Multihop with OpenVPN Tunnels on OPNsense
Check if your provider supports this. Perfect Privacy is known to support at least 4 Tunnel.
git clone https://github.com/opnsense/plugins
git clone https://github.com/ddowse/opnsense-multihop plugins/security/openvpn-multihop
cd plugins/security/openvpn-multihop
make package
Fetch the current pre-release from this repo and install it like this
pkg add https://github.com/ddowse/opnsense-multihop/releases/download/Latest/os-openvpn-multihop-1.0.txz
You can also control the tunnel cascade on the shell like this:
configctl multihop [stop|start|status]
Check your IP
curl -s https://checkip.perfect-privacy.com/json | jq
-
The Plugin will extract the VPNID and creates a list and stores that information in
/usr/local/etc/multihop.conf
. -
The Shellscript
/usr/local/opnsense/scripts/OPNsense/Multihop/multihop.sh
will be executed when the service API triggersconfigd
.- The Shellscript will read the list of VPNID's from its own conf file.
- Get's the
server_addr
field of the next VPNID int the list by usingpluginclt
and parse it withjq
- The correct
server_addr
is passed to the--route-up
script. This adds the GW of the current OpenVPN Tunnel to the routing table forserver_addr
. The Shellscript skips--route-up
on the last VPNID and set the routing options from the clients settings.
-
The static route for the first tunnel is needed to prevent a network traffic loop.
The OPNsense OpenVPN Client Configuration is not touched. Altough VPN Clients that are used for mutlihopping should be disabled in OpenVPN->Client or they will startup on reboot, too - as this is the default.
You may also want take care of NAT and Filter settings.
Some examples can be found in my other repo pfSense-pkg-openvpn-multihop.
You are welcome to open issues (code/errors) or improve this plugin. It might be a good idea to mix VPN providers and report your results if you want.
This Plugin was done as Freelance Job for a customer who wants to remain anonymous.
Thanks to her/him this Plugin is now available to the open-source community. Thank you!. ❤️
As I am a Freelancer, do not hesitate to contact me via my E-Mail if you have a need for individual Plugins or Bugfixes.