PiHole only available via OpenVPN<\/p>\n
Install OpenVPN on PiHole server according to https:\/\/ubuntu.com\/server\/docs\/service-openvpn<\/a><\/p>\n At https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-set-up-an-openvpn-server-on-ubuntu-16-04<\/a> you find a hint, how to set up a client config script.<\/p>\n create a file Then you can run You now can import that in your NetworkManager. The good old resolv.conf does not work, so you can add the IP address 10.8.0.1 of the VPN server as DNS in theconfiguration, where the pihole is running.<\/p>\n We have to block the external interface in the chain DOCKER-USER, see https:\/\/docs.docker.com\/network\/iptables\/<\/a>. <\/p>\n With these commands you can successful block everything, except port 80 from outside (for letsencrypt) and everything in the network 10.8.0.1\/24 (openVPN)<\/p>\n Save them ( Goal PiHole only available via OpenVPN Steps to Achieve Install OpenVPN on PiHole server according to https:\/\/ubuntu.com\/server\/docs\/service-openvpn At https:\/\/www.digitalocean.com\/community\/tutorials\/how-to-set-up-an-openvpn-server-on-ubuntu-16-04 you find a hint, how to set up a client config script. create a file \/etc\/openvpn\/client\/make_config.sh on the server, below the adjusted to the current ubuntu configuration with easy-rsa #!\/bin\/bash # First argument: Client identifier OPENVPNDIR=\/etc\/openvpn… Continue reading OpenVPN for Your PiHole<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10,7],"tags":[],"class_list":["post-675","post","type-post","status-publish","format-standard","hentry","category-it-sec","category-linux"],"_links":{"self":[{"href":"https:\/\/blog.chloesoe.ch\/index.php?rest_route=\/wp\/v2\/posts\/675","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.chloesoe.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.chloesoe.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.chloesoe.ch\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.chloesoe.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=675"}],"version-history":[{"count":6,"href":"https:\/\/blog.chloesoe.ch\/index.php?rest_route=\/wp\/v2\/posts\/675\/revisions"}],"predecessor-version":[{"id":682,"href":"https:\/\/blog.chloesoe.ch\/index.php?rest_route=\/wp\/v2\/posts\/675\/revisions\/682"}],"wp:attachment":[{"href":"https:\/\/blog.chloesoe.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=675"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.chloesoe.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=675"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.chloesoe.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=675"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\/etc\/openvpn\/client\/make_config.sh<\/code> on the server, below the adjusted to the current ubuntu configuration with easy-rsa<\/p>\n#!\/bin\/bash\n\n# First argument: Client identifier\n\nOPENVPNDIR=\/etc\/openvpn\n\nKEY_DIR=$OPENVPNDIR\/easy-rsa\/pki\nOUTPUT_DIR=$OPENVPNDIR\/client\/files\nBASE_CONFIG=$OPENVPNDIR\/client\/base.conf\n\ncat ${BASE_CONFIG} \\\n <(echo -e '<ca>') \\\n ${KEY_DIR}\/ca.crt \\\n <(echo -e '<\/ca>\\n<cert>') \\\n ${KEY_DIR}\/issued\/${1}.crt \\\n <(echo -e '<\/cert>\\n<key>') \\\n ${KEY_DIR}\/private\/${1}.key \\\n <(echo -e '<\/key>\\n<tls-auth>') \\\n ${OPENVPNDIR}\/ta.key \\\n <(echo -e '<\/tls-auth>') \\\n > ${OUTPUT_DIR}\/${1}.ovpn<\/code><\/pre>\n\/etc\/openvpn\/client\/make_config.sh CLIENTNAME<\/code> and you get a ovpn file in \/etc\/openvpn\/client\/files\/<\/code><\/p>\nAdd iptable rules<\/h1>\n
sudo iptables -I DOCKER-USER -i ens3 ! -s 10.8.0.1\/24 -j DROP\nsudo iptables -I DOCKER-USER -i ens3 -m comment --comment "Accept all connections from VPN to Docker - Drop all other" ! -s 10.8.0.1\/24 -j DROP\nsudo iptables -I DOCKER-USER -i ens3 -p tcp --dport 80 -m comment --comment "Accept HTTP for letsencrypt" -j ACCEPT\n\n# block all IPv6 traffic except 80 for letsencrypt and 22 for ssh\nsudo ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT\nsudo ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT\nsudo ip6tables -A INPUT -j DROP\n<\/code><\/pre>\niptables-persistent<\/code> must be installed):<\/p>\niptables-save > \/etc\/iptables\/rules.v4\nip6tables-save > \/etc\/iptables\/rules.v6<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"