PrivateInternetAccess Using OpenVPN and Squid Proxy – OpenVPN Configuration

This article in the series deals with getting the OpenVPN service up and running with PrivateInternetAccess and how to configure our routes to allow us to selectively channel our traffic through it.

As we already installed OpenVPN previously, we can jump straight in: we will need to download the PrivateInternetAccess-specific config files and then set up the software to use these; we’ll also set up a username / password file for the service to use so that we don’t have to enter them every time we want to connect.

1. Download the PrivateInternetAccess VPN config files from the website

The files can be found at the following link, all zipped up and ready to download: https://www.privateinternetaccess.com/openvpn/openvpn.zip

Fetch these into the /etc/openvpn directory using wget:

Unzip the files using the “unzip” command:

Tip: if the unzip command is not found, you may need to install it using: “apt-get install unzip"

 2. Select the Config File You Wish to Use

The OpenVPN service looks for a file called “server.conf” in the /etc/openvpn directory; the config files above are completed config files so we can either:

a) Rename one of them to server.conf OR much preferably

b) Create a shortcut called server.conf and link it to whichever config file we want to use. This is much better as the name of the config file relates to where your VPN traffic is going to “break out”: i.e. if you link server.conf to “UK London.ovpn” then your traffic will appear with a London IP address. If, however, you want to use something like Hulu which is only available in the US then you would like server.conf to e.g. “US West.ovpn.”

This is very simply done by using the “ln” command as follows:

ln -s <file-to-link-to> <name-of-your-shortcut>

 If we wanted to break out in US West then we would use the following command:

ln -s “/etc/openvpn/US West.ovpn” /etc/openvpn/server.conf

which would create a shortcut called server.conf in the /etc/openvpn directory pointing to the “/etc/openvpn/US West.ovpn” configuration file.

3. Configure the Username / Password File

The configuration above as it is will work but you will be prompted every time you want to connect for a username and password. To get around this for convenience (and also if you want your VPN to connect automatically) then we need to do the following:

a) Create a simple file with two lines – the first line should contain the username, the second the password. In this example, we echo the username and password into a file called “.pia” in the /root directory:

Note the first command has one angle bracket “>” and the second one has two “>>” – the first one creates the empty file or blanks it if it already exists and copies the text into it. The second one appends the text to it. Use the “cat” command to view the contents of the file as shown above.

For security, set the permissions on the /root/.pia file to 400 – this means that only root can access it and it will be read-only :

chmod 400 /root/.pia

b) Change the configuration files to use the password file we just created: to do this we need to open each configuration file we want to use, locate the line reading:

auth-user-pass

and change it to:

auth-user-pass /root/.pia

and then save the file. We’re nearly ready to go but first:

4. Configure Static Routes Back to Your Internal Networks!!!

This is only applicable if your proxy is in a different subnet than the one your client is in. In our example, we are connecting from our LAN (172.16.16.0/24) to the proxy in our DMZ (192.168.101.0/24). Once the VPN comes up on our proxy machine, it will become the default gateway meaning that suddenly you won’t be able to access it over the network!

To bypass this, we need to add static routes back to our internal networks, so going with our example network diagram we would need to add a route to 172.16.16.0/24 via 192.168.101.1:

route add -net 172.16.16.0 netmask 255.255.255.0 gateway 192.168.101.1

Now that our communication channels are sorted, let’s get going!

5. Restart the OpenVPN Service

Using the “service openvpn restart” command, you should see the following – we’re sorted!

Check your routing table with “route -n”:

• The first entry in red shows our default VPN gateway – going out of “tun0” – our virtual VPN network interface.
• The second entry is our standard default gateway for our local subnet.
• The third is the static route we entered to allow the proxy in the DMZ to talk back to our client’s network.

If you do a traceroute, you’ll see that the first hop is going through the VPN instead of your standard gateway:

6. Configure Your Browser / Torrent Application to Use the Proxy

You will need to configure your browser or other application to use the proxy – there are many tutorials out there already so a swift google for your particular browser will have you on your way quickly. You simply need to set the parameters to use the IP of the proxy and port 3128!

Please comment below if you run into any problems and we’ll do all we can to help!