David Cavallucci dcava

Routing tips for VPNs on OS X

When VPNs Just Work™, they're a fantastic way of allowing access to a private network from remote locations. When they don't work it can be an experience in frustration. I've had situations where I can connect to a VPN from my Mac, but various networking situations cause routing conflicts. Here are a couple of cases and how I've been able to get around them.

Specific cases

Case 1: conflicting additional routes.

In this example the VPN we are connecting to has a subnet that does not conflict with our local IP, but has additional routes that conflict in some way with our local network's routing. In my example the remote subnet is 10.0.x.0/24, my local subnet is 10.0.y.0/24, and the conflicting route is 10.0.0.0/8. Without the later route, I can't access all hosts on the VPN without manually adding the route after connecting to the VPN:

Raspberry Pi VPN Router

This is a quick-and-dirty guide to setting up a Raspberry Pi as a "router on a stick" to PrivateInternetAccess VPN.

Requirements

Install Raspbian Jessie (2016-05-27-raspbian-jessie.img) to your Pi's sdcard.

Use the Raspberry Pi Configuration tool or sudo raspi-config to:

set up root and replace default user

pi@raspberrypi:~# sudo su
root@raspberrypi:/home/pi# passwd
root@raspberrypi:/home/pi# reboot

log in as root and set up new user

root@raspberrypi:~# useradd -d /home/user user
root@raspberrypi:~# passwd user

Download the latest ugw3 package from https://github.com/FossoresLP/vyatta-wireguard/releases and install it on your USG using dpkg -i wireguard-ugw3-<version>.deb.

cd /config/auth
umask 077
mkdir wireguard
cd wireguard
wg genkey > wg_private.key
wg pubkey < wg_private.key > wg_public.key

	# cat /usr/syno/etc.defaults/rc.d/S01iptables_nat.sh
	# Script to enable port forwarding and IP Masquerading, to share
	# the wireless connection to the ethernet port of ds213air
	# e.g. computer -> eth0 -> diskstation -> wlan0 -> router -> interwebs

	# Enable port forwarding, in case not enabled by default
	echo 1 > /proc/sys/net/ipv4/ip_forward

	# Load the required modules
	/usr/syno/etc.defaults/rc.d/S01iptables.sh load_nat_mod forwarding_test

	#!/bin/bash
	#
	# /etc/ppp/ip-down
	#
	# When the ppp link goes down, this script is called with the following
	# parameters
	# $1 the interface name used by pppd (e.g. ppp3)
	# $2 the tty device name
	# $3 the tty device speed
	# $4 the local IP address for the interface

	#' @title bibtex_2academic
	#' @description import publications from a bibtex file to a hugo-academic website
	#' @author Lorenzo Busetto, phD (2017) <[email protected]>

	bibtex_2academic <- function(bibfile,
	outfold,
	abstract = FALSE,
	overwrite = FALSE) {

	require(RefManageR)

	# Stat Installation

	# XCode CLT
	xcode-select --install

	# Update Homebrew
	brew update

	# Check for broken dependencies and/or outdated packages
	brew doctor

	Accessing docker container private network easily from your boot2docker host
	-----

	(from http://ispyker.blogspot.com/2014/04/accessing-docker-container-private.html)

	add a Host-only adapter in VirtualBox

	OSX:
	# show route table
	netstat -nr

	#!/bin/bash

	WIREGUARD_TAG=0.0.20181218

	THISDIR=$(readlink -f $(dirname $0))
	SYSROOT=$THISDIR/sysroot
	TARGET=mips64-octeon-linux-gnu
	MUSL_CC=$SYSROOT/bin/musl-gcc

	export PATH=$THISDIR/toolchain/bin:$PATH