Info about back-tunnel here

S14 tunnel https://e2h.totalism.org/e2h.php?_=X-s14-net

local/ S14 machine

ssh tunnel@10.94.185.76 sudo openvpn --config /home/tunnel/client.conf

HOW TO START OPENVPN ON REBOOT?

https://www.smarthomebeginner.com/configure-openvpn-to-autostart-linux/

edit /etc/default/openvpn

Remove the ‘#' infront of ‘AUTOSTART=”all”‘ so that OpenVpn allows to start the .conf files

sudo systemctl enable openvpn-client@.service

sudo systemctl daemon-reload sudo systemctl restart openvpn-client@anarcha.service

sudo openvpn --config <client-name>.ovpn Initialization Sequence Completed

2. Run client openvpn as daemon in the background - see `man openvpn` for more options

sudo openvpn --config <client-name>.ovpn --daemon

To stop the daemon:

1. Find the daemon process

pgrep -lf openvpn

1. Kill the process

sudo kill <process number>

1. Run client openvpn in the foreground for troubleshooting the tunnel:

sudo openvpn --config <client-name>.ovpn if your verbosity in the client conf file is set to 4, then stdout of the above command should end with Initialization Sequence Completed

1. Run client openvpn systemd unit file:

Copy your client conf file to /etc/openvpn/client/ directory

in this way you can stop, start and check status of the vpn with the systemctl command: e.x if your client file is called myvpn.conf, then the command goes:

sudo systemctl start|stop|status openvpn-client@anarcha.service

(All system unit files are in /lib/systemd/system/)

Explanation: the system unit script is in /lib/systemctl/system/openvpn-client@.service whatever name you put between openvpn-client@ and .service is passed inside this unit file. This unit file which changes dir to /etc/openvpn/client and executes openvpn --config <name>.conf

1. Run server openvpn systemd unit file:

sudo systemctl start|stop|status openvpn@server.service

1. Check tunnel is up

sudo ifconfig ip addr show dev tun0 tun0 should appear

Ping from your pi the server's tun0 IP 10.8.0.1 ping 10.8.0.1 traceroute 10.8.0.1

From your pi run ifconfig and find your tun0 IP, let's say it's 10.8.0.10

Ping from the anarchaserver your pi_tunnel_ip

SSH to tunnel pi from anarchaserver (2 ways) 1. edit /root/.ssh/config and update the Hostname IP to match the one of the pi's tun0 (once pi gets a dns or a static IP we won't have to edit this config file) then do: ssh tunnel-pi 2. OR do: ssh tunnel@1.8.0.10 OK*

copy files

MOUNT HARD DRIVE tunnel@<pi_tunnel_ip>:/mnt/S14-backup tunnel@<pi_tunnel_ip>:/mntmeme_bak

STORAGE Mount disks

NAS http://water.local:5000/ sudo mount.cifs -o user=tunnel,password=*****,uid=1001,rw,vers=2.0 //10.94.185.9/web/anarcha /mnt/S14-backup /mnt/S14-backup

DISK sudo mount /dev/sda1 /mnt/meme_bak

HOW TO DO THAT IN STARTUP? add the above mount command in /etc/fstab (double check online tips) to tell where the storage device will be automatically mounted when the Raspberry Pi starts up. https://www.raspberrypi.org/documentation/configuration/external-storage.md

REF:

   https://confluence.jaytaala.com/display/TKB/Mount+drive+in+linux+and+set+auto-mount+at+boot
   https://kwilson.io/blog/force-your-raspberry-pi-to-mount-an-external-usb-drive-every-time-it-starts-up/
   https://raspberrypi.stackexchange.com/questions/46171/how-do-i-mount-my-nas

1. DISK

In the fstab file, the disk partition is identified by the universally unique identifier

sudo blkid

ADD UUID=a164f220-cc96-450f-aa4a-27849ed21d44 /mnt/meme_bak ext4 defaults,auto,users,rw,nofail 0 0

1. mount cloud

NAS

ADD //10.94.185.9/web/anarcha /mnt/S14-backup cifs user=tunnel,password=****,uid=1001,rw,iocharset=utf8,vers=2.0 0 0

Next challenge HOW TO REACH NAS water from the browser when tunnel is UP Need to mount NAS water on startup with adding the mount command also in /etc/fstab Register a domain name for the pi and either request from your internet provider a fixed IP or run a script in pi to update the dns service reqularly with its dynamic public IP. (mara has done the latter with her pi) install samba server on pi, or apache2, or nginx to serve content of the mounted disks Edit the /etc/openvpn/server.conf to push traffic to pi IP subnet. (lines 134- 140) The user's device which wants to reach pi or NAS via the browser, needs also to install openvpn and a client certificate

FIND tunnel pi IP when outside the house You need to know the CN in your certificate, Lookup the line starting with Subject: located in the file .cert or in the client conf if all keys and certs are bundled within. E.x Subject: C=SP, ST=Catalunya, L=Barcelona, O=AnarchaServer, OU=AnarchaServer, CN=FutureVintage/name=EasyRSA/emailAddress=anarchaserver@autistiche.org SSH to anarcha, and do: tail /var/log/openvpn.log search for the CN name, in our example FutureVintage, and check the IP In our example in openvpn.log it looks like:

   Fri Feb  7 21:14:57 2020 us=535934 MULTI: Learn: 10.8.0.10 -> FutureVintage/5.135.58.235:50855

LATER

1. Add local subnet to vpn

https://openvpn.net/community-resources/how-to/#pki https://community.openvpn.net/openvpn/wiki/FAQ https://forums.openvpn.net/viewtopic.php?t=14358 https://openvpn.net/archive/openvpn-users/2007-09/msg00094.html

1. Enable two-way traffic client-server

Reach OpenVPN clients directly from a private network https://openvpn.net/vpn-server-resources/reach-openvpn-clients-directly-from-a-private-network/

diagram https://e2h.totalism.org/e2h.php?_=X-s14-net