How to make my home network access the internet via VPN? reddit / selfhosted ---------------------------------------------------------------------- dnt_pnc · 2023-11-14 11:55 Hi and thanks for your help. I have a pretty besic router, so I can not install a VPN on the router itself. I have a docker instance, that is running PiHole. The PiHole is configure as the networks DNS, while the router does DHCP. Now instead of installing a VPN client on every of my devices I thought of deploying a VPN client on that docker instance and route all external traffic through the VPN like this: Client -> DNS -> VPN -> Router -> Internet Is that even possible from a technical point? What do I need? ---------------------------------------------------------------------- EspritFort · 2023-11-14 12:03 >Hi and thanks for your help. >I have a pretty besic router, so I can not install a VPN on the router itself. >I have a docker instance, that is running PiHole. The PiHole is configure as the networks DNS, while the router does DHCP. >Now instead of installing a VPN client on every of my devices I thought of deploying a VPN client on that docker instance and route all external traffic through the VPN like this: Client -> DNS -> VPN -> Router -> Internet >Is that even possible from a technical point? What do I need? Apologies, but could you take a step back first and elaborate on what you're trying to achieve here? This is not a scenario I've ever encountered - that or I misunderstand you. To me the "Client -> DNS -> VPN -> Router -> Internet"- part sounds like you wish to connect devices within your home network to a VPN server within your home network. What is the point of this? Is part of your home network... hostile? Usually you'd use a VPN to remotely connect **to** your home network. ---------------------------------------------------------------------- Profa_Neo · 2023-11-14 12:12 i think OP wants to use VPN for all traffic from his home network. Im interested in this as well if it can be done X ---------------------------------------------------------------------- dnt_pnc · 2023-11-14 12:26 What I want to achieve: Instead of running a VPN client on each of my devices (PC, notebooks, phones etc.), I thought of having a VPN client on my docker instance that all devices are forced to use if they wish to comminicate outside of the home network. VPN in this case is to be used for privacy reasons to disguise my IP to the outside world. ---------------------------------------------------------------------- Deathmeter · 2023-11-14 12:36 Not offering the perfect solution you were looking for, but if you're still using the ISP router it might be worth it to upgrade that to something you can install custom firmware on that's also relatively cheap like an asuswrt-merlin compatible device (I personally use an ASUS RT-AX86S). That would allow you to have a guest wifi using [YazFi](https://github.com/jackyaz/YazFi) that routes everything through a VPN of your choice and it would leave your regular wifi untouched. You can even use the DNS director to intercept all traffic on port 53 and reroute it to your pihole, including queries going out to [1.1.1.1](https://1.1.1.1) or other public DNS servers from apps trying to circumvent DNS blocks. ---------------------------------------------------------------------- dnt_pnc · 2023-11-14 12:43 If I was to buy a new router, I'd buy something compatible with openwrt and install a openvpn client on that one. But I was wondering, if there was a way around that with my current hardware. ---------------------------------------------------------------------- Deathmeter · 2023-11-14 12:44 That's fair. I'd imagine it's not possible but curious to see if you get an answer for it ---------------------------------------------------------------------- Profa_Neo · 2023-11-14 13:13 well, i've asked ChatGPT he gave out some pretty reasonable solution to try - dont want to paste false info but its worth checking out for yourself OP> ---------------------------------------------------------------------- EspritFort · 2023-11-14 13:39 > What I want to achieve: Instead of running a VPN client on each of my devices (PC, notebooks, phones etc.), I thought of having a VPN client on my docker instance that all devices are forced to use if they wish to comminicate outside of the home network. VPN in this case is to be used for privacy reasons to disguise my IP to the outside world. Ah, I see, then I misunderstood. While I generally have some choice words against "using" remote VPN servers for privacy (tldr: The goggles, they do nothing! Nobody cares about your IP when dozens of other data points can be used for fingerprinting) that's neither here or there. What you want can be done but not quite the way you imagine, I think. The general idea would be to put another router B between your current one A and use NAT, i.e. create a different LAN within your current LAN environment. B would be to A what A is to your ISP. B - unlike A - would be running some kind of router or firewall OS like OpenSense or OpenWRT. B *could* run virtualized (not dockerized though, at least not to my knowledge, maybe somebody smarter has a suggestion) but the hypervisor would either need some special hardware (multiple network interfaces - at least 2 total - for LAN and WAN) or you would have to juggle around some VLANs. Which kind of brings me to a conclusion: Is there no way you could just replace your existing router A with one that allows you to run a VPN client natively? That would really be a lot simpler! ---------------------------------------------------------------------- Carbine987 · 2023-11-14 13:42 Not simple, but can be done.. What I've done is: Purchased a VPN provider account. Set up a Raspberry Pi INSIDE my local network as a VPN router. (For best throughput, you'll want a 2nd network interface, so I purchased a usb network dongle) Configured the Pi to connect to the VPN provider (basically a tunnel through your router). Configured the Pi to forward traffic - Anything that comes in from the LAN interface gets forwarded to the VPN interface. When I want to use the VPN, I just change my PC's default gateway to point at the Rasp Pi. When I don't need it, I point my PC's default gateway to the ISP router. Done... (took me FOREVER to get wireguard working, but it's workin fine now !) ---------------------------------------------------------------------- dnt_pnc · 2023-11-14 13:58 Yeah, sounds like I need additional hardware with both options. Then I'd prefer to get a OpenWRT router and install OpenVPN on that device. ---------------------------------------------------------------------- notta_Lamed_Wufnik · 2023-11-14 14:35 Could you get a different router as others have said? It would certainly give you more options. I use a ubiquiti edgerouter lite and use either wireguard or the built in l2pp vpn, both on the router itself. ---------------------------------------------------------------------- dnt_pnc · 2023-11-14 14:41 I could, but I was looking for options without additional hardware. I only run a mini PC as my server. A new router would probably double my setup cost. ---------------------------------------------------------------------- arcadianarcadian · 2023-11-14 14:58 Yes, you can. Many company networks work in that way. In the company network, admins route all the client traffic to their firewall or web gateway to intercept or deny/allow client requests. ​ You must add a routing rule on your router to route all client traffic to your VPN instance. I prefer a separate VPN machine or instance instead of docker instance. Client -> DNS -> Router -> VPN -> Router -> Internet ---------------------------------------------------------------------- SomeOddCodeGuy · 2023-11-14 15:00 I essentially do this, though maybe not as complex as what you are looking for, with an ASUS router. I have NordVPN and some ASUS routers come with openvpn client installed out of the box; no custom firmware flash installed. I just generate a service token on the Nord website (it gives instructions on there), do a little configuring on the router based on their tutorials and boom- done. Now every device that connects to the net via that router is automatically on the VPN. ---------------------------------------------------------------------- bucksnort2 · 2023-11-14 15:06 If only you or up to five people need access to your network remotely, you can look at Twingate. I’ve been using it for over a year now, and it’s great. I have two agents deployed on two different machines (in case one machine goes down, for redundancy) and can access my whole network. I can specify groups of people, so if my wife wanted access to our NAS but didn’t care about anything else, I can give her access to just that one IP address. I can also limit it to certain ports: I have a Jellyfin server running on the same host as other things, but only want others to access Jellyfin, I give them access to port 8096. They can’t access anything else. You can deploy agents in Docker, on Linux, in the cloud, or many other places. On the device you wish to use to access your network, you install the Twingate client. It’s available on Windows, MacOS, Linux, Android, and iOS. ---------------------------------------------------------------------- damn_the_bad_luck · 2023-11-14 18:56 Sure it's possible, people do it all the time. The best solution is also the hardest. Grab a minipc with at least 2 gigabit ethernet ports, and install some firewall software on it. Most people use opn/pfsense, but that is based on bsd which isn't optimized to run on multicore cpu's like linux. There are various linux based distro's out there, some harder to learn than others, openwrt and vyos are both excellent, and outperform pfsense easily. For seasoned veterans, it's actually not that hard to grab a stable linux like debian stable, and just build your own router. Configure each interface, add nftables or iptables for firewall, add the wireguard vpn client, and bam! you have a very high performance router, that can handle wireguard vpn for your entire network at gigabit speeds. I'm hesitant to mention I've been updating my howto for building home linux routers, because life keeps getting in the way, and it's not done yet. Works for me, been doing it many years, but writing decent docs takes a long time. You mentioned running pihole in a docker container. You can run wireguard in another docker container, and have your network use that as the default router. That would do what you want, and give good performance. Requires reading more man pages and learning, but lots of people do that too. Plenty of options. All require various technical skill, learning and effort. Take your pick. ---------------------------------------------------------------------- MonkeyBoy4 · 2023-11-15 15:23 I use Tailscale setup in a virtual machine for remote access to my LAN. They have really good documentation on their website for subnet routers. ---------------------------------------------------------------------- Dalearnhardtseatbelt · 2023-11-17 06:46 Spin up tailscale on whatever is hosting your pihole instance ---------------------------------------------------------------------- Dalearnhardtseatbelt · 2023-11-17 06:52 I initially said the same thing but realized he wanted to send all his Internet traffic out of his network via a VPN. Not *access* his Internet from a VPN.