How to and Advice on Using VPN with Puppy Linux the first time

[number77]

Hello
I am about to try a VPN but before I do I could do with a bit of advise.
I am running xenial64 on a Dell Latitude E6230.
I watch Italian Free tv on Pale Moon. I now need a VPN as I get Geo-location blocked more and more.
If I sign up to a VPN provider and use (Gpptp VPN) what do I do next.
Help appreciated.
Thanks
number77

[snoring_cat]

Hi number77,

Most online security is moving away from username/password authentication in favor of file based authentication. To that end, many VPN providers allow you to download a file with "opvn" extension. Then it is as simple as opening a Terminal and typing something like the following

Code: Select all

openvpn my_filename.opvn

Do note that you might have to install openvpn from your package manager if it is not already installed. Also, we can help more, once we know which VPN provider you want to use.

[number77]

Hi number77,

Most online security is moving away from username/password authentication in favor of file based authentication. To that end, many VPN providers allow you to download a file with "opvn" extension. Then it is as simple as opening a Terminal and typing something like the following

Code: Select all

openvpn my_filename.opvn

Do note that you might have to install openvpn from your package manager if it is not already installed. Also, we can help more, once we know which VPN provider you want to use.

I haven't got a provider yet but been suggested a few.
Nordvpn, surfshark, expressvpn, cyberghost, ipvanish. I will enquire from them about downloading opvn file.

[number77]

Hi number77,

Most online security is moving away from username/password authentication in favor of file based authentication. To that end, many VPN providers allow you to download a file with "opvn" extension. Then it is as simple as opening a Terminal and typing something like the following

Code: Select all

openvpn my_filename.opvn

Do note that you might have to install openvpn from your package manager if it is not already installed. Also, we can help more, once we know which VPN provider you want to use.

I am signed up to surfshark. I am not very good on terminal and am a bit floundering.
Is there a gui for openvpn or something with a gui that I could try.

[snoring_cat]

VPN Providers and .OVPN files
NordVPN - https://support.nordvpn.com/General-inf ... -files.htm
surfshark - https://surfshark.com/blog/how-to-set-up-a-vpn-on-linux
expressvpn - https://www.expressvpn.com/support/vpn- ... x-openvpn/
cyberghost - https://support.cyberghostvpn.com/hc/en ... rk-Manager
ipvanish - https://support.ipvanish.com/hc/en-us/a ... mand-Line-
ProtonVPN - https://protonvpn.com/support/vpn-config-download/

Though I haven't used all of the above VPN providers, personally I like ProtonVPN because of their friendliness, features, connectivity, reputation, and corporate mission.

Configuration Steps
From form post

1. Verify OpenVPN is installed
   openvpn --version

2. If OpenVPN is not installed on your computer, you can install it via Puppy Package Manager

3. From your ProtonVPN account, download your .opvn file

4. Open the "Terminal" app and type the following (changing what is in bold)
   openvpn /root/path_to_file.ovpn

5. Put in your ProtonVPN credentials when prompted, like the following

Code: Select all

Enter Auth Username:
Enter Auth Password:

Messages will appear in Terminal, and you will be connected to the VPN. Leave Terminal running. When you are done using your ProtonVPN connection, type Ctrl-C in Terminal. Then you can close the Terminal window.

Puppy Linux GUI
If you want a GUI that uses your downloaded .ovpn files, you can use OscarTalks' vpn-onoff app via http://smokey01.com/OscarTalks
Just put your .opvn under /etc/vpn-onoff and link it to vpnconfig, like

Code: Select all

ln -s /etc/vpn-onoff/mysurfshark.ovpn /etc/vpnconfig

On a different note, please see this link for a Windscribe free VPN alternative.

[mikeslr]

Hi number77,

A while back, OscarTalks simplified using VPN on many Puppys, including Xenialpup64. Your question lead me to search for the work which had been published on the 'Old-Forum'. You'll find a quick link to that work here, viewtopic.php?p=44723#p44723

The old forum also had discussions on how to make use of VPN providers other than the free ones included in OscarTalks pets. But I discussed using ProtonVPN with OscarTalk's pet here, viewtopic.php?p=10864#p10864. That post was about Bionicpup64. But the steps I took should work under Xenialpup64 (indeed, any Puppy). Fortunately, as the links from that post no longer work, I distilled the instructions here, viewtopic.php?p=10891#p10891

[number77]

Code: Select all

ln -s /etc/vpn-onoff/mysurfshark.ovpn /etc/vpnconfig

On a different note, please see this link for a Windscribe free VPN alternative.
[/quote]
First problem is can't find out what version is installed
get error
openvpn version
openvpn: error while loading shared libraries: liblz4.so.1: cannot open shared object file: No such file or directory

And how do I enter an opvn file in vpn start

[mow9902]

You should have a look at myVPN and see if that will work for you. I have been using it for over a year with both bionic and fossapup.

viewtopic.php?p=43409#p43409

[snoring_cat]

First problem is can't find out what version is installed

openvpn: error while loading shared libraries: liblz4.so.1: cannot open shared object file: No such file or directory

And how do I enter an opvn file in vpn start

You can install liblz4 using Puppy Package Manager. In it, you should find liblz4-1_1.9.2, or similar number.

As for vpn_start, that app is a GUI to run the following command

Code: Select all

openvpn --daemon --config /etc/vpn-onoff/vpnconfig

You don't enter an .ovpn file directly into the vpn_start. vpn_start just tries to load the .ovpn file at /etc/vpn-onoff/vpnconfig. I mentioned to link to this file earlier. Maybe the following will be easier.

After you download your .ovpn file, rename it to "vpnconfig" and put it in /etc/vpn-onoff. Then you can run vpn_on, and later vpn_off

Here is a request from me
Let's say you downloaded an .ovpn file called my_file.ovpn and put it in /root. Can you first please try to run the following to troubleshoot

Code: Select all

openvpn --config /root/my_file.ovpn

Then you can validate that your openvpn connection is starting, if it is asking your for a username/password, etc.

[number77]

Code: Select all

openvpn --config /root/my_file.ovpn

Then you can validate that your openvpn connection is starting, if it is asking your for a username/password, etc.
[/quote]
First attempt not good, I will have more time to have another go later.

[OscarTalks]

Number77 and anyone else interested,
I have done a bit of work on the xenial64 version of my vpn-onoff package so you may wish to download and reinstall afresh:-
http://smokey01.com/OscarTalks/vpn-onof ... xenial.pet
The .ovpn files for the free providers in /etc/vpn-onoff should all be current now
The openssl libraries are updated to version 1.1.1m (released 14th December 2021)
OpenVPN is updated to version 2.4.11 (from 2.4.9)
Additional notes:-
The package contains its own openvpn so installing another is not required.
The included openvpn has liblz4 statically inked, so there should be no dependency on dynamic liblz4
After installing the .pet package, if you click Menu > Network > VPN-Start, it should connect to "cryptofree" free VPN (by cryptostorm.is) without needing any configuration at all.
This uses high-level sophisticated encryption, requiring openssl-1.1.1
Hence why it is included in the package, the openssl in xenial is too old for this.
Switching to the other free providers requites a bit of user configuration in /etc/vpn-onoff as described.
Using it with other providers requires a bit more adaptation but is often possible
Not sure if a server in Italy is needed for the purpose mentioned in the original post

[number77]

Hello Oscar Talks
I am working through vpn-onoff slowly.
I do want to get La7 in Italy but most programs are geo restricted so I need a vpn

PS
I do get VPN-Start going nicely but it thinks I am in France. How do I make it think I am in Italy.

[number77]

Eventually got so far
openvpn --config /root/my_file.ovpn
Sat Dec 18 18:08:55 2021 OpenVPN 2.4.11 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Dec 18 2021
Sat Dec 18 18:08:55 2021 library versions: OpenSSL 1.1.1m 14 Dec 2021, LZO 2.10
Enter Auth Username:BtZUGkAFQsGWp2X6C9vgxCJa
Enter Auth Password:
Sat Dec 18 18:10:18 2021 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Sat Dec 18 18:10:18 2021 NOTE: --fast-io is disabled since we are not using UDP
Sat Dec 18 18:10:18 2021 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sat Dec 18 18:10:18 2021 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sat Dec 18 18:10:18 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]185.217.71.51:1443
Sat Dec 18 18:10:18 2021 Socket Buffers: R=[87380->87380] S=[16384->16384]
Sat Dec 18 18:10:18 2021 Attempting to establish TCP connection with [AF_INET]185.217.71.51:1443 [nonblock]
Sat Dec 18 18:10:19 2021 TCP connection established with [AF_INET]185.217.71.51:1443
Sat Dec 18 18:10:19 2021 TCP_CLIENT link local: (not bound)
Sat Dec 18 18:10:19 2021 TCP_CLIENT link remote: [AF_INET]185.217.71.51:1443
Sat Dec 18 18:10:19 2021 TLS: Initial packet from [AF_INET]185.217.71.51:1443, sid=1da0d15d a35e6fed
Sat Dec 18 18:10:20 2021 VERIFY OK: depth=2, C=VG, O=Surfshark, CN=Surfshark Root CA
Sat Dec 18 18:10:20 2021 VERIFY OK: depth=1, C=VG, O=Surfshark, CN=Surfshark Intermediate CA
Sat Dec 18 18:10:20 2021 VERIFY KU OK
Sat Dec 18 18:10:20 2021 Validating certificate extended key usage
Sat Dec 18 18:10:20 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Dec 18 18:10:20 2021 VERIFY EKU OK
Sat Dec 18 18:10:20 2021 VERIFY OK: depth=0, CN=it-rom-v017.prod.surfshark.com
Sat Dec 18 18:10:20 2021 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1635', remote='link-mtu 1583'
Sat Dec 18 18:10:20 2021 WARNING: 'cipher' is used inconsistently, local='cipher AES-256-CBC', remote='cipher AES-256-GCM'
Sat Dec 18 18:10:20 2021 WARNING: 'auth' is used inconsistently, local='auth SHA512', remote='auth [null-digest]'
Sat Dec 18 18:10:20 2021 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Sat Dec 18 18:10:20 2021 [it-rom-v017.prod.surfshark.com] Peer Connection Initiated with [AF_INET]185.217.71.51:1443
Sat Dec 18 18:10:21 2021 SENT CONTROL [it-rom-v017.prod.surfshark.com]: 'PUSH_REQUEST' (status=1)
Sat Dec 18 18:10:22 2021 AUTH: Received control message: AUTH_FAILED
Sat Dec 18 18:10:22 2021 SIGTERM[soft,auth-failure] received, process exiting

What does it mean

[OscarTalks]

Number77,
Glad to hear that at least you were able to see that the vpn-onoff program does connect to the cryptofree VPN server on your system. This can be used for privacy, security, hiding your IP, unblocking of websites and things like that, but not for specific geo-locations on demand as far as I know. Unfortunately I am not aware of any of the free VPN providers that offer Italy as the server location. They tend to be rather limited in what they offer. Once you are willing to sign up and pay, as you have done with surfshark, they will give you much more choice. Now you have to get it going somehow.

The only thing I can suggest from the attempted connection output that you posted is that you could make a back-up copy of your .ovpn file and then try editing some of the lines as indicated by the WARNING messages, so for example change the link-mtu and cipher lines so they are the same as the "remote" ones. Seems strange that they would send you a .ovpn file with settings that are different from their server settings, but it does happen sometimes. Others may know more that me, but the bottom line seems to be that it is not authenticating for some reason.

[number77]

Number77,
Glad to hear that at least you were able to see that the vpn-onoff program does connect to the cryptofree VPN server on your system. This can be used for privacy, security, hiding your IP, unblocking of websites and things like that, but not for specific geo-locations on demand as far as I know. Unfortunately I am not aware of any of the free VPN providers that offer Italy as the server location. They tend to be rather limited in what they offer. Once you are willing to sign up and pay, as you have done with surfshark, they will give you much more choice. Now you have to get it going somehow.

The only thing I can suggest from the attempted connection output that you posted is that you could make a back-up copy of your .ovpn file and then try editing some of the lines as indicated by the WARNING messages, so for example change the link-mtu and cipher lines so they are the same as the "remote" ones. Seems strange that they would send you a .ovpn file with settings that are different from their server settings, but it does happen sometimes. Others may know more that me, but the bottom line seems to be that it is not authenticating for some reason.

How would I try just the surfshark ovpn file, nothing else.
What do I need to leave in ovpn-onoff, I may as well find if the have given me a bad ovpn file

[OscarTalks]

I would suggest leave the vpn-onoff program installed for now but leave it aside and focus on experimenting with editing the .ovpn file from surfshark. This is just a text file which feeds in all the configuration settings to the openvpn program when you do the test as described by snoring_cat (as you did before when you posted the output). Try editing the .ovpn file in geany (after making a backup copy) and then repeat the test to see if the connection to the surfshark server completes. We would need this to work first before attempting to use vpn-onoff to connect to surfshark.

The problem for me is that I can't do the experiments myself because I am not signed up to surfshark, so offering guidance becomes very difficult. If you speak to their customer support and explain that you are trying to connect via command line in linux using their .ovpn file with openvpn. They may be able to help or point out some step that needs to be done which you have missed. I took a glance at their website and they do offer a kind of terminal program for connection to their servers, but even that requires a subscription to install, so not sure if it would run in xenial64, but maybe it would.

[snoring_cat]

number77,

From your openvpn output, please note the bold and colored

openvpn --config /root/my_file.ovpn
Sat Dec 18 18:08:55 2021 OpenVPN 2.4.11 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Dec 18 2021
Sat Dec 18 18:08:55 2021 library versions: OpenSSL 1.1.1m 14 Dec 2021, LZO 2.10
Enter Auth Username: BtZUGkAFQsGWp2X6C9vgxCJa
Enter Auth Password:
...
Sat Dec 18 18:10:22 2021 AUTH: Received control message: AUTH_FAILED
Sat Dec 18 18:10:22 2021 SIGTERM[soft,auth-failure] received, process exiting

I think your problem is as simple as needing to put in your SurfShark "service credentials" username and password when using your .opvn file. These differ from your login to SurfShark usename and password. Please verify that you are using them with openvpn. The problem I see is that there are no asterisks showing you entered a password on the "Enter Auth Password" line. Please refer to the following:

I found SurfShark's steps for configuring OpenVPN at
SurfShark OpenVPN connecting

The key data on this page is that it tells you where to navigate on SurfShark's website to find your "service credentials".

If after re-running "openvpn --config /root/my_file.ovpn" with these credentials you still have problems, then there are other possible solutions. For example

• You may need to open port 1194 with UDP in your firewall and router (doubtful this is the problem)

• You may need to use IKEv2 encryption (doubtful, since your .opvn file comes from SurfShark with the correct encryption already set)

• Your CA certificates aren't available (doubtful, since they should be copied into your .ovpn file by SurfShark automatically)

• When downloading your .ovpn file, is there big red writing saying that openvpn connections have different credentials? If so, SurfShark should give you instructions for setting up openvpn connections. If not during downloading the .ovpn file, you can use SurfShark's customer support.

I think we are getting close to a solution. Once you can connect via openVPN manually, we might put your service credentials in your .ovpn file to automate logging in without typing your username and password. This will make OscarTalk's vpn_start script work. The line that might have to go into your .ovpn file are

Code: Select all

OPENVPN_USERNAME=xxxxxxxxxxxx
OPENVPN_PASSWORD=xxxxxxx

[number77]

number77,

From your openvpn output, please note the bold and colored

openvpn --config /root/my_file.ovpn

snoring_cat you are right I did not put in user or password in vpn-onoff. I also did not link my file, so another probable cause.
In the meantime I have removed and reinstalled both openvpn and vpn-onoff.
Starting from square one unless you have any different advise.

[number77]

number77,

From your openvpn output, please note the bold and colored

openvpn --config /root/my_file.ovpn

snoring_cat you are right I did not put in user or password in vpn-onoff. I also did not link my file, so another probable cause.
In the meantime I have removed and reinstalled both openvpn and vpn-onoff.
I cant now stop openvpn and get error message when starting vpn-start saying openvpn already running. I can try to run vpn-stop but that wont stop it

[bigpup]

This seemed to me to be a good how to about setting up and using VPN in Puppy Linux.
So, I moved it to the how to section of the forum.

Please continue providing info to help number77.
I am sure it will be very helpful to everyone.

[number77]

This seemed to me to be a good how to about setting up and using VPN in Puppy Linux.
So, I moved it to the how to section of the forum.

Please continue providing info to help number77.
I am sure it will be very helpful to everyone.

Hello bigpup
Could you put my post back in Beginners Help section.
Thanks
Its not anywhere finished and I still cannot connect.
Thanks again

[OscarTalks]

Number77,
If you have vpn-onoff installed, it already contains a very good version of openvpn, so openvpn is already installed in your system. You do NOT need to install another version of openvpn from PPM or anywhere else, in fact doing so may confuse the issue and introduce problems.

Once installed, vpn-onoff can be used as originally intended, to connect to those free VPN's, or you can make use of its included openvpn executable for running or testing from command line as described by snoring_cat, or it serves as the openvpn if required by something like the surfshark linux client for example.

[number77]

Number77,
If you have vpn-onoff installed, it already contains a very good version of openvpn, so openvpn is already installed in your system. You do NOT need to install another version of openvpn from PPM or anywhere else, in fact doing so may confuse the issue and introduce problems.

Once installed, vpn-onoff can be used as originally intended, to connect to those free VPN's, or you can make use of its included openvpn executable for running or testing from command line as described by snoring_cat, or it serves as the openvpn if required by something like the surfshark linux client for example.

Thanks OscarTalks I will remove everything and start again

[number77]

Number77,
If you have vpn-onoff installed, it already contains a very good version of openvpn, so openvpn is already installed in your system. You do NOT need to install another version of openvpn from PPM or anywhere else, in fact doing so may confuse the issue and introduce problems.

Once installed, vpn-onoff can be used as originally intended, to connect to those free VPN's, or you can make use of its included openvpn executable for running or testing from command line as described by snoring_cat, or it serves as the openvpn if required by something like the surfshark linux client for example.

Got a slight problem, I removed openvpn and vpn-startstop, reinstalled vpn-startstop. Put in ovpm from surfshark, deleted old config file and linked ovpm file to new vpnconfig.
Put in username and password from account in vpnpass .
Menu, Network, VPN-start and it didn't give the message network info. If I stop then start again it says openvpn already running.
Any ideas.

[OscarTalks]

If you have openvpn running because you are trying to start it via vpn-onoff then Menu > Network > VPN-Stop should shut down the openvpn process. Otherwise open a terminal and enter killall openvpn. Repeat this command until it returns "No process killed".
Really though you need to confirm that the .ovpn file (plus any name and password you are entering) is establishing a connection when you do the manual test as described by snoring_cat. Only then should you try to insert it into vpn-onoff.

[number77]

number77,

From your openvpn output, please note the bold and colored

openvpn --config /root/my_file.ovpn

Hello again snoring_cat

What password and username do I have to enter in openvpn if they are different to login details for surfshark
You said
(I think your problem is as simple as needing to put in your SurfShark "service credentials" username and password when using your .opvn file. These differ from your login to SurfShark usename and password. Please verify that you are using them with openvpn. The problem I see is that there are no asterisks showing you entered a password on the "Enter Auth Password" line. Please refer to the following):

[snoring_cat]

number77,

Let's say you are logging into SurfShark's web interface with

Code: Select all

username: number77
password: mystrongpassword

After you login with those, you then can navigate on the website to find your "service credentials" username and password. Those should loook like

Code: Select all

username: 132JJNASLJDFHNIHUASJHNKHI9
password: JHAKLSDNHFQWEH89H38AJSD

That username and password was created for you by SurfShark. That is the username and password that OpenVPN needs. (Please refer to the second screenshot at this post for a reference of what the "service credentials" webpage looks like.)

Let's pretend that your "service credentials' username and password above is what you obtained from SurfShark's website. You would type the following bold entries

openvpn --config /root/my_file.ovpn
Sat Dec 18 18:08:55 2021 OpenVPN 2.4.11 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Dec 18 2021
Sat Dec 18 18:08:55 2021 library versions: OpenSSL 1.1.1m 14 Dec 2021, LZO 2.10
Enter Auth Username: 132JJNASLJDFHNIHUASJHNKHI9
Enter Auth Password: JHAKLSDNHFQWEH89H38AJSD
...
Initialization Sequence Completed

The last line is telling you that your VPN connection is working and active.

[number77]

number77,

Let's say you are logging into SurfShark's web interface with

Code: Select all

username: number77
password: mystrongpassword

After you login with those, you then can navigate on the website to find your "service credentials" username and password. Those should loook like

Code: Select all

username: 132JJNASLJDFHNIHUASJHNKHI9
password: JHAKLSDNHFQWEH89H38AJSD

That username and password was created for you by SurfShark. That is the username and password that OpenVPN needs. (Please refer to the second screenshot at this post for a reference of what the "service credentials" webpage looks like.)

Let's pretend that your "service credentials' username and password above is what you obtained from SurfShark's website. You would type the following bold entries

openvpn --config /root/my_file.ovpn
Sat Dec 18 18:08:55 2021 OpenVPN 2.4.11 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Dec 18 2021
Sat Dec 18 18:08:55 2021 library versions: OpenSSL 1.1.1m 14 Dec 2021, LZO 2.10
Enter Auth Username: 132JJNASLJDFHNIHUASJHNKHI9
Enter Auth Password: JHAKLSDNHFQWEH89H38AJSD
...
Initialization Sequence Completed

The last line is telling you that your VPN connection is working and active.

Thanks snoring_cat that does explain nicely.

I still am getting the error at the end of putting in
openvpn --config /root/my_file.ovpn

Mon Dec 20 18:59:54 2021 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Dec 20 18:59:54 2021 ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
Mon Dec 20 18:59:54 2021 Exiting due to fatal error

[OscarTalks]

Try opening a terminal and enter modprobe tun
This should load the tun kernel module
Then try the openvpn --config /root/my_file.ovpn test command again

[number77]

Try opening a terminal and enter modprobe tun
This should load the tun kernel module
Then try the openvpn --config /root/my_file.ovpn test command again

Exactly, worked straight away, thanks.

Now I need to find how get geo-located as still blocked from Italian TV