Pi Zero W Wifi repeater with OpenVPN

Question

Im trying to setup a Pi Zero W as a wifi repeater with openVPN without using a USB wifi dongle, as a tiny travel router.

I tried using this tutorial - by @ingo raspberry-pi-zero-w-as-a-wifi-repeater as a starting point, i can connect to the AP created and ping the pi but could not get any internet connection on the AP (with everything exactly as per the tutorial - except IP of the router, and without static routes in router as i dont have access).

I have also managed to get openVPN setup and working on the pi but still cant access from the AP.

               wifi             Rpi             wifi              wan
mobile-phone <.~.~.~.~.> (ap0) (tun0) (wlan0) <.~.~.~.~.> router <-----> INTERNET
        \               /                \                  /
       (dhcp)   192.168.50.1           192.168.1.2    192.168.1.1

I Also need to be able to access via ssh on ap0 to change wifi SSID/Passphrase for the wlan0 interface, as it will change weekly and i also have no access for forwarding/routing in the router its connected to. i would like to block ssh coming from the tunnel side, but allow on both wlan0 and ap0

I dont need to access any other devices on the network, all traffic besides ssh can go through the tunnel. it would be nice to have a failover option if the openVPN cant connect just in case (possibly with a way to quickly enable/disable the failover)

Im sure its something simple I'm missing. Any suggestions on how to setup routing to achieve this?

Answer 1

I have made some router with VPN and you may get some ideas from How To Create A Private Subnet Behind Raspberry Pi? and from Raspberry pi as access point with vpn. But your wifi repeater does not work so I suggest to make it first running without fiddling with a VPN tunnel. If it works as expected then you should add the VPN tunnel. You also want to have special access conditions and a failover and no, there is nothing simple you missed ;-)

So lets start to improve this answer interactively in this steps:

1. make access point running incl. ssh
2. add VPN tunnel
3. configure restrictions
4. lets talk about failover

As far as I understand you can connect to the access point (AP) and you can connect another station also connected to the AP but you cannot get into the internet and you cannot ssh into the RasPi. Check if ip forwarding is active and the default route is set to the internet router:

rpi ~$ cat /proc/sys/net/ipv4/ip_forward   # should give 1
1

rpi ~$ ip route show
default via 192.168.1.1 dev wlan0 proto static
192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.2
192.168.50.0/24 dev ap0 proto kernel scope link src 192.168.50.1

The line with default must point to the internet router and the device must be wlan0.

Then NAT (network address translation) must be enabled. Check with:

rpi ~$ sudo iptables --table nat --list POSTROUTING --verbose
Chain POSTROUTING (policy ACCEPT 5 packets, 355 bytes)
 pkts bytes target     prot opt in     out     source      destination
   13   974 MASQUERADE  all  --  any    wlan0   anywhere    anywhere

For ssh you should enable and start the service on the RasPi with:

rpi ~$ sudo systemctl enable ssh.service --now

and then from a linux computer try to connect with verbose messages and look what's going wrong:

station ~$ ssh -v pi@192.168.50.1

Belonging to name resolution you should first make it run only with ip addresses. If you are sure that DNS server can be addressed by ip address you can look what's wrong with DNS. Systemd-networkd presents default DNS server anywhere in the internet to the clients so you should be able to resolve internet names like google.com. If internet connection is broken then default DNS is also not working. If you use names in your local network managed by your own DNS server you can configure systemd-netword to present this server to its clients.

Check if you have enabled systemd name resolving with:

rpi ~$ sudo systemctl enable systemd-resolved.service
rpi ~$ sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

With cat /etc/resolv.conf systemd-networkd shows its default DNS server if you don't have configure some:

nameserver 8.8.8.8
nameserver 8.8.4.4
nameserver 2001:4860:4860::8888
# Too many DNS servers configured, the following entries may be ignored.
nameserver 2001:4860:4860::8844

For example with systemd-networkd on configuration for wlan0 you can define your own DNS server 192.168.10.10 for the RasPi itself with:

[Match]
Name=wlan0
[Network]
Address=192.168.10.2/24
Gateway=192.168.10.1
DNS=192.168.10.10 8.8.8.8

To give your own DNS server to the stations associated to the access point, set it on the configuration for ap0 with:

[Match]
Name=ap0
[Network]
Address=192.168.50.1/24
IPForward=yes
DHCPServer=yes
[DHCPServer]
DNS=192.168.10.10 8.8.8.8