Setting up Private Internet Access VPN is usually not a problem these days as Linux version is readily available among the supported clients. However, such installation requires GUI. What if we don’t want or need one?
For setup to work independently of GUI, one approach is to use OpenVPN client usually installed by default. Also needed are PIA’s IP-based OpenVPN configuration files. While this might cause issues down the road if that IP changes, it does help a lot with security as we won’t need to poke an unencrypted hole (and thus leak information) for DNS.
From the PIA configuration archive extract your choice of
.ovpn file (usually going with the one physically closest to you will give you the best results). There is no need to extract
.pem files as configuration has certificates embedded.
Rest of the VPN configuration needs to be done from the Bash:
sudo cp sudo cp ~/Downloads/openvpn-ip/US\ Seattle.ovpn /etc/openvpn/client/pia.conf
echo "auth-user-pass /etc/openvpn/client/pia.login" | sudo tee -a /etc/openvpn/client/pia.conf
echo "mssfix 1400" | sudo tee -a /etc/openvpn/client/pia.conf
echo "dhcp-option DNS 220.127.116.11" | sudo tee -a /etc/openvpn/client/pia.conf
echo "dhcp-option DNS 18.104.22.168" | sudo tee -a /etc/openvpn/client/pia.conf
echo "script-security 2" | sudo tee -a /etc/openvpn/client/pia.conf
echo "up /etc/openvpn/update-resolv-conf" | sudo tee -a /etc/openvpn/client/pia.conf
echo "down /etc/openvpn/update-resolv-conf" | sudo tee -a /etc/openvpn/client/pia.conf
The basic VPN setup is already completed but we still need to setup our login (replacing
password with the actual values):
echo 'username' | sudo tee -a /etc/openvpn/client/pia.login
echo 'password' | sudo tee -a /etc/openvpn/client/pia.login
sudo chmod 400 /etc/openvpn/client/pia.login
Firewall rules are to allow data flow only via VPN’s tun0 interface with only encrypted VPN traffic being allowed on port 1198.
yes | sudo ufw reset
sudo ufw default deny incoming
sudo ufw default deny outgoing
sudo ufw allow out on tun0
sudo ufw allow out on eth0 proto udp to `cat /etc/openvpn/client/pia.conf \
| grep "^remote " | grep -o ' [^ ]* '` port 1198
sudo ufw enable
To test VPN connection execute:
sudo openvpn --config /etc/openvpn/client/pia.conf
Assuming test was successful (i.e. resulted in
Initialization Sequence Completed message), we can further make sure data is actually traversing VPN. I’ve found whatismyipaddress.com quite helpful here. Just check if IP detected is different then IP you usually get without VPN.
Stop the test connection using
Ctrl+C and proceed to configure OpenVPN’s auto-startup. Reboot is there just to test if auto-startup works.
sudo systemctl enable openvpn-client@pia
This should give you quite secure setup without the need for GUI.