I wanted to initiate a connection to my VPN provider Private Internet Access (PIA) from one of my headless CentOS 7 servers. Unfortunately PIA software requires a GUI to work. Fortunately, PIA provides ovpn files that fully work with the openVPN software, which does work headlessly.
I followed this guide from htpcguides.com to get me going. I tweaked it a bit to work with CentOS 7. I then used this guide to help me set up port forwarding to work with transmission-daemon.
First, install openvpn & iproute
sudo yum -y install openvpn
Next grab PIA’s ovpn files for their servers:
wget https://www.privateinternetaccess.com/openvpn/openvpn.zip
sudo unzip openvpn.zip -d /etc/openvpn/pia
Now create a credentials file to specify your PIA username and password. The format is simply the first line being your PIA username, and the second line being your PIA password, nothing else.
#Create file
sudo vim /etc/openvpn/pia/.secret
#Enter PIA credentials into the file, then save and exit
USERNAME
PASSWORD
#Change permissions to be readable only by root
sudo chmod 700 /etc/openvpn/pia/.secret
Test if it’s working by manually running OpenVPN
sudo openvpn --config /etc/openvpn/PIA_SITE_FILENAME.ovpn --auth-user-pass /etc/openvpn/pia/.secret
Create a systemd service file to get OpenVPN to run on startup
sudo vim /usr/lib/systemd/system/pia.service
[Unit]
Description=OpenVPN
After=syslog.target network.target
[Service]
PrivateTmp=true
Type=forking
ExecStart=/usr/sbin/openvpn --daemon --config "/etc/openvpn/PIA_SITE_FILENAME.ovpn" --auth-user-pass /etc/openvpn/.secret
[Install]
WantedBy=multi-user.target
Reload systemd daemons and enable at boot:
sudo systemctl daemon-reload
sudo systemctl enable pia.service
Start the service (or reboot) and then use curl to verify your external IP has changed
sudo systemctl start pia.service
curl https://ipinfo.io/ip
Port Forwarding
PIA is awesome because it supports port forwarding to facilitate things like torrents. I took the script from this guide and tweaked it a bit to suit my needs (and to correct a syntax error)
Note: PIA only supports port forwarding from specific regions. Here is the current list.
Download script to pia directory
sudo wget -O /etc/openvpn/pia/portforward.sh https://raw.githubusercontent.com/HTPCGuides/pia-port-forwarding-scripts/master/transmission-pia-port-forwarding.sh
sudo chmod +x /etc/openvpn/portforward.sh
Edit the script to provide PIA username and pass, and Transmission user/pass (if you have that configured.) The variables to change are USERNAME,PASSWORD, TRANSUSER, and TRANSPASS
Test the script by running it manually (make sure both your pia service and transmission services are already running.) I’ve noticed that the script will say success even on failure which is why I suggest using bash -x so you can see actual error messages from PIA regarding port forwarding:
sudo bash -x /etc/openvpn/pia/portforward.sh
After that’s run you can check your transmission daemon to ensure it is listening on the PIA port that’s been forwarded.
Configure to run on startup and every two hours by invoking cron:
sudo crontab -e
@reboot sleep 60 && /etc/openvpn/pia/portforward.sh | while IFS= read -r line; do echo "$(date) $line"; done >> /var/log/pia_portforward.log 2>&1 #PIA Port Forward
0 */2 * * * /etc/openvpn/pia/portforward.sh | while IFS= read -r line; do echo "$(date) $line"; done >> /var/log/pia_portforward.log 2>&1 #PIA Port Forward
If you are paranoid about transmission running without the VPN working you can tweak your transmission service to rely on the pia service before starting. Modify /usr/lib/systemd/system/transmission-daemon.service and tweak the After line and add a Required line so it now reads this:
Required=pia.service
After=network.target pia.service
Don’t forget to run a sudo systemctl daemon-reload afterward.
Troubleshooting
If you get the error message “/etc/openvpn/pia/portforward.sh: line 35: [: : integer expression expected” it means you have to tweak the script a bit (it’s broken?)
Change line 35 to be the following:
if [ "$SPLITVPN" == 1 ]; then