The goal is to set up a server with dnsmasq as DNS and DHCP server, Pi-Hole to manage the host entries, DNS-Crypt to encrypt the DNS requests and a VPN gateway.
The whole network should be able to be managed centrally via the RaspberryPi.
- For Windows I would recommend the Bitvise SSH Client, which also implements SFTP for file transfer.
- I also assume that all commands are executed as root and Raspbian Buster is used as operating system.
- I use Windscribe, because I like their log policy, they offer a Stealth VPN protocol and I was able to get a Lifetime Premium license. The offer is sold out, but you should always look for similar ones if you have projects like this in mind. BTW.: This post is not sponsored.
This how-to is also available in german.
Enforce system:
1.Install updates:
apt-get update && apt-get upgrade2.Create a new user:
adduser <Username>3.Add the new user to group sudo:
adduser <Username> sudo4.Delete the “pi” user :
Reconnect to the Raspberry, using the new user you just created.
deluser pi5.Change the password of the new user and root:
passwd <Username>
passwd root6.Change SSH config :
Uncomment/paste in /etc/ssh/sshd_config
Port <Change freely>
Protocol 2
PermitRootLogin no
DebianBanner noConfigure and install DNSCrypt:
1.Download and extract DNSCrypt-Proxy:
Newest release : https://github.com/jedisct1/dnscrypt-proxy/releases/
cd /etc
wget https://github.com/DNSCrypt/dnscrypt-proxy/releases/download/<Release>.tar.gz
tar -xf dnscrypt-proxy-linux_arm-x.x.x.tar.gz
mv linux-arm dnscrypt-proxy
rm dnscrypt-proxy-linux_arm-x.x.x.tar.gz2.Configure DNSCrypt:
You can either use lists or pic every server yourself.
Using the require_ filters you can filter the lists (declarative).
Using DNS relays anonymizes your DNS requests by routing them to the actual server via the specified relay server. You should choose a relay server maintained by a different entity than the DNS server.
cd dnscrypt-proxy
cp example-dnscrypt-proxy.toml dnscrypt-proxy.toml/etc/dnscrypt-proxy/dnscrypt-proxy.toml (CHANGES)
server_names = [’ <SERVER NAME1>’, ’ <SERVER NAME2>’] ## If you want to use specific servers
ipv6_servers = false ## “true” if your VPN service supports IPv6
listen_addresses = [‘127.0.0.1:5300’, ‘[::1]:5300’] ## Pi-Hole already uses Port 53
require_dnssec = true # I would recommend it for security reasons
require_nolog = true ## I would recommend it for privacy reasons
fallback_resolver = ‘176.126.70.119:53’ ## OpenNIC; You can use any server you trust
ignore_system_dns = true ## Pi-Hole is our system resolver, where we used DNSCrypt-Proxy (Loop)
##Insert below “[sources]”:
[sources.’<LIST NAME>’]
urls = [’<List URL>’, ‘<BACKUP URL>’]
minisign_key = ‘<MINISIGN_KEY>’
cache_file = ‘<CACHE FILE (CUSTOM)>’
##Insert below “[anonymized_dns]”:
routes = [
{ server_name=’ <SERVER NAME1>’, via=[’ <RELAY NAME>’,<…>] },
{ server_name=’<SERVER NAME2>’, via=[’ <RELAY NAME>’,<…>] }
]
Server/Relay lists (“Sources”)
More info about the servers
3.Install and start the service:
./dnscrypt-proxy -service install
./dnscrypt-proxy -service start4.Check your configuration:
./dnscrypt-proxy -resolve google.comThe output should look something like this:
Resolving [google.com]
Domain exists: yes, 4 name servers found
Canonical name: google.com.
IP addresses: 216.58.206.110, 2a00:1450:4009:810::200e
TXT records: docusign=05958488-4752-4ef2-95eb-aa7ba8a3bd0e v=spf1 include:_spf.google.com ~all facebook-domain-verification=22rm551cu4k0ab0bxsw536tlds4h95
Resolver IP: xxx.xxx.xxx.xxx6.Allows the service to bind to the specified port while being run as non-root user:
setcap cap_net_bind_service=+pe dnscrypt-proxy5.Start the service on boot:
systemctl enable dnscrypt-proxySetup Pi-Hole :
1.Install Pi-Hole:
curl -sSL https://install.pi-hole.net | bashOur code is completely open, but piping to bash can be dangerous. For a safer install, review the code and then run the installer locally.
Interface : eth0
DNS Server : Doesn’t really matter
Protocol : Activate IPv4 and IPv6
IP : IP of eth0 (usually already properly configured)
Gateway : IP of your Router (usually already properly configured)
Log Queries : Doesn’t really matter
Web interface : ON
2.Activate DNSSEC :
If DNSSEC is activated in dnscrypt-proxy, you should activate it in dnsmasq too.
echo "proxy-dnssec" >> /etc/dnsmasq.d/dnscrypt.conf3.Change the web interface’s password:
pihole -a -pSetup the OpenVPN gateway:
1.Configure the Interface:
In case you don’t already have your interface set up during the Pi-Hole setup, paste at the and overwrite any existing static configuration for eth0 in /etc/dhcpcd.conf:
interface eth0
static ip_address=192.168.0.2/24 ##IP for this server
static routers=192.168.0.1 ##IP of your router
static domain_name_servers=127.0.0.12.Restart the network interfaces:
service networking restart3.Install OpenVPN:
apt install openvpn4.Download the OpenVPN config files from your VPN provider
5.Move your config files to /etc/openvpn/:
If your server configuration is saved as <Server.conf> in /etc/openvpn/ the connection as automatically initialized during boot.
cp <Server.ovpn> /etc/openvpn/*Server*.conf
mkdir /etc/openvpn/serverIf those files exist:
mv <CACertificate.crt> /etc/openvpn/server/
mv <UserCertificate.crt> /etc/openvpn/server/
mv <PrivateKey.key> /etc/openvpn/server/6.You probably don’t want to enter your VPN credentails every time:
Insert in /etc/openvpn/<Server>.conf:
auth-user-pass /etc/openvpn/server/passwd.confCreate passwd.conf:
/etc/openvpn/server/passwd.conf
<LOGIN NAME>
<LOGIN PASSWORT>
Only allow root to access the file:
chown root:root /etc/openvpn/server/passwd.conf
chmod 600 /etc/openvpn/server/passwd.conf7.Depending on the files you got from your VPN provider you may have to configure certificates or keys:
Insert in <Server>.ovpn:
ca /etc/openvpn/server/<CACertificate>.crt
cert /etc/openvpn/server/<UserCertificate>.crt
key /etc/openvpn/server/<PrivateKey>.keyIf you are using Windscribe you can skip step 3 to 7 and install the linux client. You should definitely deactivate the inbuilt firewall.
8.Activate IP forwarding and some security features:
Uncomment/paste in /etc/sysctl.conf:
#IP Forwarding
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding=1 ##If your VPN service supports IPv6
#IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
#Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1
#Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
#Ignore send redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
#Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
# Block SYN attacks
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5More info about the settings:
IP Spoofing
ICMP broadcast requests
ICMP redirects
Source packet routing
SYN attacks
Load these changes:
sysctl -p /etc/sysctl.conf9.Configure iptables:
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth0 -j REJECT
iptables -A FORWARD -s 192.168.0.0/24 -o tun0 -j ACCEPT
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
##If your VPN service supports IPv6
ip6tables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
ip6tables -A FORWARD -i eth0 -o eth0 -j REJECT
ip6tables -A FORWARD -s fe80::/10 -o tun0 -j ACCEPT
ip6tables -t nat -A POSTROUTING -o tun0 -j MASQUERADE10.Save this configuration:
Install ‘iptables-persistent’
apt install iptables-persistentSave the current iptables configuration (In case you didn’t already do it during the installation)
iptables-save > /etc/iptables/rules.v4
iptables-save > /etc/iptables/rules.v6 ## If your VPN service supports IPv6 11.Configure DHCP and DNS:
Turn off the DHCP server of your router first.
Change in /etc/pihole/setupVars.conf:
DHCP_ACTIVE=true
DHCP_ROUTER=<IP of the VPN Gateway (eth0)>
DHCP_rapid_commit=true
PIHOLE_DNS_1=127.0.0.1#5300
PIHOLE_DNS_2=::1#5300
DNSSEC=false
Restart pihole to apply all changes:
service pihole-FTL restart
To test everything, open ipleak.net in your Browser to check your IP address and DNS servers.