# See my PiHole enabled OpenVPN Server

**URL:** <https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111>\
**Category:** Customizing Pi-hole\
**Created:** [May 25, 2016, 1:55am UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111 "2016-05-25T01:55:56Z")\
**Posts on this page:** 16\
**Page:** 3

<div class="post-metadata">

**Author:** ![Luke\_Davidson](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/luke_davidson/32/2664_2.png) [@Luke\_Davidson](https://discourse.pi-hole.net/u/Luke_Davidson)\
**Post date:** [June 13, 2017, 8:01pm UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/41 "2017-06-13T20:01:10Z")

</div>

Would I need to change the openvpn server config file?

---

<div class="post-metadata">

**Author:** ![Luke\_Davidson](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/luke_davidson/32/2664_2.png) [@Luke\_Davidson](https://discourse.pi-hole.net/u/Luke_Davidson)\
**Post date:** [June 13, 2017, 9:57pm UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/42 "2017-06-13T21:57:52Z")

</div>

I guess I should explain the problem rather than jumping to my own solution.

When looking at the Query Log, all entries that originate from my local network have an IP address of 192.168.1.1 rather than their actual IP.

I'd really like to fix that. Is it correct that I would have to use the pihole as my DHCP server rather than my router?

If so, how would I go about making the change? I have checked​ around and haven't found a solution.

My guess is to make a change to the OpenVPN server configuration file but I don't know what to change.

I appreciate your continued help.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [June 17, 2017, 10:59am UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/43 "2017-06-17T10:59:02Z")

</div>

> [@Luke\_Davidson](#):
>
> I'd really like to fix that. Is it correct that I would have to use the pihole as my DHCP server rather than my router?
> 
> If so, how would I go about making the change? I have checked​ around and haven't found a solution.
> 
> My guess is to make a change to the OpenVPN server configuration file but I don't know what to change.

Everything you will have to do is described in

[https://github.com/pi-hole/pi-hole/wiki/Pi-hole---OpenVPN-server](https://github.com/pi-hole/pi-hole/wiki/Pi-hole---OpenVPN-server)

Please provide further details if you need specific help with any of the changes.

---

<div class="post-metadata">

**Author:** ![graysky2](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/graysky2/32/1588_2.png) [@graysky2](https://discourse.pi-hole.net/u/graysky2)\
**Post date:** [July 2, 2017, 11:07am UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/44 "2017-07-02T11:07:28Z")

</div>

@twotonefox - I followed your steps including the "long overdue" section but am unable to get pihole to see my openvpn traffic. In summary:

1. Added /etc/dnsmasq.d/02-openvpn.conf to define the tun0 interface.
2. Modified /etc/openvpn/server/server.conf as you directed
3. Modified my client.conf as you directed

I can connect to my openvpn server and all traffic flows, but pihole doesn't seem to see my tunneling traffic.

Server config:  
cipher AES-256-CBC  
auth SHA512  
tls-version-min 1.2  
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA  
port 443  
proto tcp  
dev tun  
ca /etc/openvpn/server/ca.crt  
cert /etc/openvpn/server/server.crt  
key /etc/openvpn/server/server.key  
dh /etc/openvpn/server/dh.pem  
server 10.8.0.0 255.255.255.0  
ifconfig-pool-persist ipp.txt  
**push "redirect-gateway def1 bypass-dhcp"**  
**push "dhcp-option DNS 192.168.1.251"**  
keepalive 10 120  
tls-auth /etc/openvpn/server/ta.key 0  
comp-lzo  
max-clients 4  
user nobody  
group nobody  
persist-key

```
persist-tun
status openvpn-status.log
verb 3

```

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [July 8, 2017, 3:46pm UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/45 "2017-07-08T15:46:58Z")

</div>

Is this still an issue for you?

---

<div class="post-metadata">

**Author:** ![graysky2](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/graysky2/32/1588_2.png) [@graysky2](https://discourse.pi-hole.net/u/graysky2)\
**Post date:** [July 28, 2017, 8:33am UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/46 "2017-07-28T08:33:38Z")

</div>

No, working as expected. I updated the [Arch Wiki](https://wiki.archlinux.org/index.php/Pi-hole#Using_Pi-hole_together_with_OpenVPN) with the details.

---

<div class="post-metadata">

**Author:** ![Alexurb](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/f14d63/32.png) [@Alexurb](https://discourse.pi-hole.net/u/Alexurb)\
**Post date:** [July 15, 2019, 3:17pm UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/47 "2019-07-15T15:17:34Z")

</div>

@twotonefox, @graysky2  
So my two issues are that:  
1 without adding interface=eth1, to a conf file my internet will not work.  
My pi-hole is running on eth1.  
2 I cannot seem to get the routing correct.  
The VPN connects without a problem, the Pi is assigned the VPN's public address  
However my devices are being filtered through the pi hole, however it is not going through the vpn tunnel. Hence all my devices have my old public ip address and not the VPN's. At least this is my thoughts thus far .

Update:  
I've reinstalled the server along with not transferring the .ovpn files over dropbox as this seems to create some problem.

So I've managed to get some clients connected. Though I'm still very puzzled:

1. So the server works correctly and I can connect through my original public ip address, however when I get openvpn to connect to the nordvpn servers then my clients can't connect. I have a DynDNS setup, and the changed IP address is correct. The clients just refuse to connect. In essence i think i'm trying to setup openvpn as a gateway and as a server.

2. I was wondering if there's a way to force all local traffic through to nordvpn servers without having setup clients to connect to openvpn first.

Update# 2

I've managed to set everything up correctly (many incorrect tutorials on the internet)  
I'm left with only 1 issue. So I can see and connect to my entire LAN network , however I'm unable to connect to my MQTT broker through the vpn when I am not connected to my home wifi. When connected to the wifi network it passes through.

---

<div class="post-metadata">

**Author:** ![Maverick](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/maverick/32/8904_2.png) [@Maverick](https://discourse.pi-hole.net/u/Maverick)\
**Post date:** [July 15, 2019, 5:29pm UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/48 "2019-07-15T17:29:51Z")

</div>

Not trying to bomb the thread, but a little information that some may find useful is doing the same thing with Wireguard.

I use Wireguard to bridge my home network with my cloud hosted VPN/Pi-Hole Server, however I don't tunnel through it. I can tunnel everything through it if I wanted, but instead I can just simply access my LAN if I wish or the usual traffic goes out my existing gateway on whatever network I am using (Usually my home or cellular). The only traffic that is tunneled is DNS queries and Wireguard provides a lower latency, Lower CPU usage, Memory Usage, and higher potential bandwidth than OpenVPN.

---

<div class="post-metadata">

**Author:** ![Alexurb](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/f14d63/32.png) [@Alexurb](https://discourse.pi-hole.net/u/Alexurb)\
**Post date:** [July 19, 2019, 11:01am UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/49 "2019-07-19T11:01:06Z")

</div>

I've setup your Wireguard (wg) suggestion, really impressed with the simplicity. However MQTT is still not going through. This I suppose might be as a result of MQTT relying on tcp, wireguard is purely udp.

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [July 19, 2019, 11:30am UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/50 "2019-07-19T11:30:49Z")

</div>

> [@Alexurb](#):
>
> This I suppose might be as a result of MQTT relying on tcp, wireguard is purely udp.

What about [TunSafe](https://github.com/TunSafe/TunSafe/blob/master/docs/WireGuard%20TCP.txt) (WireGuard over TCP)?

---

<div class="post-metadata">

**Author:** ![Maverick](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/maverick/32/8904_2.png) [@Maverick](https://discourse.pi-hole.net/u/Maverick)\
**Post date:** [July 19, 2019, 2:56pm UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/52 "2019-07-19T14:56:19Z")

</div>

Personally, I am unfamiliar with MQTT, however Wireguard can encapsulate both TCP and UDP traffic. Otherwise, other TCP services will not work through it. My DNS redirection through it is UDP, however, my web server behind it, mail server, spam filtering, etc.. are all TCP.

However, if you are trying to do something like establish a TCP connection through something like a firewall, then I can see your issue.

If you are trying to forward traffic through it beyond the endpoints of the VPN itself, you may have to enable net.ipv4.ip\_forward = 1, I am unsure why, but I also enabled net.ipv4.conf.all.proxy\_arp = 1 in /etc/sysctl.conf, then do sysctl -p

You also have to include any additional IPs you want to have access to the other side in the target's wireguard IP allow list, otherwise only the traffic from the other VPN endpoint will be allowed. (ie: I had to add the CIDR entry for my LAN xxx.xxx.xxx.xxx/xx

---

<div class="post-metadata">

**Author:** ![badnewsblair](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/badnewsblair/32/8951_2.png) [@badnewsblair](https://discourse.pi-hole.net/u/badnewsblair)\
**Post date:** [July 20, 2019, 1:27am UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/53 "2019-07-20T01:27:15Z")

</div>

I'm having a heck of a time getting _any_ VPN to work at this point (I've tried OpenVPN/PiVPN, and Wireguard about 100 times each). I'm really hoping to get a helping hand with my Wireguard setup.

My setup looks like this:

**Router:** xxx.xxx.xxx.1  
**Primary Pihole and Wireguard Server (ethernet):** xxx.xxx.xxx.66  
**Seconday/Backup Pihole (wireless):** xxx.xxx.xxx.99

```auto
-= wg0.conf =-

[Interface]
Address = xxx.xxx.xxx.1/24 (Router)
DNS = xxx.xxx.xxx.66,xxx.xxx.xxx.99 (Primary and Secondary Piholes)
ListenPort = default port, already forwarded

PrivateKey = XXXXXXXXXX
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCE$
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j AC$

[Peer]
#Client1
PublicKey = XXXXXXXXXX
AllowedIPs = 0.0.0.0/0, ::/0
PersistentkeepAlive = 60

```

```auto
-= client1.conf =-

[Interface]
Address = xxx.xxx.xxx.66/24 (Primary Pihole and Wireguard Server)
DNS = xxx.xxx.xxx.66,xxx.xxx.xxx.99 (Primary and Secondary Piholes)
PrivateKey = XXXXXXXXXX

[Peer]
PublicKey = XXXXXXXXXX
Endpoint = mydynamic.ddns.com:default
AllowedIPs = 0.0.0.0/0, ::/0
#AllowedIPs = ??????
#PersistentkeepAlive = 60

```

Ideally, I am aiming for Dual Operation (as described [here](https://docs.pi-hole.net/guides/vpn/dual-operation/)).

Previous attempts resulted in timeouts during the handshaking process.

With this current setup, everything seems to kick off correctly when I run the WG Server (as far as I can tell). However, I get an immediate DNS/Endpoint error when trying to connect with my client.

Given I've spent so much time on this, I'm pretty committed to Wireguard at this point as I too have read and seen a bit of research promoting Wireguard over OpenVPN. I'm also willing to take this to PMs if need be.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Maverick](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/maverick/32/8904_2.png) [@Maverick](https://discourse.pi-hole.net/u/Maverick)\
**Post date:** [July 20, 2019, 6:53am UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/54 "2019-07-20T06:53:31Z")

</div>

@badnewsblair

One thing that I notice is that you refer to a "default" port.

I may be wrong, but in my experience with Wireguard, it chooses a port above the average service port range of like 32000 at random when the config is setup.

After your config file is setup, try using wg-quick up /path/to/config/file (Normally /etc/wireguard/interfacename.config IE: /etc/wireguard/wg0.config)

wg-quick will also add new rules to iptables for accepting new connections and append the routing table.

---

<div class="post-metadata">

**Author:** ![badnewsblair](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/badnewsblair/32/8951_2.png) [@badnewsblair](https://discourse.pi-hole.net/u/badnewsblair)\
**Post date:** [July 20, 2019, 2:10pm UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/55 "2019-07-20T14:10:17Z")

</div>

I was referring to the default port Wireguard uses, which I believe is `51820` (I just left it out of my .conf file).

A few quick questions if you (or others) don't mind...

Under my server configuration, I am using my Gateway/Router `xxx.xxx.xxx.1` for the Address value. Should I be using the Raspberry Pi that I have Wireguard and Pihole installed on `xxx.xxx.xxx.66`? (I'm not sure why I used the Gateway/Router).

And if I use my Raspberry Pi for Address, do I keep the DNS field as that device serves both purposes (VPN and DNS server through Pihole)?

Should Address for Server and Client be the same IP?

I seem to have a pretty good grasp on everything but `Address` (and the use of the CIDR notation). Any clarification around those areas would be great!

Thanks for your response!

---

<div class="post-metadata">

**Author:** ![Maverick](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/maverick/32/8904_2.png) [@Maverick](https://discourse.pi-hole.net/u/Maverick)\
**Post date:** [July 22, 2019, 3:18am UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/56 "2019-07-22T03:18:44Z")

</div>

If 51820 is specified, then okay. I normally see a port selected at random during the creation of the endpoint config if no port is specified.

If you are saying that is in your PiHole config, then it is utilizing the IP that is assigned to it on the default network connection for requests. If you want to allow requests from Wireguard, then you must specify the Wireguard interface IP.

Depending on where your server is located, you may need to specify allowed ip address ranges in your Wireguard config to allow the requesting client ip or ip ranges. I learned this the hard way initially when I couldn't figure out why the server wasn't responding. (However I don't run it on a Pi myself, I have a Ubuntu 19.04 instance in the cloud and I run 3 LANs off of it with a total of 52 clients.)

---

<div class="post-metadata">

**Author:** ![badnewsblair](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/badnewsblair/32/8951_2.png) [@badnewsblair](https://discourse.pi-hole.net/u/badnewsblair)\
**Post date:** [July 23, 2019, 12:36am UTC](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111/57 "2019-07-23T00:36:45Z")

</div>

Thanks for the info! I appreciate it. I'll keep digging.

[Previous page](https://discourse.pi-hole.net/t/see-my-pihole-enabled-openvpn-server/111.md?page=2)