I'm headed to the UK, and I need a VPN so I can access my home network and NAS on the go.
VPN stands for Virtual Private Network, and VPNs are used for a lotta different reasons.
Companies have VPNs that let employees work from home but using office systems.
VPNs encrypt traffic to protect your data when you're on public WiFi. And some VPNs
allow you to choose a region to access content that might be region-locked.
But for me, today, I can't rely on that. I need my OWN VPN. This video's gonna show
you how to build your own, private VPN for your home. It doesn't take much! I
built mine using this Raspberry Pi, and the only other thing you need is an Internet connection.
And you don't even need a Raspberry Pi. You can run a VPN on a used Mini PC like
this one I bought used for a hundred bucks. This thing would run the VPN even faster than the Pi!
Of course, speed also depends a lot on your Internet! I have Spectrum
'gigabit'... but that 'gigabit' only refers to download speed. Upload speed,
which matters a lot more here, is stuck at 35 megabits... but I can live with that,
I just have to "stop all the downloadin", at least when I'm on my VPN.
But you also need a public IP address. It doesn't have to be static—meaning it
stays the same forever—but it does have to be public. If you have 4G or 5G Internet,
your ISP might use something called CG-NAT. If they do,
you can't run a private VPN, but there are options; I'll get to those later.
But how do you know if you have a public IP address?
Well, visit icanhazip.com and copy out the IP address it gives you. Then open
Terminal or Powershell, and run traceroute, then your IP address. Oh, and on Windows,
traceroute is spelled trace-r-t for some reason.
If it just shows one line, like this,
then you're good to go. If it shows more than one line, then you're stuck behind CG-NAT.
Now I do have a public IP address, and I have this little Raspberry Pi. By the end
of this video, I'll be able to access my home network the whole time I'm in
the UK. And best of all? I won't use any cloud services to do it!
And... that awkwardly leads me to this video's sponsor, Surfshark!
It's ironic, because this whole video's about making your own VPN,
right? Why would Surfshark, a cloud VPN provider, sponsor this?
Well, I still use Surfshark in addition to my home VPN
because sometimes I need a different kind of VPN.
Sometimes I just want an encrypted connection when I'm on public WiFi,
or I wanna be able to watch my favorite shows that are region-locked in the US while I'm over in
the UK. Surfshark solves both problems, and they have a way faster Internet connection than I do!
They also have tons of servers around the world and even some cool features
like static IP addresses and even an addon called Dedicated IP that makes
it easier to use Surfshark even through other secure VPNs! VPN-ception? I love it!
And to top it all off, guess what protocol they
use by default. Wireguard! Just like we're gonna setup in a few minutes!
Sign up using my link below, or just use the code redshirtjeff,
and you can get an extra 3 months free! Plus they have a 30-day money-back guarantee,
so there's nothing to lose if you try it out.
So what's the quickest way to build your own secure, private VPN at home? PiVPN.
On the website, it says it's the "simplest and fastest way to install
and set up an extremely secure OpenVPN or WireGuard server on your Raspberry Pi."
And you don't have to use a Pi—you can even install
it on a VPS or most any computer running Debian!
So let's get started! I already flashed Raspberry Pi OS to this microSD card with
Raspberry Pi's Imager, and when I did that, I also set the hostname to pivpn.local,
and set up a Pi user and password. I also recommend using an SSH key, but you don't have to.
So I put the card in my Pi, and plugged it into my network. After it booted up,
I connected with SSH. You could also do this setup with a keyboard and mouse,
but I don't even have my Pi plugged into a monitor, so that wouldn't be easy here!
Your Pi VPN computer should have a static IP address on your home network,
too. And you can do that on your home router, or you can set an IP address during the PiVPN
setup process. I did it on my router, because that's how I manage my other homelab servers.
And this is entirely optional, but since I bought a domain name that I use for all my
homelab servers, I actually changed the local hostname for my Pi VPN to pivpn.geerli.net.
So now that I have a persistent internal IP address and a hostname,
I can log into the Pi and run the PiVPN installer.
I just ran the script from their website, and followed the guided installer.
When I was prompted to pick a VPN option,
I chose WireGuard, since it's a lot newer than OpenVPN and slightly faster on my Pi.
I kept the default port, and since I run Pi-hole on my network and use it for my home DNS,
I chose the 'Custom' option for DNS Provider, and input the IP address of the server running
Pi-hole. If you don't run Pi-hole, you could use something like Cloudflare DNS instead.
For the 'DNS or IP' option, I chose to assign a public DNS name to my VPN
server for one of the domains I own. Now, I won't tell you exactly what that domain is,
because last time I did that, some idiot started DDoSing my home Internet until
my ISP threatened to cut me off. I made a whole video about that.
So, yeah, not gonna do that again! (sarcastically)
But to make that custom domain work, I added a DNS A record for my home's
public IP address to my domain settings. I usually grab my home IP address by running
curl icanhazip.com. You could also visit that domain in your browser.
To make sure the traffic gets through to Pi VPN,
you have to enable port forwarding on your router. On mine, this is what that looks like,
and I set up the external UDP port 51820 to point to the internal static IP address I set
up for my Pi VPN. Now traffic from the public Internet can route through the Pi to PiVPN.
Now, at this point, if all this talk about "UDP", "routers",
and "static IPs" has your head spinning, I have to give a bit of a warning. Security is a huge
concern here—don't set up a VPN if you don't know what you're doing first. If someone gets
access through the VPN to your home network, they could hack into anything in your house!
Along that theme, another way people can break in is if you don't keep your software up to
date. PiVPN helpfully offers to set up automated updates on your computer, but I recommend even
more security hardening, especially since this computer's exposed to the Internet!
For me, that means running my Ansible security playbook. I have a whole video
in my Ansible 101 series where I talk about the 'first five'—the first steps you should
take securing any Linux server. Go check it out by clicking that link up there.
After PiVPN finishes setting things up, it recommends rebooting, so go ahead and do that now.
Now you have a running VPN, but no way to connect to it. You need to
create a new client profile for each device you want to connect.
Log back into the Pi VPN computer, and run the command pivpn add.
It asks you for a name, and for me, I usually set a name like username,
devicetype, and network identifier, so in this case, jgeerling dash macbook dash home.
Doing that lets me remember exactly what client I'm looking at.
After it generates the config file, you need to copy it to your computer. I usually use scp,
or 'Secure Copy', like this, but you could also use SFTP,
or just cat out the file and then copy the contents into a file on your computer.
Now, I have a Mac, but the process is pretty much the same on anything.
I installed Wireguard from the Mac App Store, and opened it.
Inside, click "Import Tunnel from File..." and chose the config file you just copied.
Now comes the moment of truth... To make sure the VPN actually works,
you should test it on an external network. You could tether to your mobile phone,
but since I was with my Dad filming a Geerling Engineering video today, I hopped on his WiFi.
I went into the Terminal to check if I can ping one of the computers on my home network.
And... I can't, of course, because I'm on his network!
If I turn on the VPN connection, though,
I should be back on my home network, but this time from the radio station.
And if I ping that computer again... There it is! Now I have my own completely private VPN!
The next thing I wanted to do was see how fast it was. There are limitations here,
from my Dad's WiFi speed, to Spectrum's slow upload speeds, but it's helpful to know.
So while I was connected, I ran some speed tests, and I got speeds anywhere from 10 to 20 megabits.
Then when I came home, I ran a speed test and got over 500 megabits.
But to test the theoretical limits,
I connected through the VPN while I was at home, and got speeds from 30 to 200 Megabits.
So my slow upload bandwidth really slows things down, plus there's a little overhead
from the tiny Raspberry Pi encrypting the connection. But it works for what I need.
The other main thing I wanna do is use Home Assistant on my phone without relying on any
cloud services, so to do that, the first step is installing Wireguard on my phone.
There are apps for Android and iOS, and after I install it,
I can add a new connection using a QR code.
To generate one of those, lets head back over to Pi VPN.
First, create another client for your phone. I called mine
jgeerling-iphone-home. Then run pivpn -qr to display a QR code right in the Terminal.
Point your phone's camera at the terminal window, and there it is! Just name it the
same as you typed in PiVPN, and then go ahead and test the connection.
Disconnect from your home WiFi if you're connected, then activate the Wireguard
connection. Visit icanhazip.com in your browser, and it should show you your home's IP address!
This is great! Now I can make sure Red Shirt Jeff's not in the
workshop starting a fire or blowing anything up!
Now, VPNs aren't always simple.
If you have any issues, the first thing to do is run pivpn -d. This runs some self-tests
and displays a ton of debug information. If everything checks out OK, it could be you have
DNS issues—it's almost always DNS, and that's why I have a shirt for that over on redshirtjeff.com.
Another handy command is pivpn -c. That shows a list of all
clients and their last connection times, with data transfer stats.
And it's a good idea to back up your VPN configuration,
in case your VPN computer ever dies. Run pivpn backup to generate a backup
tarball inside the home directory. Then copy that off to a safe place. Restoring is as
simple as copying all the files from that tarball back to a fresh install of PiVPN.
You might be wondering what to do if your home doesn't have a 'static' IP address. Well,
me too. I mean, I have a pretty stable IP address, but it does change every few months.
If your public IP address changes, you have to make sure the DNS A record you set up for
your VPN is also updated in your domain registrar account. And that's not always easy to automate!
The best way to deal with 'Dynamic DNS' or DDNS is to use a service like DynDNS
or No-IP. But to do that, you have to run something on your router or a computer
on your home network that periodically updates their server with your home IP.
In my case, since I'm a little over-cautious,
I publish my IP address to a private VPS I run on DigitalOcean. Then if my VPN connection fails,
I just log into that server and grab the updated IP address, then I put it in my domain settings.
I have a custom shell script that looks a little like what you see on the screen,
and I have it run on a cron job on my Pi VPN.
I could probably make it better though—I could make it so it detects when the IP address changes,
and if it does, I could have it send me a Slack, a Telegram, a WhatsApp,
a Signal, an Email, a Discord, a Skype, or whatever chat app in style these days.
But I'm a simple man, so I don't.
Now, at this point, you might have what you need, and be on your merry way.
But there are two different use cases PiVPN can't cover.
First, what do you do if your stuck behind CG-NAT,
like I mentioned at the beginning of this video, and PiVPN doesn't work?
And second, what if you don't need access to your home network, but you just want some
of the protections a VPN has to offer? Like encrypting traffic on public WiFi,
or bypassing geographical content restrictions?
First, I'll cover CG-NAT.
Unfortunately, if you have CG-NAT, you can't really run a private self-hosted VPN,
since you don't have a direct gateway to the public Internet.
You could call your ISP and see if there's any way to get a public IP address... but don't get your
hopes up. Sometimes it's impossible, like with Starlink, and other times you have to upgrade
to a business plan which could cost a lotta money! Otherwise, you could use a service like
Tailscale, Cloudflare Tunnel, or Twingate. It does mean you're dependent on a cloud service
to access your home network, but I've used all three and I think they're pretty solid.
But maybe you don't even need a private home VPN at all! If you just want a little extra
security on public WiFi, or if you wanna bypass content restrictions,
there are a bunch of decent and affordable VPN providers.
And the one I use? Surfshark! And not just because they're sponsoring
this video. I've been using them for a while now,
and if you wanna try them out, make sure you use the link in the description.
Until next time, I'm Jeff Geerling.