{"id":2114,"date":"2022-04-23T20:07:19","date_gmt":"2022-04-23T20:07:19","guid":{"rendered":"https:\/\/picockpit.com\/raspberry-pi\/?p=2114"},"modified":"2023-08-28T09:24:04","modified_gmt":"2023-08-28T09:24:04","slug":"how-to-set-up-a-vpn-with-raspberry-pi-for-remote-working","status":"publish","type":"post","link":"https:\/\/picockpit.com\/raspberry-pi\/es\/como-configurar-una-vpn-con-raspberry-pi-para-trabajar-de-forma-remota\/","title":{"rendered":"Configurar un servidor VPN con Raspberry Pi"},"content":{"rendered":"\n
\"raspberry<\/figure>\n\n\n\n

This article covers how to turn your Raspberry Pi into a VPN server.<\/p>\n\n\n\n

I was inspired when one of my friends was going away on a long trip and wanted a VPN.<\/p>\n\n\n\n

The benefit of having a VPN, he explained, was that it allowed him to access his home network and files.<\/p>\n\n\n\n

That\u2019s pretty standard.<\/p>\n\n\n\n

He also mentioned that he\u2019d have an easier time logging into banking apps and other services if he logs in through his home network.<\/p>\n\n\n\n

Having an overseas IP address throws red flags and it would cause him to need to do Captcha tests and 2FAs.<\/p>\n\n\n\n

So that made me think of whether the Raspberry Pi would work in this case.<\/p>\n\n\n\n\n\n

Check your router first<\/h2>\n\n\n\n

An important detail here is to check whether your router can act as a VPN server.<\/p>\n\n\n\n

That would be the most reliable solution. Frankly, it was also the easiest and least tedious solution.<\/p>\n\n\n\n

I have a TP-Link Archer C7 which has the ability to run a VPN server using OpenVPN or PPTP VPN. In less than five minutes, I followed the instructions<\/a> and managed to get it running. <\/p>\n\n\n\n

Then all I had to do was install OpenVPN on my devices and use the configuration file.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

If, however, you have a router that doesn\u2019t support VPN connections, then follow along\u2026<\/p>\n\n\n\n

What do I need to create a Raspberry Pi server?<\/h2>\n\n\n
\n
\"Ethernet
Ethernet cable, Raspberry Pi and router<\/figcaption><\/figure>\n<\/div>\n\n\n

First and foremost, you will need a Raspberry Pi. <\/p>\n\n\n\n

It would be ideal to have a Raspberry Pi with a wired ethernet connection such as the Raspberry Pi 4 for maximum reliability and speed.<\/p>\n\n\n\n

If you choose these devices, then, you will need an ethernet cable to connect the Raspberry Pi to your router.<\/p>\n\n\n\n

And in order to ensure your Raspberry Pi is connected via wired ethernet, you should disable the wireless connection.<\/p>\n\n\n\n

However, PiVPN has successfully run on a Zero-series Raspberry Pi, so you could use that too.<\/p>\n\n\n\n

Install PiVPN<\/h2>\n\n\n
\n
\"PiVPN
PiVPN logo<\/figcaption><\/figure>\n<\/div>\n\n\n

Head to pivpn.io<\/a> for more information about the software.<\/p>\n\n\n\n

To install it, run the installation command curl -L https:\/\/install.pivpn.io | bash <\/strong>in your Terminal.<\/p>\n\n\n\n

This step can take a while, but once it\u2019s done, you will see this intro screen.<\/p>\n\n\n\n

DHCP Reservation<\/h2>\n\n\n\n

The PiVPN is a server, so it needs to have a static IP address to function properly. <\/p>\n\n\n\n

If you are able to create a DHCP reservation\u2026<\/h3>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

Not all routers allow you to create a DHCP reservation, so if you can’t find a section for this setting, skip to the next section.<\/p>\n\n\n\n

I have a separate modem and a router that I bought so I could create a DHCP reservation to ensure PiVPN is on the same IP address all the time.<\/p>\n\n\n\n

Every router is a bit different, so you\u2019d have to Google the exact instructions for creating a DHCP reservation for your router.<\/p>\n\n\n\n

In case you use a TP-Link Archer C7, like I do, you\u2019d go to Advanced > Network > DHCP Server<\/strong>.<\/p>\n\n\n\n

Under the Address Reservation<\/strong> section, I clicked on Add<\/strong>. I needed my MAC Address (not shown in PiVPN) and the IP address provided by PiVPN.<\/p>\n\n\n\n

Finding your MAC Address<\/h4>\n\n\n
\n
\"finding
You can usually find your Raspberry Pi’s MAC address through your router or use ifconfig<\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n

There are two ways you can find your MAC address. <\/p>\n\n\n\n

Most conveniently, my TP-Link router displayed my MAC address \u201cDC-A6-32-88-AC-97\u201d in the table of DHCP clients.<\/p>\n\n\n\n

Alternatively, you can open up a Terminal and type in ifconfig<\/strong>.<\/p>\n\n\n\n

Since you\u2019re connected via wired ethernet, look for \u201ceth0\u201d and on the line where it says ether<\/strong>, that\u2019s where your MAC address is.<\/p>\n\n\n\n

If you can\u2019t create a DHCP reservation,<\/h3>\n\n\n
\n
\"dhcp<\/figure>\n<\/div>\n\n\n

In this menu, press \u201cNo\u201d to set up a static IP address.<\/p>\n\n\n\n

In the next menu, you will need to configure your static IP address to something that is not within the range of IP addresses that your router will assign devices.<\/p>\n\n\n\n

For example, my router assigns connected devices an IP address 192.168.0.100 to 192.168.0.249. So, I can assign PiVPN an IP address of 192.168.0.250.<\/p>\n\n\n\n

It\u2019ll then ask you for the gateway IP address. You can leave this as default unless you have a different gateway. It\u2019s usually the IP address of your router.<\/p>\n\n\n\n

Finally, press OK on PiVPN until you reach the \u201cLocal Users\u201d page.<\/p>\n\n\n\n

Local users<\/h2>\n\n\n\n

In the \u201cChoose A User\u201d page, I chose the one and only user, pi.<\/p>\n\n\n\n

In the latest updates of the Raspberry Pi OS, you no longer have \u201cpi\u201d as a default user, so just be aware.<\/p>\n\n\n\n

Press OK.<\/p>\n\n\n\n

Installation Mode<\/h2>\n\n\n
\n
\"raspberry<\/figure>\n<\/div>\n\n\n

Here, it\u2019ll ask you whether you want to use WireGuard or OpenVPN. I went with WireGuard because it was recommended.<\/p>\n\n\n\n

Default Wireguard Port<\/h2>\n\n\n\n

Unless you need another port, you can just press OK and use the default 51820 port.<\/p>\n\n\n\n

DNS Provider<\/h2>\n\n\n
\n
\"choose<\/figure>\n<\/div>\n\n\n

There are many choices for DNS providers here and I just went with Google for the ease of set up.<\/p>\n\n\n\n

Public IP or DNS<\/h2>\n\n\n\n

What you\u2019re seeing here is your public IP address and this will be the IP address you\u2019ll use to connect to your VPN.<\/p>\n\n\n\n

Unattended Upgrades<\/h2>\n\n\n
\n
\"unattended<\/figure>\n<\/div>\n\n\n

I enabled unattended upgrades because I wanted the security upgrades. <\/p>\n\n\n\n

Time to add client profiles<\/h2>\n\n\n
\n
\"Use
Use pivpn add<\/strong> to add a client, then use pivpn -qr <\/strong>to get a QR code for your phone to scan<\/figcaption><\/figure>\n<\/div>\n\n\n

Sweet! You\u2019ve made it to the \u201cInstallation Complete\u201d menu.<\/p>\n\n\n\n

Setting PiVPN up on the Raspberry Pi is half the battle. The next half is configuring your client profiles so that you can connect computers, phones and other devices to it.<\/p>\n\n\n\n

Here\u2019s how:<\/p>\n\n\n\n

Open up a Terminal and type \u201cpivpn add\u201d<\/p>\n\n\n\n

Enter a name for the client. You can use something like \u201cclient1\u201d, \u201cclient2\u201d or something more intuitive like \u201csmartphone\u201d, \u201ctelevision\u201d, etc.<\/p>\n\n\n\n

Press Enter.<\/p>\n\n\n\n

When it\u2019s done, you will see a message saying it\u2019s done.<\/p>\n\n\n\n

PiVPN would have generated a .conf file that you can use with Wireguard apps.<\/p>\n\n\n\n

However, there\u2019s an even easier way to get the configuration onto your phone.<\/p>\n\n\n\n

Setting up an Android phone<\/h3>\n\n\n\n

In the same terminal, enter pivpn -qr<\/strong><\/p>\n\n\n\n

Then, enter the client that you want. There\u2019s only one right now named \u201csmartphone\u201d.<\/p>\n\n\n\n

So, enter \u201csmartphone\u201d and press enter.<\/p>\n\n\n\n

If everything goes well, you will see a QR code that you can scan with the Wireguard app on your smartphone.<\/p>\n\n\n

\n
\"Encoding
Encoding problems leads to a garbled PiVPN QR code<\/figcaption><\/figure>\n<\/div>\n\n\n

However, if it doesn\u2019t, it will look garbled. This is because the encoding of your Terminal is wrong.<\/p>\n\n\n\n

If this happens to you, you can copy the smartphone.conf file onto your phone and point the Wireguard app to the file.<\/p>\n\n\n

\n
\"wireguard
Wireguard Android app scanning QR code<\/figcaption><\/figure>\n<\/div>\n\n\n

Another way is to try to ssh into the Raspberry Pi and run the command qrencode -t ansiutf8 < \/home\/pi\/configs\/smartphone.conf <\/strong>(change \u201csmartphone\u201d to whatever you named your client).<\/p>\n\n\n\n

The QR code was generated successfully when I used ssh on my Windows computer.<\/p>\n\n\n\n

Setting up WireGuard on your computer<\/h3>\n\n\n\n

There are two things you need to do. Download the WireGuard app for your computer and also get the .conf file from your Raspberry Pi.<\/p>\n\n\n\n

You can download the WireGuard app for Windows, Linux and Mac here<\/a>.<\/p>\n\n\n\n

Once you have that, create a new profile by using pivpn add<\/strong>. <\/p>\n\n\n\n

Type in the name of your config file. I used msi-pc<\/strong>, which generates a msi-pc.conf<\/strong> file.<\/p>\n\n\n\n

In order to copy the file to your PC, the easiest way is to copy it using a command. You should have SSH access enabled on the Raspberry Pi OS.<\/p>\n\n\n\n

If you are on Windows like I am, you would use this command:<\/p>\n\n\n\n

pscp.exe [your-user-name]<\/strong>@[your-pi-ip-address]<\/strong>:\/home\/pi\/configs\/[wireguard file].conf<\/strong> [local-dir]<\/strong><\/p>\n\n\n\n

Here\u2019s what mine turned out to be like:<\/p>\n\n\n\n

pscp.exe pi@192.168.0.241:\/home\/pi\/configs\/msi-pc.conf<\/strong><\/p>\n\n\n\n

In the app, press \u201cAdd Tunnel\u201d and locate your .conf file.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Activate and you are done!<\/p>\n\n\n\n

Setup port forwarding on your router<\/h2>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

If you\u2019ve followed the steps up until now, you will be able to enable the toggle on your Wireguard app, but you won\u2019t be able to get on the internet.<\/p>\n\n\n\n

That\u2019s because you need to configure your router so that it points traffic accessing port 51820 to your Raspberry Pi.<\/p>\n\n\n\n

In order to do this, go to the port forwarding menu on your router. On my TP-Link Archer router, it was accessible in Advanced > NAT Forwarding > Virtual Servers<\/strong>.<\/p>\n\n\n\n

You\u2019ll know you\u2019re in the right place when it asks you for an external and internal port and an internal IP address.<\/p>\n\n\n\n

This screen is basically asking, \u201cif we get traffic from the interwebs using port 51820, which device do we send it to and which port?.<\/p>\n\n\n\n

In this case, the external and internal ports are 51820<\/strong>, Wireguard\u2019s default. Protocol is UDP<\/strong> and Internal IP <\/strong>is your Pi\u2019s IP address.<\/p>\n\n\n\n

How do I know my VPN is working?<\/h2>\n\n\n
\n
\"testing<\/figure>\n<\/div>\n\n\n

You’ll know your VPN is working if your IP address changes.<\/p>\n\n\n\n

In order to test my smartphone’s VPN connection, I first went to find my IP address before I connected to the VPN.<\/p>\n\n\n\n

The VPN said my address was XXX.XX.88.241<\/p>\n\n\n\n

I connected to my VPN and my IP address changed to XXX.XXX.169.39.<\/p>\n\n\n\n

So, if there is a change in your IP address, that means that you have successfully connected.<\/p>\n\n\n\n

There are many services out there. You could even just Google “what is my IP address” and Google might be able to tell you on the search result page. Or else, I used whatismyip.com<\/a>.<\/p>\n\n\n\n

What happens if my internet IP changes?<\/h2>\n\n\n\n

Sometimes, you might not get the same IP address when you reset your router. Power outages, accidental yanks of power cords can happen. <\/p>\n\n\n\n

The question is\u2026 how do you find your new IP address when you\u2019re not at home and desperately need to connect to your VPN?<\/p>\n\n\n\n

Our software PiCockpit<\/strong> makes it easy to find out what your public IP is.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

In the screenshot above, that is my public IP. If it ever changes, you can update your .conf files with the new endpoint address.<\/p>\n\n\n\n

PiCockpit will also allow you to reboot and diagnose issues with your Raspberry Pi remotely through its web interface.<\/p>\n\n\n\n

Follow this guide to install PiCockpit.<\/a><\/p>\n\n\n\n

Alternatively, you can also get a dynamic DNS service and a hostname. Here’s a guide<\/a>.<\/p>\n