Puppy Linux Discussion Forum

Use Openvpn to connect through Proton Vpn servers
Credit for researching and testing this method belongs to @rockedge

This was tested on BookwormPup64 10.0.8

-install openvpn using Synaptic
-open Proton VPN site in your browser
-create a free account
-sign in to Proton VPN

-click: Account in the left panel
-scroll down to: OpenVPN / IKEv2 username
-copy the OpenVPN / IKEv2 username and OenVPN / IKEv2 password
These are the username and password you will use to connect to the VPN servers.

-click: Downloads in the left panel
-scroll down to: OpenVPN configuration files
-choose: GNU/Linux

-scroll down to: 3. Select config file and download
-click the download button for the server file you want

In this example we choose: US-FREE#397035 which downloads the file: us-free-397035.protonvpn.udp.ovpn

-use Rox to navigate to the directory containing the configuration file
-press the F4 key to open a terminal

This is the code to type for the example configuration file us-free-397035.protonvpn.udp.ovpn

openvpn --config us-free-397035.protonvpn.udp.ovpn

-press enter
-when prompted, enter your username and password
NOTE: when typing or pasting your password, it will not echo in the terminal screen. Also, pasting is done using: ctrl + alt + v

To disconnect:
-click in the terminal window
-press: ctrl + c

You can check your connection by opening:
https://www.whatismyip.com/

Bonus-Easier Method

On newer Puppys, install vpn-connect.pet

This will add vpn-connect.sh to the Rox right click menu. Then try this:
-use Rox to navigate to the directory containing the configuration file
-right click the configuration file
-choose: Open With>vpn-connect.sh
-when prompted, enter your username and password

To disconnect:
-click in the terminal window
-press: ctrl + c

This makes using multiple configuration files easier.

wizard

UPDATE 241110 See BONUS METHOD 2 in the 4th reply

Fossapup64-95 ................ newer builds of OpenVPN require OpenSSL 3.x libraries

This is very good. See below.

wizard wrote: ↑Sat Nov 09, 2024 9:38 pm

Use Openvpn to connect through Proton Vpn servers
Credit for researching and testing this method belongs to @rockedge

This was tested on BookwormPup64 10.0.8

-install openvpn using Synaptic
-open Proton VPN site in your browser
-create a free account
-sign in to Proton VPN

-click: Account in the left panel
-scroll down to: OpenVPN / IKEv2 username
-copy the OpenVPN / IKEv2 username and OenVPN / IKEv2 password
These are the username and password you will use to connect to the VPN servers.
user-pw.jpg

-click: Downloads in the left panel
-scroll down to: OpenVPN configuration files
-choose: GNU/Linux
config.jpg
-scroll down to: 3. Select config file and download
-click the download button for the server file you want

In this example we choose: US-FREE#397035 which downloads the file: us-free-397035.protonvpn.udp.ovpn

-use Rox to navigate to the directory containing the configuration file
-press the F4 key to open a terminal

This is the code to type for the example configuration file us-free-397035.protonvpn.udp.ovpn

Code: Select all

openvpn --config us-free-397035.protonvpn.udp.ovpn

-press enter
-when prompted, enter your username and password

To disconnect:
-click in the terminal window
-press: ctrl + c

You can check your connection by opening:
https://www.whatismyip.com/

Bonus-Easier Method

On newer Puppys, install vpn-connect.pet

This will add vpn-connect.sh to the Rox right click menu. Then try this:
-use Rox to navigate to the directory containing the configuration file
-right click the configuration file
-choose: Open With>vpn-connect.sh
-when prompted, enter your username and password

To disconnect:
-click in the terminal window
-press: ctrl + c

This makes using multiple configuration files easier.

wizard

Great instructions, however, it took me a looooooong time of struggling with these because the programmer that wrote the code for these programs made a mistake (not a bug), see further below.
With the first method, I got to this screen in terminal (pw x'ed out):

# openvpn --config us-free-293035.protonvpn.udp.ovpn
2024-11-10 09:31:46 OpenVPN 2.6.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2024-11-10 09:31:46 library versions: OpenSSL 3.0.11 19 Sep 2023, LZO 2.10
2024-11-10 09:31:46 DCO version: N/A
Enter Auth Username:xxxxxxxxxxxxxxxxxxxxxxxx
Enter Auth Password:

With the second method, I got the same:

2024-11-10 10:11:46 OpenVPN 2.6.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2024-11-10 10:11:46 library versions: OpenSSL 3.0.11 19 Sep 2023, LZO 2.10
2024-11-10 10:11:46 DCO version: N/A
Enter Auth Username:xxxxxxxxxxxxxxxxxxxxxxxx
Enter Auth Password:

The problem with both is I was apparently unable to type/paste anything.
When I press [Enter] anyway, I got this:

# openvpn --config us-free-293035.protonvpn.udp.ovpn
2024-11-10 09:31:46 OpenVPN 2.6.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2024-11-10 09:31:46 library versions: OpenSSL 3.0.11 19 Sep 2023, LZO 2.10
2024-11-10 09:31:46 DCO version: N/A
Enter Auth Username:xxxxxxxxxxxxxxxxxxxxxxxx
Enter Auth Password:
2024-11-10 10:14:59 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-11-10 10:14:59 TCP/UDP: Preserving recently used remote address: [AF_INET]149.102.254.91:51820
2024-11-10 10:14:59 UDPv4 link local: (not bound)
2024-11-10 10:14:59 UDPv4 link remote: [AF_INET]149.102.254.91:51820
2024-11-10 10:15:00 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2024-11-10 10:15:00 [node-us-281.protonvpn.net] Peer Connection Initiated with [AF_INET]149.102.254.91:51820
2024-11-10 10:15:07 AUTH: Received control message: AUTH_FAILED
2024-11-10 10:15:07 SIGTERM[soft,auth-failure] received, process exiting
# 

I presume the 'auth-nocache' option be used, like this?
openvpn --config us-free-293035.protonvpn.udp.ovpn --auth-nocache

I then discovered that both methods worked! event though I was unable to paste or type anything in the PW field, so I guess it must have been pasted invisibly!?

2024-11-10 10:20:43 OpenVPN 2.6.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2024-11-10 10:20:43 library versions: OpenSSL 3.0.11 19 Sep 2023, LZO 2.10
2024-11-10 10:20:43 DCO version: N/A
Enter Auth Username:xxxxxxxxxxxxxxxxxxxxxxxx
Enter Auth Password:
2024-11-10 10:20:57 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-11-10 10:20:57 TCP/UDP: Preserving recently used remote address: [AF_INET]149.102.254.91:80
2024-11-10 10:20:57 UDPv4 link l ocal: (not bound)
2024-11-10 10:20:57 UDPv4 link remote: [AF_INET]149.102.254.91:80
2024-11-10 10:20:57 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2024-11-10 10:20:58 [node-us-281.protonvpn.net] Peer Connection Initiated with [AF_INET]149.102.254.91:80
2024-11-10 10:20:59 NOTE: setsockopt TCP_NODELAY=1 failed
2024-11-10 10:20:59 TUN/TAP device tun0 opened
2024-11-10 10:20:59 net_iface_mtu_set: mtu 1500 for tun0
2024-11-10 10:20:59 net_iface_up: set tun0 up
2024-11-10 10:20:59 net_addr_v4_add: 10.96.0.35/16 dev tun0
2024-11-10 10:20:59 /etc/openvpn/update-resolv-conf tun0 1500 0 10.96.0.35 255.255.0.0 init
2024-11-10 10:20:59 Initialization Sequence Completed

The programmer's error is that there is no indication that the PW was pasted in, or information telling the user that no indication of the pasted PW would be given.
Both methods are working for me now. Thanks! @rockedge
Caveat: I noticed that my public IPv6 address was still listed at https://www.whatismyip.com/ even though my public IPv4 address was not listed. Thoughts?

You could use this

openvpn --auth-nocache --config <filename>

BONUS METHOD 2

Download the Proton VPN server configuration files as in first message.

Download VPN2.tar.gz into the directory with your configuration files and unpack (extract) it.
You will have these four files:
login.conf
readme.txt
userpw.txt
VPN-CONNECT2.sh

Open login.conf in Geany
-enter your username on the first line
-enter your password on the second line
-save the file

To Connect:
Using Rox, just drag and drop a .ovpn configuration file onto VPN-CONNECT2.sh

Openvpn will execute in a terminal window and your username and password will automatically be entered.

To disconnect:
-click in the terminal window
-press: ctrl + c

UPDATE 111112
VPN2a.tar.gz, now has code to stop any existing openvpn session before starting a new session.

wizard

wizard wrote: ↑Sun Nov 10, 2024 3:28 pm

BONUS METHOD 2

Download the Proton VPN server configuration files as in first message.

Download VPN2.tar.gz into the directory with your configuration files and unpack (extract) it.
You will have these four files:
login.conf
readme.txt
userpw.txt
VPN-CONNECT2.sh
VPN2.tar.gz
Open login.conf in Geany
-enter your username on the first line
-enter your password on the second line
-save the file

To Connect:
Using Rox, just drag and drop a .ovpn configuration file onto VPN-CONNECT2.sh

Openvpn will execute in a terminal window and your username and password will automatically be entered.

To disconnect:
-click in the terminal window
-press: ctrl + c

wizard

I placed my login and pw in the login.conf file as the first 2 lines..
Unfortunately, it isn't working. When I drag the configuration file, 'us-free-293035.protonvpn.udp.ovpn', and drop it onto 'VPN-CONNECT2.sh', there is a brief flash of a terminal window, but nothing seems to happen, and my IP address is unchanged. Did I do something wrong?

@Governor

Right click on VPN-CONNECT2.sh
-choose: Permissions
-set as: a+x (Make executable/searchable)

Make sure that these files are in the same directory as your configuration files:
login.conf
readme.txt
userpw.txt
VPN-CONNECT2.sh

wizard

@wizard

Looking at the *.ovpn files there is a comment which might be of interest

# The server you are connecting to is using a circuit in order to separate entry IP from exit IP
# The same entry IP allows to connect to multiple exit IPs in the same data center.

# If you want to explicitly select the exit IP corresponding to server US-FREE#23 you need to
# append a special suffix to your OpenVPN username.
# Please use "<USERNAME>+b:0" in order to enforce exiting through US-FREE#23.

In this example I have removed the <USERNAME>

All of these files have the same <USERNAME>+b:0 followed by the server name

I think it would be useful to have a script that would allow you to randomly choose a *.ovpn configuration file upon execution.

I might be wrong ..... but I am guessing that most users would simply downloading the first file in the chosen location list or whichever one at that time appeared to have the least percentage of use.

This would vary from day,hour,minute .............. therefore why stick to the first one that you downloaded ?

@Jasper

therefore why stick to the first one that you downloaded ?

Yes, you can download as many .ovpn configuration files as you want. Both vnc-connect.sh and VNC-CONNET2.sh just make it easier to execute openvpn than if you manually type/paste it in from the cli.

Thanks
wizard

@wizard

I've customized the Rox-filer right click menu by adding a symlink here -> root/.config/rox.sourceforge.net/SendTo/.text_plain/VPN-CONNECT2.sh

which is renamed to VPNCONNECT2 and also dragged VPN-CONNECT2.sh to the desktop pinboard, renamed to vpnconnect for a better manageable size and assigned an icon.

So it is possible to drag protonvpn config files from a Rox-filer window drop on the desktop icon!

@rockedge

I've customized the Rox-filer right click menu by adding a symlink here -> root/.config/rox.sourceforge.net/SendTo/.text_plain/VPN-CONNECT2.sh

which is renamed to VPNCONNECT2 and also dragged VPN-CONNECT2.sh to the desktop pinboard, renamed to vpnconnect for a better manageable size and assigned an icon.

So it is possible to drag protonvpn config files from a Rox-filer window drop on the desktop icon!

You can rename VPN-CONNECT2.sh to anything you like, no problem. If you look at the code you'll see it finds the directory where VPN-CONNECT2.sh is being executed and CD's (changes) to that directory. It then takes the original .ovpn file, adds the username/password code and creates the myserver.ovpn file. Last it executes openvpn using myserver.ovpn.

As written, it depends on the original .opvn files and the four files from VPN2.tar.gz being in the same directory and VPN-CONNECT2.sh being executed from there (this setup lets a user put the files almost anywhere).

Not sure about the behavior of your symlinks, the question is, will the code find the parent directory or will it find the directory containing the symlink, in which case it will fail.

Give both a try and see what happens, shouldn't hurt anything, but might write a bad myserver.ovpn file in the wrong place.

If it fails, the code could be re-written to give absolute paths and then it would work. Also, might be able to get the parent path from the symlink and use that.

Let me know how it turns out.

Thanks
wizard

@wizard
This is the setup as described:

@rockedge

Well how about that, did you have to mod VPN-CONNECT.sh or is it OOTB?

Thanks
wizard

@wizard
I followed the directions you listed and then from the location I set up, dragged and dropped to the Rox pinboard desktop:

There are no modifications to the script.

wizard wrote: ↑Sun Nov 10, 2024 6:04 pm

@Governor

Right click on VPN-CONNECT2.sh
-choose: Permissions
-set as: a+x (Make executable/searchable)

Make sure that these files are in the same directory as your configuration files:
login.conf
readme.txt
userpw.txt
VPN-CONNECT2.sh

wizard

It is working now. Thanks! But... my public IPv6 is showing no matter which of the methods I use.
Can I hide IPv6 too, or do I have to disable IPv6?

@wizard

Looking at your script VPN-Connect2

Are you simply adding/merging the login details provided to the *.ovpn file?

The reason why I am asking is that I wanted to use a different approach using a random server

#!/bin/sh
OVPN_DIR="/path/to/my/collection/of/FREE/servers"
RANDOM_OVPN=$(ls "$OVPN_DIR"/*.ovpn | awk '{print $NF}' | shuf -n 1)

openvpn --auth-nocache --script-security 2 --config "$RANDOM_OVPN"

this will then ask me to provide my login details.

@Governor

You didn't bother to read their FAQ's .............. gives you plenty more time to look at something else

https://protonvpn.com/support/disable-i ... ocol-linux

Jasper wrote: ↑Mon Nov 11, 2024 8:41 am

@Governor

You didn't bother to read their FAQ's .............. gives you plenty more time to look at something else

https://protonvpn.com/support/disable-i ... ocol-linux

ProtonVPN-Free-Customer-Support.png

Thanks for the tip.

# nano /etc/sysctl.conf
Command 'nano' not found, but can be installed with:
apt install nano
# apt install nano
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
  gnome-keyring libjs-jquery libndp0 libnewt0.52 libteamdctl0 network-manager
  python3-aiohttp python3-aiosignal python3-async-timeout python3-attr python3-bcrypt
  python3-cffi-backend python3-cryptography python3-dbus python3-distro
  python3-frozenlist python3-gnupg python3-importlib-metadata python3-jaraco.classes
  python3-jeepney python3-jinja2 python3-keyring python3-markupsafe
  python3-more-itertools python3-multidict python3-nacl python3-openssl
  python3-packaging python3-secretstorage python3-sentry-sdk python3-yarl python3-zipp
Use 'apt autoremove' to remove them.
Suggested packages:
  hunspell
The following NEW packages will be installed:
  nano
0 upgraded, 1 newly installed, 0 to remove and 127 not upgraded.
1 not fully installed or removed.
Need to get 690 kB of archives.
After this operation, 2,871 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian bookworm/main amd64 nano amd64 7.2-1+deb12u1 [690 kB]
Fetched 690 kB in 0s (1,541 kB/s)
Selecting previously unselected package nano.
(Reading database ... 86182 files and directories currently installed.)
Preparing to unpack .../nano_7.2-1+deb12u1_amd64.deb ...
Unpacking nano (7.2-1+deb12u1) ...
Setting up mullvad-vpn (2024.7) ...
/var/lib/dpkg/info/mullvad-vpn.postinst: line 6: systemctl: command not found
dpkg: error processing package mullvad-vpn (--configure):
 installed mullvad-vpn package post-installation script subprocess returned error exit s
tatus 127
Setting up nano (7.2-1+deb12u1) ...
update-alternatives: using /bin/nano to provide /usr/bin/editor (editor) in auto mode
update-alternatives: using /bin/nano to provide /usr/bin/pico (pico) in auto mode
Processing triggers for man-db (2.11.2-2) ...
Errors were encountered while processing:
 mullvad-vpn
E: Sub-process /usr/bin/dpkg returned an error code (1)
# 

The sysctl.conf file now looks like this:

#
# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additional system variables.
# See sysctl.conf (5) for information.
#

#kernel.domainname = example.com

# Uncomment the following to stop low-level messages on console
#kernel.printk = 3 4 1 3
kernel.printk = 3 4 1 3

###################################################################
# Functions previously found in netbase
#

# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
#net.ipv4.conf.default.rp_filter=1
#net.ipv4.conf.all.rp_filter=1

# Uncomment the next line to enable TCP/IP SYN cookies
# See http://lwn.net/Articles/277146/
# Note: This may impact IPv6 TCP sessions too
#net.ipv4.tcp_syncookies=1

# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1

# Uncomment the next line to enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
#net.ipv6.conf.all.forwarding=1


###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Do not accept ICMP redirects (prevent MITM attacks)
#net.ipv4.conf.all.accept_redirects = 0
#net.ipv6.conf.all.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
# net.ipv4.conf.all.secure_redirects = 1
#
# Do not send ICMP redirects (we are not a router)
#net.ipv4.conf.all.send_redirects = 0
#
# Do not accept IP source route packets (we are not a router)
#net.ipv4.conf.all.accept_source_route = 0
#net.ipv6.conf.all.accept_source_route = 0
#
# Log Martian Packets
#net.ipv4.conf.all.log_martians = 1
#

###################################################################
# Magic system request Key
# 0=disable, 1=enable all, >1 bitmask of sysrq functions
# See https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html
# for what other values do
#kernel.sysrq=438
net.ipv6.conf.all.disable_ipv6 = 1 
net.ipv6.conf.default.disable_ipv6 = 1 
net.ipv6.conf.lo.disable_ipv6 = 1 
net.ipv6.conf.tun0.disable_ipv6 = 1

How do I proceed? Should any of the extra security features be enabled?
Thanks!
I got this output for sysctl -p

# sysctl -p
kernel.printk = 3 4 1 3
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
sysctl: cannot stat /proc/sys/net/ipv6/conf/tun0/disable_ipv6: No such file or directory
# 

PS. It works! My public IPv6 not detected. How would you also eliminate (or spoof) the "My ISP" and "IP Location"?

rockedge wrote: ↑Sun Nov 10, 2024 10:49 pm

@wizard

I've customized the Rox-filer right click menu by adding a symlink here -> root/.config/rox.sourceforge.net/SendTo/.text_plain/VPN-CONNECT2.sh

which is renamed to VPNCONNECT2 and also dragged VPN-CONNECT2.sh to the desktop pinboard, renamed to vpnconnect for a better manageable size and assigned an icon.

So it is possible to drag protonvpn config files from a Rox-filer window drop on the desktop icon!
Screenshot(14).jpg

This worked well for me, but apparently I must close the current proton connection before starting a new one?
Can you make it so the current proton connection will automatically close when choosing a new connection?

@Jasper

Are you simply adding/merging the login details provided to the *.ovpn file?

Yes, that's line 18 which then creates the file myserver.ovpn

There are many ways you could write this to be more polished, if you have a lot of server config files @rockedge spin of putting a VPN-CONNECT2.sh link on the desktop is an easy choice. Think you could also put an icon in the JWM tray that would work. Lots of choices.

I chose the current approach for several reasons:
1. simple to use, open directory, choose server file, drag and drop on VPN-CONNECT2.sh
2. directory with files can be located almost anywhere
3. only requires the user to edit one file with the username/password
4. some users are hesitant to install a .pet file
5. easy to write and deploy, especially considering the limited interest.

Keep us advised on your solution.

Thanks
wizard

@Governor

Can you make it so the current proton connection will automatically close when choosing a new connection?

Try this:

wizard

@wizard

My random script does work 'as is' but it requires the user to input their credentials.

So, I tried to figure out where I needed to insert the User Credentials in the *.ovpn files

Ideally, some script could have automated the process to insert the details into lines 127 - 130 as shown above.

The 'random' script needs tweaking as it does pick the file but it still prompts you for credentials.

If you run the command in terminal for an individual file, it does not require any user input

openvpn --auth-nocache --script-security level 0 --config <OVPN-FILE>

some users are hesitant to install a .pet file

It is a shame this is falling by the wayside .......... Pets are what makes Puppy unique.

@Jasper

Probably needs to look something like this:

#!/bin/sh
OVPN_DIR="/path/to/my/collection/of/FREE/servers"
RANDOM_OVPN=$(ls "$OVPN_DIR"/*.ovpn | awk '{print $NF}' | shuf -n 1)

#delete any existing myserver.ovpn file
rm myserver.ovpn

#add user and password to configuration file
cat $RANDOM_OVPN userpw.txt > myserver.ovpn

#run openvpn in terminal
urxvt -e openvpn --auth-nocache --script-security 2 --config myserver.ovpn

The username/password are in the file: login.conf
The code that calls login.conf is in: userpw.txt
The "cat" function adds the code from userpw.txt to the bottom of the original .ovpn and creates the file: myserver.ovpn
The last line above runs openvpn using myserver.ovpn

wizard

@Jasper

some users are hesitant to install a .pet file

It is a shame this is falling by the wayside .......... Pets are what makes Puppy unique.

Think it's mostly new and inexperienced users particularly those coming from MS Windows where use of the "registry" and sloppy practices leads to gradual erosion of performance. Experienced users here can just open a .pet up and look inside if they want, or as always good practice, install in a test save file/folder to validate.

Thanks
wizard

On my KLA-plasma-KDE-CE-1.2 it connects automatically (with a mouse click and open with Import VPN - only the name and password remain to be entered

Install : sudo pacman -Syu openvpn networkmanager-openvpn

USA and Netherlands

@Sofiya

What method and script are you usiing?

Thanks
wizard

wizard wrote: ↑Mon Nov 11, 2024 9:24 pm

@Sofiya

What method and script are you usiing?

Thanks
wizard

no script - just the file from which the installation will occur
I just right-click on the file and select (Open with Import VPN)
KDE already has everything for this in its network settings.

The speed is excellent Thank you for the tip !!!