User Tools

Site Tools


vpn-pi

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
vpn-pi [2020/04/29 16:37]
robm [DHCP & DNS Services]
vpn-pi [2020/04/29 16:54] (current)
robm
Line 13: Line 13:
 <code>sudo wpa_cli terminate</code> <code>sudo wpa_cli terminate</code>
  
-Forever: +Forever: Disabling the service permanently is tricky, as lots of events can cause it to be started. A better solution is to exclude ''wlan0'' from being managed by itby adding ''nohook wpa_supplicant'' to ''/etc/network/interfaces.d/wlan0'' (created in the next section).
- +
-Disabling the ''wpa_supplicant.service'' in systemd doesn't workbut see below for how to disable the ''wpa_supplicant'' hook in ''/etc/network/interfaces.d/wlan0''+
  
 ===== Configure WiFi settings ===== ===== Configure WiFi settings =====
Line 25: Line 23:
 iface wlan0 inet static iface wlan0 inet static
   address 172.16.0.1/24   address 172.16.0.1/24
-  nohook wpa_supplicant+  nohook wpa_supplicant  # Conflicts with hostapd (WPA is for clients, not access points)
 </code> </code>
  
Line 43: Line 41:
  
 ===== DHCP & DNS Services ===== ===== DHCP & DNS Services =====
 +
 +Disable the default ''systemd-resolved'' service which runs on localhost, as it takes control of ''/etc/resolv.conf'', which in turn prevents the DHCP + DNS server we're about to install from noticing when expressvpn changes the DNS server.
 +
 +It's important that ''dnsmasq'' notices when ''/etc/resolv.conf'' changes, or DNS lookups will fail entirely due to ExpressVPN adding firewall rules to drop all DNS queries that don't go via ExpressVPN.
 +
 +<code>
 +sudo systemctl disable --now systemd-resolved
 +</code>
  
 <code> <code>
Line 57: Line 63:
   --dhcp-range=172.16.0.10,172.16.0.20,1h \   --dhcp-range=172.16.0.10,172.16.0.20,1h \
   --except-interface=eth0 \   --except-interface=eth0 \
-  --bind-interfaces \ 
   --dhcp-authoritative \   --dhcp-authoritative \
 +  --log-queries \
   --clear-on-reload   --clear-on-reload
 </code> </code>
- 
-Notes: 
- 
-  * ''--bind-interfaces' causes the DNS server (TCP/UDP port 53) to bind to the network interfaces it will serve requests from. We need this because the default behaviour of binding to all interfaces via the special address ''0.0.0.0'' conflicts with ''systemd-resolved'' which binds to ''127.0.0.53%lo''. This essentially works around it. 
  
 Later on, we'll want to move these settings into ''/etc/dnsmasq.conf'' Later on, we'll want to move these settings into ''/etc/dnsmasq.conf''
Line 147: Line 149:
  
 Then try to connect from another device (e.g. mobile phone). The WiFi network should be visible, and when you connect you should get an IP address, but probably an error about no internet connection. That's next. Then try to connect from another device (e.g. mobile phone). The WiFi network should be visible, and when you connect you should get an IP address, but probably an error about no internet connection. That's next.
 +
 +===== Network Address Translation =====
 +
 +Enable Network Address Translation (NAT) on any traffic that leaves us via ExpressVPN's ''tun0'' interface.
 +
 +Note that the interface doesn't exist until you run ''expressvpn connect'', but you can add the rule to ''iptables'' without issue.
 +
 +<code>
 +iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
 +</code>
 +
 +Note that is this is the **only** MASQUERADE rule (check with ''iptables -t nat -nvL'') then devices using this access point will experience 100% packet loss when ExpressVPN is not connected. I consider this a feature, but if you don't you can add another rule for ''eth0'':
 +
 +<code>
 +iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
 +</code>
 +
vpn-pi.1588178245.txt.gz · Last modified: 2020/04/29 16:37 by robm