medusa/the_information_nexus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
the_information_nexus/tech_docs/networking/NordVPN.md
Whisker Jones 7d794ad2f9 site updates
2024-05-05 10:38:02 -06:00

6.8 KiB
Raw Permalink Blame History

Absolutely, let’s streamline the steps to set up NordVPN on a fresh OpenWrt device using CLI commands. This guide assumes you have basic knowledge of how to access your router via SSH and that OpenWrt is already installed on your device.

Step 1: Access Your Router

Connect to your router via SSH:

ssh root@192.168.1.1

Replace 192.168.1.1 with your router's IP address if it has been changed from the default.

Step 2: Update and Install Necessary Packages

Update the package manager and install OpenVPN and the necessary IP utilities:

opkg update
opkg install openvpn-openssl ip-full

Step 3: Download and Set Up NordVPN Configuration Files

Choose a NordVPN server that you want to connect to and download its OpenVPN UDP configuration. You can find server configurations on the NordVPN website.

  1. Download a server config file directly to your router: Replace SERVERNAME with your chosen server's name.

    wget -P /etc/openvpn https://downloads.nordcdn.com/configs/files/ovpn_udp/servers/SERVERNAME.udp.ovpn

  2. Rename the downloaded configuration file for easier management:

    mv /etc/openvpn/SERVERNAME.udp.ovpn /etc/openvpn/nordvpn.ovpn

Step 4: Configure VPN Credentials

NordVPN requires authentication with your service credentials.

  1. Create a credentials file: Open a new file using nano:

    nano /etc/openvpn/credentials

    Enter your NordVPN username and password, each on a separate line. Save and close the editor.

  2. Modify the NordVPN configuration file to use the credentials file:

    sed -i 's/auth-user-pass/auth-user-pass \/etc\/openvpn\/credentials/' /etc/openvpn/nordvpn.ovpn

Step 5: Enable and Start OpenVPN

  1. Automatically start OpenVPN with the NordVPN configuration on boot:

    echo 'openvpn --config /etc/openvpn/nordvpn.ovpn &' >> /etc/rc.local

  2. Start OpenVPN manually for the first time:

    /etc/init.d/openvpn start

Step 6: Configure Network and Firewall

Ensure the VPN traffic is properly routed and the firewall is configured to allow it.

  1. Edit the network configuration: Add a new interface for the VPN:

    uci set network.vpn0=interface
uci set network.vpn0.ifname='tun0'
uci set network.vpn0.proto='none'
uci commit network

  2. Set up the firewall to allow traffic from LAN to the VPN:

    uci add firewall zone
uci set firewall.@zone[-1].name='vpn'
uci set firewall.@zone[-1].network='vpn0'
uci set firewall.@zone[-1].input='REJECT'
uci set firewall.@zone[-1].output='ACCEPT'
uci set firewall.@zone[-1].forward='REJECT'
uci set firewall.@zone[-1].masq='1'
uci commit firewall
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='lan'
uci set firewall.@forwarding[-1].dest='vpn'
uci commit firewall

  3. Restart the firewall to apply changes:

    /etc/init.d/firewall restart

Step 7: Test the Connection

Check if the VPN connection is active and working:

ping -c 4 google.com

You should now be connected to NordVPN through your OpenWrt router using the configured OpenVPN setup. This streamlined guide ensures you have a clear path through the configuration process with easy-to-follow CLI commands.

The CLI instructions you're interested in offer a more hands-on approach to setting up NordVPN on an OpenWrt router. This method is ideal if you're comfortable using the command line and want more control over the VPN configuration. Here's a simplified version of the process, broken down into manageable steps:

1. Access Router via SSH

Connect to your OpenWrt router using SSH. The default IP is usually 192.168.1.1 unless you have changed it. The default username is root.

2. Install Necessary Packages

Update your package list and install the required OpenVPN packages:

opkg update
opkg install openvpn-openssl ip-full luci-app-openvpn

(Optional) Install nano for easier file editing:

opkg install nano

3. Download OpenVPN Configuration

Use NordVPN's server recommendation tool to find the best server and download its configuration file directly to your router:

wget -P /etc/openvpn https://downloads.nordcdn.com/configs/files/ovpn_udp/servers/[server-name].udp.ovpn

Replace [server-name] with the actual server name, such as uk2054.nordvpn.com.

4. Configure OpenVPN

Edit the downloaded .ovpn file to include your NordVPN credentials:

nano /etc/openvpn/[server-name].udp.ovpn

Modify the auth-user-pass line to point to a credentials file:

auth-user-pass /etc/openvpn/credentials

Create the credentials file:

echo "YourUsername" > /etc/openvpn/credentials
echo "YourPassword" >> /etc/openvpn/credentials
chmod 600 /etc/openvpn/credentials

5. Enable OpenVPN to Start on Boot

Ensure OpenVPN starts automatically with your router:

/etc/init.d/openvpn enable

6. Set Up Networking and Firewall

Create a new network interface for the VPN and configure the firewall to route traffic through the VPN:

Network Interface Configuration:

uci set network.nordvpntun=interface
uci set network.nordvpntun.proto='none'
uci set network.nordvpntun.ifname='tun0'
uci commit network

Firewall Configuration:

uci add firewall zone
uci set firewall.@zone[-1].name='vpnfirewall'
uci set firewall.@zone[-1].input='REJECT'
uci set firewall.@zone[-1].output='ACCEPT'
uci set firewall.@zone[-1].forward='REJECT'
uci set firewall.@zone[-1].masq='1'
uci set firewall.@zone[-1].mtu_fix='1'
uci add_list firewall.@zone[-1].network='nordvpntun'
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='lan'
uci set firewall.@forwarding[-1].dest='vpnfirewall'
uci commit firewall

7. Configure DNS

Change DNS settings to use NordVPN DNS or another preferred DNS service:

uci set network.wan.peerdns='0'
uci del network.wan.dns
uci add_list network.wan.dns='103.86.96.100'
uci add_list network.wan.dns='103.86.99.100'
uci commit

8. Prevent Traffic Leakage (Optional)

To enhance security, add custom rules to block all traffic if the VPN disconnects:

echo "if (! ip a s tun0 up) && (! iptables -C forwarding_rule -j REJECT); then iptables -I forwarding_rule -j REJECT; fi" >> /etc/firewall.user

9. Start the VPN

Start the OpenVPN service and verify it's running properly:

/etc/init.d/openvpn start

10. Check Connection Status

Visit NordVPN's homepage or another site like ipinfo.io to check your IP address and ensure your traffic is routed through the VPN.

This setup should give you a robust and secure VPN connection on your OpenWrt router using NordVPN. If you encounter any issues, you may need to review the configuration steps or consult NordVPN's support for further troubleshooting.