Question VPN gateway ethernet #956

asyba · 2021-07-11T04:49:18Z

asyba
Jul 11, 2021

Can I use VPN gateway with this raspAP?
Using the ethernet port? not the wifi?

Answered by asyba

Jul 16, 2021

it kind of worked, but is not what I was expecting to be, so I will discard using like this.

View full answer

asyba · 2021-07-11T04:59:38Z

asyba
Jul 11, 2021
Author

to add more information:

my RPI 4 now has:
docker compose pi-hole (my router to this dns so all devices don't have ads)
docker compose homebridge

What I want:
VPN gateway:
To use nordVPN / expressVPN or another provider.
And use the same dns pi-hole to block ads.

The VPN main use for me is for streaming not need for encryption/security.

I want to choose which devices I want to use this VPN, I don't want the whole network I just want some IPs.
(special for 2 Apple TV and one notebook to access content from US, I'm from Argentina.)

I want also to have a way to turn off the VPN of the chosen devices, I don't want to be always enable VPN.

Note: Apple TV doesn't have VPN configuration or apps for VPN.

I have a usb3-ethernet adaptar , can I use this Adapter for RaspAP so then my appleTV gateway IP uses the usb3 IP and uses the openvpn with RaspAP?
and then the stock ethernet port from RPI works as now, just pihole dns.

3 replies

billz Jul 13, 2021
Maintainer

Can I use VPN gateway with this raspAP?
Using the ethernet port? not the wifi?

In a roundabout way, yes.

RaspAP's OpenVPN implementation works with the configured AP interface. The script configauth.sh handles NAT and forwarding with iptables. This takes an $interface argument from the application. Setting the AP interface to eth0 and starting OpenVPN with RaspAP will configure iptables for this interface.

asyba Jul 13, 2021
Author

I did that but is not working
eth0 is where the RPI is connected to router.
eth1 is connected to AppleTV
I set eth1 as AP interface

Note: I tried to start hotspot, but is not doing that.

check this images:

asyba Jul 13, 2021
Author

logs

Configuration file: /etc/hostapd/hostapd.conf
nl80211: Could not configure driver mode
nl80211: deinit ifname=eth1 disabled_11b_rates=0
nl80211 driver initialization failed.
eth1: interface state UNINITIALIZED->DISABLED
eth1: AP-DISABLED
eth1: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface eth1 wasn't started
Configuration file: /etc/hostapd/hostapd.conf
nl80211: Could not configure driver mode
nl80211: deinit ifname=eth1 disabled_11b_rates=0
nl80211 driver initialization failed.
eth1: interface state UNINITIALIZED->DISABLED
eth1: AP-DISABLED
eth1: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface eth1 wasn't started
Configuration file: /etc/hostapd/hostapd.conf
nl80211: Could not configure driver mode
nl80211: deinit ifname=eth1 disabled_11b_rates=0
nl80211 driver initialization failed.
eth1: interface state UNINITIALIZED->DISABLED
eth1: AP-DISABLED
eth1: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface eth1 wasn't started
Configuration file: /etc/hostapd/hostapd.conf
nl80211: Could not configure driver mode
nl80211: deinit ifname=eth1 disabled_11b_rates=0
nl80211 driver initialization failed.
eth1: interface state UNINITIALIZED->DISABLED
eth1: AP-DISABLED
eth1: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface eth1 wasn't started
Configuration file: /etc/hostapd/hostapd.conf
nl80211: Could not configure driver mode
nl80211: deinit ifname=eth1 disabled_11b_rates=0
nl80211 driver initialization failed.
eth1: interface state UNINITIALIZED->DISABLED
eth1: AP-DISABLED
eth1: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface eth1 wasn't started
Configuration file: /etc/hostapd/hostapd.conf
nl80211: Could not configure driver mode
nl80211: deinit ifname=eth1 disabled_11b_rates=0
nl80211 driver initialization failed.
eth1: interface state UNINITIALIZED->DISABLED
eth1: AP-DISABLED
eth1: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface eth1 wasn't started
Configuration file: /etc/hostapd/hostapd.conf
nl80211: Could not configure driver mode
nl80211: deinit ifname=eth1 disabled_11b_rates=0
nl80211 driver initialization failed.
eth1: interface state UNINITIALIZED->DISABLED
eth1: AP-DISABLED
eth1: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface eth1 wasn't started
Configuration file: /etc/hostapd/hostapd.conf
nl80211: Could not configure driver mode
nl80211: deinit ifname=eth1 disabled_11b_rates=0
nl80211 driver initialization failed.
eth1: interface state UNINITIALIZED->DISABLED
eth1: AP-DISABLED
eth1: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface eth1 wasn't started

billz · 2021-07-13T16:48:03Z

billz
Jul 13, 2021
Maintainer

You're attempting to start the hotspot with eth1, which isn't an AP-capable interface.

In your case I'd suggest setting the interface manually in configauth. You can find it in /etc/raspap/openvpn/configauth.sh

2 replies

asyba Jul 13, 2021
Author

You're attempting to start the hotspot with eth1, which isn't an AP-capable interface.

In your case I'd suggest setting the interface manually in configauth. You can find it in /etc/raspap/openvpn/configauth.sh

ohh I see, I should set back to wlan start hotspot and then change the interface from configauth?

asyba Jul 13, 2021
Author

@billz
done
openvpn is up
but how to setup proper IP,gateway,etc to the apple tv? still is showing generic IP data
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether d0:37:45:a7:73:c8 brd ff:ff:ff:ff:ff:ff
inet 169.254.28.54/16 brd 169.254.255.255 scope global noprefixroute eth1

5: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 10.8.8.7/24 brd 10.8.8.255 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::3ab2:e70a:694:3a30/64 scope link stable-privacy
valid_lft forever preferred_lft forever

Bostonvex · 2021-07-16T12:10:15Z

Bostonvex
Jul 16, 2021

Your tunnel traffic is sent to eth1. It should go to eth0 based on your config. eth1 has an APIPA address. Automatic Private IP Addressing (APIPA) starts with 169.254. These IP addresses are only useful on local networks, not the internet. If you want it to go out eth1 then assign a valid IP to eth1 and configure routing etc.

I use the Raspberry Pi ExpressVPN client on my RaspAP for streaming content from the UK as I'm in the US, I'm a rugby fan and rugby broadcasting is very limited in the US. I found that the default ExpressVPN client plays well with RaspAP and I do not use OpenVPN. I use RaspAP's DHCP server to provide IPs to the clients connecting to the RaspAP.

Roku connects to RaspAP Streaming SSID (Pi is dedicated to RaspAP)
RaspAP uses ExpressVPN client to connect to desired location for streaming
ExpressVPN handles VPN and iptables config
RaspAP serves DHCP to local clients connecting to SSID via dnsmasq.

Setup was simple.

Install fresh Raspberry Pi OS
Install RaspAP
Install ExpressVPN client
Start ExpressVPN client with script and script updates dnsmasq and /etc/resolv.conf configs
Client then connects to streaming SSID and gets IP config from DHCP

One thing to note is that ExpressVPN creates an iptables config and that I had to write a very rudimentary shell script to pull the VPN tunnel DNS server IP from iptables and then update dnsmasq config to ensure that my DHCP client gets the latest DNS IP otherwise DNS doesn't work...I'm assuming the iptables rules are there to prevent DNS leak. I'm not a developer so the bash script is dirty, has redundancies, no error checking etc. but should give you an idea of what I'm doing.

#connect to VPN server
expressvpn connect "United Kingdom"
sleep 2

#Get DNS server IP and update RaspAP /etc/resolv.conf
echo " "
echo "Get DNS server from IPTables and update resolv.conf."
sudo iptables -S | grep "xvpn_dns_ip_exceptions -d" | awk '$4!="xvpn_dns_ip_exceptions"{print "nameserver "$4}' | cut -d/ -f1 | sudo tee /etc/resolv.conf

#Update dnsmasq dhcp config to provide VPN DNS to clients
sleep 1
echo " "
echo "Update dnsmasq config with new VPN DNS value for DHCP."

DNSIP=$( sudo iptables -S | grep "xvpn_dns_ip_exceptions -d" | awk '$4!="xvpn_dns_ip_exceptions"{print $4}' | cut -d/ -f1)
echo "DNS IP is $DNSIP."
sudo sed -i "/dhcp-option/s/=6,.*/=6,$DNSIP/" /etc/dnsmasq.d/090_wlan0.conf

#Restart dnsmasq
echo " "
echo "Stopping dnsmasq"
sudo systemctl stop dnsmasq.service

echo " "
echo "Starting dnsmasq"
sudo systemctl start dnsmasq.service

Below is an example of the iptables config that is created by ExpressVPN

pi@raspberrypi:~ $ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N xvpn
-N xvpn_dns
-N xvpn_dns_iface_exceptions
-N xvpn_dns_ip_exceptions
-N xvpn_ks
-N xvpn_ks_iface_exceptions
-N xvpn_ks_ip_exceptions
-A OUTPUT -j xvpn
-A xvpn -j xvpn_dns
-A xvpn -j xvpn_ks
-A xvpn_dns -j xvpn_dns_iface_exceptions
-A xvpn_dns -j xvpn_dns_ip_exceptions
-A xvpn_dns ! -o lo -p udp -m udp --dport 53 -j DROP
-A xvpn_dns_ip_exceptions -d 10.112.0.1/32 -p udp -m udp --dport 53 -j ACCEPT
-A xvpn_ks -j xvpn_ks_iface_exceptions
-A xvpn_ks -j xvpn_ks_ip_exceptions
-A xvpn_ks -p udp -m udp --dport 67:68 -j ACCEPT
-A xvpn_ks ! -o lo -j DROP
-A xvpn_ks_iface_exceptions -o tun0 -j ACCEPT
-A xvpn_ks_ip_exceptions -d 10.0.0.0/8 -j ACCEPT
-A xvpn_ks_ip_exceptions -d 172.16.0.0/12 -j ACCEPT
-A xvpn_ks_ip_exceptions -d 192.168.0.0/16 -j ACCEPT
-A xvpn_ks_ip_exceptions -d 169.254.0.0/16 -j ACCEPT
-A xvpn_ks_ip_exceptions -d 224.0.0.0/24 -j ACCEPT
-A xvpn_ks_ip_exceptions -d 185.198.191.198/32 -j ACCEPT
pi@raspberrypi:~ $

0 replies

asyba · 2021-07-16T12:31:41Z

asyba
Jul 16, 2021
Author

it kind of worked, but is not what I was expecting to be, so I will discard using like this.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Question VPN gateway ethernet #956

{{title}}

Replies: 3 comments 5 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

Question VPN gateway ethernet #956

asyba Jul 11, 2021

Replies: 3 comments · 5 replies

asyba Jul 11, 2021 Author

billz Jul 13, 2021 Maintainer

asyba Jul 13, 2021 Author

asyba Jul 13, 2021 Author

billz Jul 13, 2021 Maintainer

asyba Jul 13, 2021 Author

asyba Jul 13, 2021 Author

Bostonvex Jul 16, 2021

asyba Jul 16, 2021 Author

asyba
Jul 11, 2021

Replies: 3 comments 5 replies

asyba
Jul 11, 2021
Author

billz Jul 13, 2021
Maintainer

asyba Jul 13, 2021
Author

asyba Jul 13, 2021
Author

billz
Jul 13, 2021
Maintainer

asyba Jul 13, 2021
Author

asyba Jul 13, 2021
Author

Bostonvex
Jul 16, 2021

asyba
Jul 16, 2021
Author