Installing PiVPN

---

• Part 1: Enable SSH
• Part 2: Install Pi-Hole
• Part 3: Install PiVPN
• Part 4: Create a Full-tunnel user in PiVPN
• Part 5: Create a Split-tunnel user in PiVPN
• Part 6: Setup PiVPN Endpoint Device
• Part 7: Remove PiVPN user/client

---

So I already have PiHole installed at home and it works great to block ads at home. But if you’re not at home, how do you to block ads? What about if you want to access resources you have at home (i.e. – printers, file storage, remote support of non-tech-savvy family) while you are away? Well the answer is PiVPN.

You’ve probably heard of VPN services before or you might already use one. They are common for work places to use, to connect back to your office. As well as for individuals looking to bypass geo-location filters when you are overseas, to make it appear that you are in the U.S.

VPN actually stands for virtual private network. What that means is that when you connect to a VPN, you are essentially creating a secure encrypted tunnel from your device to the network on the other side. A VPN prevents “snooping eyes” from seeing the actual network traffic that crosses the wire, meaning that you only you and the other end know what you are doing. The caveat to that, depending on how your VPN is set up, is that the internet traffic on your device will appear to be coming from the network you are VPNed into and that will be visible to the ISP. So don’t think that just because you setup a VPN on your Raspberry Pi at home that you can blindly surf the Internet and download illegal torrents without consequence, because you’d be wrong. The best use case, in my opinion, for setting up a VPN, or in our case PiVPN, is to access your files and storage when you’re not at home.

---

Lets get started with setting up PiVPN.
As a prerequisites, make sure that you have already installed and setup PiHole.

Open a terminal window or SSH into your Raspberry Pi (RPi)

Enter the following command:

curl -L https://install.pivpn.io | bash

By running the above command essentially piping the curl command to bash, the RPi will automatically download and run PiVPN.

A cautionary note about piping curl to bash – Basically, be sure you trust the source, because you’re essentially letting them run whatever they want on your device!

The PiVPN Automated Installer should appear. Click ‘Ok’.

The installer will need to apply a static IP address to your Raspberry Pi. This is a PiVPN requirement. If you’re running PiHole, you should already have a static IP assigned to your device. If you don’t… go fix that now, and come back.
If you do already have a static IP address assigned at this screen, click ‘No’.

Comment on the above step… Even if you set a static IP on the device, if that IP is within the DHCP reservation pool, the DHCP server (the router, for most people) could theoretically still assign that IP to another device. That should never happen for an always on device, but if you take it offline for a while or switch routers it could happen.
So when setting static IP addresses, take a look into your network’s settings and assign addresses outside of the DHCP pool’s range. This will help prevent the possible scenario i just mentioned above.

The next screen shows your current network settings and confirms that you want to use it as your static address. Click ‘Yes’.

The next screen is just a warning of what could happen with an IP conflict if the RPi does not have a static IP address and is using DHCP. We’re all set though using a static IP, so click ‘Ok’.

Next we will choose the user which we’ll install PiVPN under…
Click ‘Ok’.

Then choose the desired user, and click ‘Ok’ again.

We want to install WireGuard. So on this screen, select it and click ‘Ok’.

*If you need, or wish, to install OpenVPN to meet you needs then that option is available. My recommendation – If this is your first time setting up a VPN, stick with the default – WireGuard.

Wait and watch the status bar complete….

Select your default port. I am going to leave mine set to the default value “51820”. Click ‘Ok’.

Confirm the port, click ‘Yes’.

Because PiHole is already install, PiVPN detects it and offers to set that as our desired DNS. This is what we want, so click ‘Yes’.

This next screen asks how we will be connecting remotely to our PiVPN.

Most of us do not have a static “external” IP given to us by our ISP. So with that in mind, we do not want to use the public IP address that is shown.

We want to use a Dynamic DNS (DDNS) service. The best example of this type of DDNS service is No-IP (noip.com). This type of service allows you to run a client within your network that will go out and check what your external IP is, and then update No-IP with that address any time it changes. Dynamically updating the DNS record that you have setup with the DDNS service provider.

Note: This DDNS value can be changed later if your DDNS public name ever changes, though you would need to update your user/client endpoints to use the updated name.

Since we already have DDNS set up, we will be chooseing “DNS Entry – Use a public DNS”. Click ‘Ok’.

Enter your DDNS public DNS name. Click ‘OK’.

Confirm your entry. Click ‘Yes’.

The generation of the encryption keys are the next step. Click ‘Ok’.

We will want to acknowledge the ‘Unattended Upgrades’ page. It’s just letting us know that we should enable this feature and have the RPi automatically check for and install security updated for us daily. Note, that it will not automatically reboot the RPi, so we’ll need to do that manually from time to time. Click ‘Ok’.

Click ‘Yes’

Wait and watch the status bar complete….

Click ‘Ok’. PiVPN has now been installed! Woohoo!!!
We will still need to add our users/profiles before we can log in.

Click ‘Yes’ to reboot your RPi. Then ‘Ok’ again to initiate the reboot.

---

Now we need to log into our router.
We will need to setup a port forwarding. We need to forward port 51820 to our Raspberry Pi.
This will allow traffic both ways between the Internet and your PiVPN.

Note: If you skip this port forwarding step, you will not be able to connect remotely to your PiVPN.

---

Next Article in this series: Part 4: Create a Full-tunnel user in PiVPN