requests, you will have to create another instance of OpenVPN. +### Dual VPN Setup - Separate DNS and VPN Traffic +In order to separate VPN traffic from DNS queries you will need to run two VPN servers, one that routes the traffic and one that answers only to DNS requests. This configuration requires a second instance of OpenVPN. -### Prerequisites and Configuration -We're going to use the original configuration file (`/etc/openvpn/server.conf`) and copy it, and then, edit the second file: +#### Prerequisites and Configuration +We are going to use the original configuration file (`/etc/openvpn/server.conf`). You will copy it then edit the second file: ``` sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf sudo nano /etc/openvpn/server2.conf ``` -We'll need to change the port to a diferent one from the original, so that it does not conflict with the first instance of OpenVPN +We will need to change the port to one different from the original, so that it does not conflict with the first instance of OpenVPN + +Assuming you used the default port configuration, you should have 1194 as the port. You need to change this to a different value (make sure the port is available - 1195 should be) and if needed, port forward it from your router to your device. You will also need to assign a different class of IP addresses that will serve this connection only. -Assuming you used the default port configuration, you should have 1194 as the port. You need to change this to a different value (make sure the port is available - 1195 should be) and if needed, port forward it from your router to your device. You also need to assign a different class of IPs that will serve this connection only. Your server line should look like this: ``` server 10.9.0.0 255.255.255.0 ``` -And make sure that the DNS requests go though the instance of OpenVPN: +Make sure that the DNS requests go though the instance of OpenVPN: ``` push "dhcp-option DNS 10.9.0.1" ``` One other setting that we need to change is to comment out `# push "redirect-gateway def1 bypass-dhcp"`. + Save the file and run the second instance of OpenVPN: ``` systemctl start openvpn@server2.service ``` -If your distro doesn’t have `systemctl` you may use commands like below to start OpenVPN with your second configuration as a daemon: +*If your distribution does not have `systemctl` you may use commands like below to start OpenVPN with your second configuration as a daemon:* ``` /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2 @@ -41,11 +43,11 @@ The next step is to edit the existing .ovpn file that is used for this connectio When editing the file, update the port from the previous value to the port you used for the second instance of OpenVPN. -### Testing -Before testing, make sure: +#### Testing +Before testing, make sure that: -1. you have the port forwarded to the second instance of OpenVPN -2. `ps ax | grep openvpn` should show you two instances of openvpn running (with different configs) -3. you modified the ovpn file and loaded it onto the client. +1. Port forwarding is configured for the second instance of OpenVPN. +2. `ps ax | grep openvpn` shows two instances of OpenVPN running (with different configs). +3. The modified ovpn file is loaded on the client. -**Note, when connected to your secondary VPN connection (the DNS only one), you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it will load with an error, and that's because we didn't route the traffic through the VPN and we didn't create an iptables rule for masquerading, so the return packets (since they are not part of the same LAN subset as your VPN CLient) get lost.** +**Note: when connected to your secondary VPN connection (the DNS only one), you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it will load with an error, because we did not route the traffic through the VPN. We did not create an `iptables` rule for masquerading and the return packets (since they are not part of the same LAN subset as your VPN CLient) get lost.** From bdadcef40949f924f68058c182602a74b7029b5d Mon Sep 17 00:00:00 2001 From: Dan Schaper Date: Sat, 14 Jul 2018 11:44:58 -0700 Subject: [PATCH 14/20] More wordsmithing, added TODO task and typo check. Signed-off-by: Dan Schaper --- docs/guides/vpn/dual-VPN.md | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index 9a1f0bb..cc9e126 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -1,17 +1,24 @@ ### Dual VPN Setup - Separate DNS and VPN Traffic -In order to separate VPN traffic from DNS queries you will need to run two VPN servers, one that routes the traffic and one that answers only to DNS requests. This configuration requires a second instance of OpenVPN. +In order to separate VPN traffic from DNS queries you will need to run two VPN servers. One server routes the normal user traffic and the second routes only DNS requests. This can be done with two OpenVPN configurations. #### Prerequisites and Configuration -We are going to use the original configuration file (`/etc/openvpn/server.conf`). You will copy it then edit the second file: +You should have an existing OpenVPN server configured and running. We are going to use the original configuration file located at `/etc/openvpn/server.conf`. -``` +First, copy the file: + +```bash sudo cp /etc/openvpn/server.conf /etc/openvpn/server2.conf +``` + +Next, exit the new copy of the configuration. We use the `nano` editor in this example, but any editor will work. Remember to edit under the root account via `sudo`. + +```bash sudo nano /etc/openvpn/server2.conf ``` -We will need to change the port to one different from the original, so that it does not conflict with the first instance of OpenVPN +We will need to change the port to one different from the original, so that it does not conflict with the first instance of OpenVPN. Assuming you used the default port configuration, you should have 1194 as the port. You need to change this to a different value, making sure the port is available - 1195 should be. -Assuming you used the default port configuration, you should have 1194 as the port. You need to change this to a different value (make sure the port is available - 1195 should be) and if needed, port forward it from your router to your device. You will also need to assign a different class of IP addresses that will serve this connection only. +Nex, if needed, port forward the newly configured port from your router to your device. You will also need to assign a different class of IP addresses that will serve this connection only. Your server line should look like this: @@ -25,9 +32,9 @@ Make sure that the DNS requests go though the instance of OpenVPN: push "dhcp-option DNS 10.9.0.1" ``` -One other setting that we need to change is to comment out `# push "redirect-gateway def1 bypass-dhcp"`. +One other setting that we need to change is to comment out `# push "redirect-gateway def1 bypass-dhcp"`. TODO -- Explain why this is needed. -Save the file and run the second instance of OpenVPN: +Save the file and start the second instance of OpenVPN: ``` systemctl start openvpn@server2.service @@ -39,9 +46,7 @@ systemctl start openvpn@server2.service /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2 ``` -The next step is to edit the existing .ovpn file that is used for this connection. - -When editing the file, update the port from the previous value to the port you used for the second instance of OpenVPN. +Finally, edit the existing `.ovpn` file that is used for this connection. Update the port from the previous value to the port you used for the second instance of OpenVPN. #### Testing Before testing, make sure that: @@ -50,4 +55,4 @@ Before testing, make sure that: 2. `ps ax | grep openvpn` shows two instances of OpenVPN running (with different configs). 3. The modified ovpn file is loaded on the client. -**Note: when connected to your secondary VPN connection (the DNS only one), you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it will load with an error, because we did not route the traffic through the VPN. We did not create an `iptables` rule for masquerading and the return packets (since they are not part of the same LAN subset as your VPN CLient) get lost.** +**Note: when connected to your DNS only VPN connection you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it may load with an error. This is because the web server traffic is not routed through the VPN. We did not create an `iptables` rule for masquerading and the return packets (since they are not part of the same LAN subset as your VPN Client) are prevented.** \ No newline at end of file From d8b2ee8894d7947c16021ae9955d162fed107cdc Mon Sep 17 00:00:00 2001 From: Dan Schaper Date: Sat, 14 Jul 2018 12:13:57 -0700 Subject: [PATCH 15/20] Fulfilling requested changes. Signed-off-by: Dan Schaper --- docs/guides/vpn/dual-VPN.md | 2 +- mkdocs.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index cc9e126..07bbe8c 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -18,7 +18,7 @@ sudo nano /etc/openvpn/server2.conf We will need to change the port to one different from the original, so that it does not conflict with the first instance of OpenVPN. Assuming you used the default port configuration, you should have 1194 as the port. You need to change this to a different value, making sure the port is available - 1195 should be. -Nex, if needed, port forward the newly configured port from your router to your device. You will also need to assign a different class of IP addresses that will serve this connection only. +Next, if needed, port forward the newly configured port from your router to your device. You will also need to assign a different class of IP addresses that will serve this connection only. Your server line should look like this: diff --git a/mkdocs.yml b/mkdocs.yml index 476b9ec..376cdbb 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -63,7 +63,7 @@ pages: - 'Android': 'guides/vpn/android-client.md' - 'Optional: Only route DNS via VPN': 'guides/vpn/only-dns-via-vpn.md' - 'Optional: Dual operation: LAN & VPN at the same time': 'guides/vpn/dual-operation.md' - - 'Optional: Dual VPN (Full and DNS only)': 'guides/vpn/dual-VPN.md' + - 'Optional: Dual VPN (Full and DNS-only)': 'guides/vpn/dual-VPN.md' - 'Optional: Dynamic DNS': 'guides/vpn/dynDNS.md' extra: social: From 7eb84d27e646689e6b63556009ec02460c69051e Mon Sep 17 00:00:00 2001 From: RamSet Date: Sat, 14 Jul 2018 13:20:12 -0600 Subject: [PATCH 16/20] Update dual-VPN.md --- docs/guides/vpn/dual-VPN.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index 07bbe8c..79fed01 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -32,7 +32,7 @@ Make sure that the DNS requests go though the instance of OpenVPN: push "dhcp-option DNS 10.9.0.1" ``` -One other setting that we need to change is to comment out `# push "redirect-gateway def1 bypass-dhcp"`. TODO -- Explain why this is needed. +One other setting that we need to change is to comment out `# push "redirect-gateway def1 bypass-dhcp"`. Commenting out this line, ensures that no traffic is routed via the VPN server. Save the file and start the second instance of OpenVPN: @@ -55,4 +55,4 @@ Before testing, make sure that: 2. `ps ax | grep openvpn` shows two instances of OpenVPN running (with different configs). 3. The modified ovpn file is loaded on the client. -**Note: when connected to your DNS only VPN connection you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it may load with an error. This is because the web server traffic is not routed through the VPN. We did not create an `iptables` rule for masquerading and the return packets (since they are not part of the same LAN subset as your VPN Client) are prevented.** \ No newline at end of file +**Note: when connected to your DNS only VPN connection you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it may load with an error. This is because the web server traffic is not routed through the VPN. We did not create an `iptables` rule for masquerading and the return packets (since they are not part of the same LAN subset as your VPN Client) are prevented.** From 0a6c3faa1f4354f545e63097205bb989f4b62a10 Mon Sep 17 00:00:00 2001 From: RamSet Date: Sat, 14 Jul 2018 13:25:28 -0600 Subject: [PATCH 17/20] Update mkdocs.yml --- mkdocs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mkdocs.yml b/mkdocs.yml index 376cdbb..9a69d0b 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -63,7 +63,7 @@ pages: - 'Android': 'guides/vpn/android-client.md' - 'Optional: Only route DNS via VPN': 'guides/vpn/only-dns-via-vpn.md' - 'Optional: Dual operation: LAN & VPN at the same time': 'guides/vpn/dual-operation.md' - - 'Optional: Dual VPN (Full and DNS-only)': 'guides/vpn/dual-VPN.md' + - 'Optional: Full and DNS-only': 'guides/vpn/dual-VPN.md' - 'Optional: Dynamic DNS': 'guides/vpn/dynDNS.md' extra: social: From 0b96e81a59dc69040facf0d61cfcbb7bcec3b367 Mon Sep 17 00:00:00 2001 From: Dan Schaper Date: Sat, 14 Jul 2018 14:49:09 -0700 Subject: [PATCH 18/20] Modifications per PR review Signed-off-by: Dan Schaper --- docs/guides/vpn/dual-VPN.md | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index 79fed01..55d629c 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -32,21 +32,27 @@ Make sure that the DNS requests go though the instance of OpenVPN: push "dhcp-option DNS 10.9.0.1" ``` -One other setting that we need to change is to comment out `# push "redirect-gateway def1 bypass-dhcp"`. Commenting out this line, ensures that no traffic is routed via the VPN server. +One other setting that we need to change is to comment out the `bypass-dhcp` instruction so that it looks like below: + +``` +# push "redirect-gateway def1 bypass-dhcp"`. +``` + +Commenting out this line, ensures that no traffic is routed via the VPN server. Save the file and start the second instance of OpenVPN: -``` +```bash systemctl start openvpn@server2.service ``` -*If your distribution does not have `systemctl` you may use commands like below to start OpenVPN with your second configuration as a daemon:* +*If your distribution does not have `systemctl` you may use commands below to start OpenVPN with your second configuration as a daemon:* -``` +```bash /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2 ``` -Finally, edit the existing `.ovpn` file that is used for this connection. Update the port from the previous value to the port you used for the second instance of OpenVPN. +Finally, edit the existing `.ovpn` file used for the client connection. Update the port from the previous value to the port you used for the second instance of OpenVPN. #### Testing Before testing, make sure that: @@ -55,4 +61,4 @@ Before testing, make sure that: 2. `ps ax | grep openvpn` shows two instances of OpenVPN running (with different configs). 3. The modified ovpn file is loaded on the client. -**Note: when connected to your DNS only VPN connection you will not get a Pi-hole splash page when accessing a blocked domain directly. The page will not load or it may load with an error. This is because the web server traffic is not routed through the VPN. We did not create an `iptables` rule for masquerading and the return packets (since they are not part of the same LAN subset as your VPN Client) are prevented.** +*Note: when connected to your DNS only VPN connection **you will not get a Pi-hole splash page when accessing a blocked domain directly.** The page will not load or it may load with an error. **This is because the web server traffic is not routed through the VPN.** We did not create an `iptables` rule for masquerading, and the return packets (since they are not part of the same LAN subset as your VPN Client) are prevented.* From b2557b23ee3e897581f2730013a70ae8587b1dbf Mon Sep 17 00:00:00 2001 From: Dan Schaper Date: Sat, 14 Jul 2018 14:58:32 -0700 Subject: [PATCH 19/20] Futher Modifications per PR review Signed-off-by: Dan Schaper --- docs/guides/vpn/dual-VPN.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index 55d629c..b49cdd1 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -32,13 +32,13 @@ Make sure that the DNS requests go though the instance of OpenVPN: push "dhcp-option DNS 10.9.0.1" ``` -One other setting that we need to change is to comment out the `bypass-dhcp` instruction so that it looks like below: +One other setting that we need to change is to comment out the `bypass-dhcp` instruction so that it looks like: ``` # push "redirect-gateway def1 bypass-dhcp"`. ``` -Commenting out this line, ensures that no traffic is routed via the VPN server. +Commenting out this line ensures that no traffic is routed via the VPN server. Save the file and start the second instance of OpenVPN: @@ -46,7 +46,7 @@ Save the file and start the second instance of OpenVPN: systemctl start openvpn@server2.service ``` -*If your distribution does not have `systemctl` you may use commands below to start OpenVPN with your second configuration as a daemon:* +*If your distribution does not have `systemctl` you may use command below to start OpenVPN with your second configuration as a daemon:* ```bash /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2 From fc559ac7f9dc8ab952446e1d43fe9569902b4bed Mon Sep 17 00:00:00 2001 From: Dan Schaper Date: Sat, 14 Jul 2018 15:03:52 -0700 Subject: [PATCH 20/20] Futher Modifications per PR review Signed-off-by: Dan Schaper --- docs/guides/vpn/dual-VPN.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/guides/vpn/dual-VPN.md b/docs/guides/vpn/dual-VPN.md index b49cdd1..728ad04 100644 --- a/docs/guides/vpn/dual-VPN.md +++ b/docs/guides/vpn/dual-VPN.md @@ -46,7 +46,7 @@ Save the file and start the second instance of OpenVPN: systemctl start openvpn@server2.service ``` -*If your distribution does not have `systemctl` you may use command below to start OpenVPN with your second configuration as a daemon:* +*If your distribution does not have `systemctl` you may use the command below to start an OpenVPN daemon with your second configuration:* ```bash /usr/sbin/openvpn --daemon --writepid /var/run/openvpn/server2.pid --cd /etc/openvpn --config server2.conf --script-security 2