VPN

How to automatically connect to a Virtual private network system to create secure point-to-point or site-to-site connections




Installation

Remove systemd-networkd configuration and install NetworkManager

rm /etc/systemd/network/*
pacman -Syu networkmanager networkmanager-openvpn
systemctl disable systemd-networkd
systemctl enable NetworkManager

Download OpenVPN configuration files from VPN provider

wget https://privadovpn.com/apps/ovpn_configs.zip
unzip ovpn_configs.zip 'zrh*'
/home/wildw1ng/.vpn/zrh-001.ovpn

comment: route 0.0.0.0 0.0.0.0 # vpn_gateway


Import OpenVPN configuration files to NetworkManager

nmcli connection import type openvpn file /home/wildw1ng/.vpn/zrh-001.ovpn

Modify new NetworkManager VPN configuration

/etc/NetworkManager/system-connections/zrh-001.nmconnection
password-flags=0
username=USERNAME
[vpn-secrets]
password=PASSWORD

Modify NetworkManager connection to reconnect indefinitely

nmcli connection edit zrh-001

nmcli> set connection.autoconnect yes
nmcli> set connection.autoconnect-retries 0
nmcli> save persistent
nmcli> quit


Automatically start a VPN connection

nmcli connection
NAME UUID TYPE DEVICE
zrh-001 d46e4a92-778e-4792-b085-e1f638ecb8e3 vpn enp1s0
enp1s0 1715b889-3c47-3e21-a86f-94ce207297a9 ethernet enp1s0

Copy UUID of VPN connection you want to connect automatically

nmcli connection edit enp1s0

nmcli> set connection.secondaries d46e4a92-778e-4792-b085-e1f638ecb8e3
nmcli> save persistent
nmcli> quit

systemctl restart NetworkManager

Manual VPN connection

nmcli connection up zrh-001
nmcli connection down zrh-001
nmcli connection delete id zrh-001

Check public IP address

ip route
curl ifconfig.co
curl ifconfig.me
curl icanhazip.com
whois $(curl ifconfig.co)

Andreas Bauer. All rights reserved.

Kill switch

How to create a VPN kill switch with UFW firewall rules that will stop all internet traffic if your VPN connection drops




Installation

pacman -Syu ufw
systemctl enable ufw
systemctl start ufw

Disable IPv6

/etc/sysctl.d/40-ipv6.conf
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

Modify UFW configuration

/etc/default/ufw
IPV6=no

Modify NetworkManager connection

nmcli connection modify enp1s0 ipv6.method "disabled"

Firewall configuration

ufw --force reset

Allow local traffic

ufw allow in to 10.0.0.0/22
ufw allow out to 10.0.0.0/22

Allow VPN tunnel traffic

ufw allow out on tun0 from any to any
ufw allow in on tun0 from any to any

Allow connection to the VPN server to establish the tunnel

ufw allow out to 185.156.175.0/24 port 1194 proto udp

Set the default policy to deny all traffic

ufw default deny outgoing
ufw default deny incoming

Enable firewall

ufw enable
ufw status verbose

Disable logging

ufw logging off