Manual setup for PIA (VPN Service Provider) with Gargoyle OpenVPN

Post by **ispyisail** » Wed Nov 15, 2017 5:02 pm

can you draw a network diagram?

twf85 · Post by **twf85** » Mon Dec 04, 2017 6:22 pm

Thank you for the settings/guide, encro.

I made a few small adjustments to your config:

client
dev tun
proto udp
remote VPN_SERVER_ADDRESS_HERE 1198
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
keysize aes-128-cbc
auth sha1
tls-client
remote-cert-tls server
tun-mtu 1500
tun-mtu-extra 32
comp-lzo no
sndbuf 393216
rcvbuf 393216
verb 1
reneg-sec 0
auth-user-pass '/etc/openvpn/AUTH_FILE_NAME_HERE'
crl-verify '/etc/openvpn/crl.rsa.2048.pem'

On a WRT1200ACv1, these settings boosted my speedtests from ~20Mbit to ~28Mbit (on a 150Mbit line).

Source for edits (posts by user "MrGenie):
https://www.privateinternetaccess.com/f ... -speeds/p8

I couldn't get these two settings from MrGenie to work:

Code: Select all

push "sndbuf 393216"
push "rcvbuf 393216"

Though Gargoyle showed a successful connection to the PIA VPN server, I could not access the internet from any connected devices.

He claims that "Speed is simply doubled using these settings", which includes the settings I couldn't get to work.. So, maybe there is room for improvement?

sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"

These 5 settings in the server definately have a huge impact on the router!
Speed is simply doubled by using these settings.

I'm unsure of the 5th setting he's referencing..

in the end, my recommended settings for encrypted connections:
t;s-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
cipher AES-256-CBC
auth SHA256
tun-mtu 1500
tun-mtu-extra 32 (for tap)
comp-lzo no

sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"

On the 2 windows clients you'll get roughly 120-150Mbps
on the WRT3200ACM you'll get roughly 80Mbps

If you are copy+pasting this block of settings, make sure to correct "t;s-cipher" -> "tls-cipher" and remove " (for tap)".

JasonB11 · Post by **JasonB11** » Sat Feb 10, 2018 9:17 pm

encro wrote:Despite the TLS standard stating that a client key isn't required Gargoyle won't unfortunately let you bypass it. Private Internet Access (PIA) does not generally have a client key.

Download the PIA Certificate files (ca.rsa.2048.crt and crl.rsa.2048.pem) from https://www.privateinternetaccess.com/o ... penvpn.zip

Copy those 2 certificate files into /etc/openvpn on the Gargoyle Router using WinSCP.

While you are in the /etc/openvpn directory, create a file called pia.auth and edit the file:
The first line should have your L2TP Username
The second line should have your L2TP Password.
Save this file and change the permissions on the file to 0600 (rw-------) for security and ensure the group and owner are root.

Create a OpenVPN client from the Open VPN menu option in Connections in the Gargoyle UI.

OpenVPN Server Address: Select the address from https://www.privateinternetaccess.com/pages/network/
Port: 1198
UDP
Encryption Type: Other
aes-128-cbc

Enter the following into the 'OpenVPN Configuration:'
(Change the PIA Server name to your preferred/geographically closer option).

Code: Select all

keysize aes-128-cbc
client
dev tun
proto udp
remote aus-melbourne.privateinternetaccess.com 1198
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server
auth-user-pass /etc/openvpn/pia.auth
comp-lzo
verb 1
reneg-sec 0
auth-user-pass '/etc/openvpn/pia.auth'
crl-verify '/etc/openvpn/crl.rsa.2048.pem'

CA Certificate:

Code: Select all

Client Certificate:

Code: Select all

Client Key:

Code: Select all

Click the 'Save Changes' button.

Gargoyle will then create 4 files in /etc/openvpn:
grouter_client_{randomidentifier}.conf
grouter_client_{randomidentifier}.crt
grouter_client_{randomidentifier}.key
grouter_client_{randomidentifier}_ca.crt

The grouter_client_{randomidentifier}.conf will be referenced as the configuration file in:
/etc/config/openvpn
/etc/config/openvpn_gargoyle

You should now see that OpenVPN is running and it will also appear on the Gargoyle login screen. If you go to the Private Internet Access website it will also show that you are protected at the top of the page.

I hope you find this useful, I've been trying to get this working for the last 2 days and it is finally working

Note that the Certificate and RSA Key data above comes from this post:
https://www.privateinternetaccess.com/f ... -on-ios/p1

This totally worked for me too! Thanks a lot!

Gargoyle Forum

Manual setup for PIA (VPN Service Provider) with Gargoyle OpenVPN

Re: Manual setup for PIA (VPN Service Provider) with Gargoyle OpenVPN

Re: Manual setup for OpenVPN

Re: Manual setup for OpenVPN