Skip to content

Commit 64c7302

Browse files
satrapesDimitris Paraskevopoulos
satrapes
and
Dimitris Paraskevopoulos
authored
Add a ProtonVPN Road Warrior setup page (opnsense#521)
* Add ProtonVPN WireGuard page --------- Co-authored-by: Dimitris Paraskevopoulos <[email protected]>
1 parent ec65e88 commit 64c7302

File tree

5 files changed

+202
-2
lines changed

5 files changed

+202
-2
lines changed

‎source/manual/how-tos/images/proton_configuration_1.png

303 KB
Loading

‎source/manual/how-tos/images/proton_wireguard_configuration.png

209 KB
Loading

‎source/manual/how-tos/wireguard-client-proton.rst

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
=======================================
2+
WireGuard ProtonVPN Road Warrior Setup
3+
=======================================
4+
5+
------------
6+
Introduction
7+
------------
8+
9+
ProtonVPN is a cloud-based VPN provider, offering secure tunneling with respect to privacy.
10+
To set up a WireGuard VPN to ProtonVPN we assume you are familiar with the concepts of WireGuard that
11+
you have read the basic howto :doc:`wireguard-client`.
12+
13+
-----------------------------------------
14+
Step 1 - Download ProtonVPN configuration
15+
-----------------------------------------
16+
17+
The configuration is available in the ProtonVPN website.
18+
The `landing page <https://account.protonvpn.com/dashboard>`__ appears after signing in.
19+
Click on Downloads from the left hand panel or go to the `downloads page <https://account.protonvpn.com/downloads>`__ and
20+
scroll down to the `WireGuard configuration <https://account.protonvpn.com/downloads#wireguard-configuration>`__
21+
22+
The existing WireGuard configurations appear first with their expiration dates and following are the options to generate new ones.
23+
24+
.. image:: images/proton_wireguard_configuration.png
25+
:width: 100%
26+
27+
- Select a name for the generated configuration
28+
29+
.. Note::
30+
If a name is not provided a unique ID will be generated by ProtonVPN
31+
32+
- Select Router as a platform
33+
- Select VPN options
34+
35+
- There are 3 options for NetShield blocker filtering
36+
37+
- No filtering
38+
- Block malware
39+
- Block malware, ads and trackers
40+
41+
- There are also options to enable Moderate NAT, NAT-PMP (Port Forwarding) and VPN accelerator as well. The features are documented in the ProtonVPN website.
42+
- Pick the options that satisfy your requirements and move on to the next section.
43+
44+
- Select a server to connect to
45+
46+
- ProtonVPN proposes the best server or allows the user to select manually.
47+
- When selecting manually there are 2 main choices:
48+
49+
- Standard vs Secure Core configuration
50+
- Exit country
51+
52+
- Pick the one that satisfies your requirements and click on `Create` to generate the configuration.
53+
- Upon successful completion a window like the following will appear on the screen.
54+
55+
.. image:: images/proton_configuration_1.png
56+
:width: 100%
57+
58+
The full configuration looks like this:
59+
60+
.. code-block:: none
61+
62+
[Interface]
63+
# Bouncing = 0
64+
# NetShield = 1
65+
# Moderate NAT = off
66+
# NAT-PMP (Port Forwarding) = off
67+
# VPN Accelerator = on
68+
PrivateKey = 2Kh7TlGz+7PCFa0jEHat8IWkYZgPmDLAiagGq+dyLks=
69+
Address = 10.2.0.2/32
70+
DNS = 10.2.0.1
71+
72+
[Peer]
73+
# NO#21
74+
PublicKey = KOITt3KQ72LHPbpVp7kp4cQo/qw2qvKPrN732UTWWFw=
75+
AllowedIPs = 0.0.0.0/0
76+
Endpoint = 146.70.170.18:51820
77+
78+
.. Note::
79+
The private key disappears after creating the configuration so it must be stored. It will be used in the following
80+
section to generate the public key. Both are needed for successful configuration.
81+
82+
.. Warning::
83+
**Do not re-use the private keys in these examples**
84+
85+
---------------------------------------------
86+
Step 2 - Generate public key from private key
87+
---------------------------------------------
88+
89+
ProtonVPN, unlike Mullvad or other WG implementations, only provides a private key. The private key appears briefly when generating the configuration in the web UI.
90+
The public key will be derived from the private key with the "wg pubkey" command.
91+
92+
`Windows`
93+
94+
.. code-block:: sh
95+
96+
echo wgPrivateKey | wg pubkey
97+
98+
`Linux`
99+
100+
.. code-block:: sh
101+
102+
wg pubkey < wgPrivateKey
103+
104+
----------------------------------
105+
Step 3 - Setup WireGuard Instance
106+
----------------------------------
107+
108+
- Go to :menuselection:`VPN --> WireGuard --> Settings --> Instances`
109+
- Click **+** to add a new Instance configuration
110+
- Turn on “advanced mode"
111+
- Configure the Instance from the downloaded ProtonVPN configuration as follows (if an option is not mentioned below, leave it as the default):
112+
113+
===================== ===============================================================================================
114+
**Enabled** *Checked*
115+
**Name** *Call it whatever you want (eg* :code:`ProtonVPN-ExitCountry` *)*
116+
**Public Key** *Insert the derived public key from the previous step*
117+
**Private Key** *Insert the* :code:`PrivateKey` *field from the* :code:`\[Interface\]` *section*
118+
**Listen Port** *51820 or a higher numbered unique port*
119+
**MTU** *Needs to be 80 bytes shorter than normal MTU. Default 1420*
120+
**DNS Server** *Insert the* :code:`DNS` *field from the* :code:`\[Interface\]` *section as is (without subnet mask)*
121+
**Tunnel Address** *Insert the* :code:`Address` *field from the* :code:`\[Interface\]` *section` in CIDR format, eg 10.2.0.2/32*
122+
**Peers** *Leave blank for now*
123+
**Disable Routes** *Checked*
124+
**Gateway** *Insert the same address as in the DNS Server field above*
125+
===================== ===============================================================================================
126+
127+
- **Save** the Instance configuration, and then click **Apply**
128+
129+
-------------------------------
130+
Step 4 - Configure the peer
131+
-------------------------------
132+
133+
- Go to :menuselection:`VPN --> WireGuard --> Settings --> Peers`
134+
- Click **+** to add a new Peer
135+
- Configure the Peer from the downloaded ProtonVPN configuration as follows (if an option is not mentioned below, leave it as the default):
136+
137+
====================== ====================================================================================================
138+
**Enabled** *Checked*
139+
**Name** *Call it whatever you want (eg* :code:`ProtonVPN_Location` *)*
140+
**Public Key** *Insert the* :code:`PublicKey` *field from the* :code:`\[Peer\]` *section*
141+
**Allowed IPs** *0.0.0.0/0*
142+
**Endpoint Address** *Insert the IP address from the* :code:`Endpoint` *field in the* :code:`\[Peer\]` *section*
143+
**Endpoint Port** *Insert the port number from the* :code:`Endpoint` *field in the* :code:`\[Peer\]` *section*
144+
**Instances** *Select the instance configured in the previous step*
145+
**Keepalive** *25*
146+
====================== ====================================================================================================
147+
148+
- **Save** the Peer configuration, and then click **Apply**
149+
150+
.. Note::
151+
The UI for configuring the Instances and Peers changed with OPNsense verion 23.7.9 so some of the fields may be in different
152+
places.
153+
154+
--------------------------
155+
Step 5 - Turn on WireGuard
156+
--------------------------
157+
158+
Turn on WireGuard under :menuselection:`VPN --> WireGuard --> Settings --> General` if it is not already on
159+
160+
----------------------------------------------------
161+
Step 6 - Configure assignments, gateways and routing
162+
----------------------------------------------------
163+
164+
The rest of the steps are mostly the same as described in the how-to on selective routing :doc:`wireguard-selective-routing`
165+
166+
-------------------
167+
ProtonVPN DNS leaks
168+
-------------------
169+
Since ProtonVPN provides a DNS server an extra firewall rule may be required to route the DNS traffic to the
170+
WireGuard gateway.
171+
172+
- Go to :menuselection:`Firewall --> Rules --> [Name of interface for network in which hosts/network resides, eg LAN for LAN hosts]`
173+
- Click **Add** to add a new rule
174+
- Configure the rule as follows (if an option is not mentioned below, leave it as the default):
175+
176+
============================ ====================================================================================================================
177+
**Action** *Pass*
178+
**Quick** *Checked*
179+
**Interface** *Whatever interface you are configuring the rule on*
180+
**Direction** *in*
181+
**TCP/IP Version** *IPv4*
182+
**Protocol** *TCP/UDP*
183+
**Source / Invert** *Unchecked*
184+
**Source** *IP of your DNS server*
185+
**Destination / Invert** *Checked*
186+
**Destination** *Select the* :code:`RFC1918_Networks` *Alias you created above in the dropdown*
187+
**Destination port range** *DNS - DNS*
188+
**Description** *Add one if you wish to*
189+
**Gateway** *Select the WireGuard gateway created according to the selective routing how-to page (eg* :code:`WAN_ProtonVPN` *)*
190+
============================ ====================================================================================================================
191+
192+
- **Save** the rule, and then click **Apply Changes**
193+
- Then make sure that the new rule is **above** any other rule on the interface that would otherwise interfere with its operation. For example, you want your new rule to be above the “Default allow LAN to any rule”
194+
195+
In layman terms if the DNS server makes any requests to a non-local address it will go through the VPN gateway.
196+
197+
198+
All images from `ProtonVPN` website are the property of `ProtonVPN` and are used with written permission.
199+

‎source/manual/how-tos/wireguard-selective-routing.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ Step 6 - Create a gateway
120120

121121
.. Note::
122122

123-
Specifying the endpoint VPN tunnel IP is preferable. As an alternative, you could include an external IP such as 1.1.1.1 or 8.8.8.8, but be aware that this IP will *only* be accessible through the VPN tunnel (OPNsense creates a static route for it), and therefore will not accessible from local hosts that are not using the tunnel
123+
Specifying the endpoint VPN tunnel IP is preferable. As an alternative, you could include an external IP such as 1.1.1.1 or 8.8.8.8, but be aware that this IP will *only* be accessible through the VPN tunnel (OPNsense creates a static route for it), and therefore will not be accessible from local hosts that are not using the tunnel
124124

125125
Some VPN providers will include the VPN tunnel IP of the endpoint in the configuration data they provide. For others (such as Mullvad), you can get the IP by running a traceroute from a host that is using the tunnel - the first hop after OPNsense is the VPN provider's tunnel IP
126126

‎source/manual/vpnet.rst

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -721,7 +721,8 @@ This paragraph offers examples for some commonly used implementation scenarios.
721721
how-tos/wireguard-client
722722
how-tos/wireguard-client-azire
723723
how-tos/wireguard-client-mullvad
724-
724+
how-tos/wireguard-client-proton
725+
how-tos/wireguard-selective-routing
725726

726727
--------------------------
727728
Plugin VPN options

0 commit comments

Comments
 (0)