Private Internet Access Client (OpenVPN+Iptables+DNS over TLS on Alpine Linux)

Lightweight VPN client to tunnel to private internet access servers

WARNING: auth.conf is now replaced by the environment variables USER and PASSWORD, please update your configuration

Image size	RAM usage	CPU usage
20MB	14MB to 80MB	Low to Medium

It is based on:

• Alpine 3.8 for a tiny image
• OpenVPN 2.4.6-r3 to tunnel to PIA servers
• IPtables 1.6.2-r0 enforces the container to communicate only through the VPN or with other containers in its virtual network (acts as a killswitch)
• Unbound 1.7.3-r0 configured with Cloudflare's 1.1.1.1 DNS over TLS
• Malicious hostnames list used with Unbound (see BLOCK_MALICIOUS environment variable)
• Malicious IPs list used with Unbound (see BLOCK_MALICIOUS)

Extra features

• Only use environment variables:
  • the destination region
  • the protocol tcp or udp
  • the level of encryption normal or strong
• Connect other containers to it
• The iptables firewall allows traffic only with needed PIA servers (IP addresses, port, protocol) combination
• OpenVPN restarts on failure using another PIA IP address for the same region
• Docker healthchecks using duckduckgo.com to obtain your public IP address and compare it with PIA Ips in configuration file
• Openvpn and Unbound do not run as root

Requirements

• A Private Internet Access username and password - Sign up
• Docker installed on the host
• If you use a strict firewall on the host/router:
  • Allow outbound TCP 853 to 1.1.1.1 to allow Unbound to resolve the PIA domain name at start. You can then block it once the container is started.
  • For UDP strong encryption, allow outbound UDP 1197
  • For UDP normal encryption, allow outbound UDP 1198
  • For TCP strong encryption, allow outbound TCP 501
  • For TCP normal encryption, allow outbound TCP 502

Setup

1. Make sure you have your /dev/net/tun device setup on your host with one of the following commands, depending on your OS:

   insmod /lib/modules/tun.ko
   

   Or

   modprobe tun
   

2. Launch the container with:

   docker run -d --name=pia -v ./auth.conf:/auth.conf:ro \
   --cap-add=NET_ADMIN --device=/dev/net/tun --network=pianet \
   -e REGION="CA Montreal" -e PROTOCOL=udp -e ENCRYPTION=strong \
   -e USER=js89ds7 -e PASSWORD=8fd9s239G \
   qmcgaw/private-internet-access
   

   or use docker-compose.yml with:

   docker-compose up -d
   

   Note that you can change all the environment variables

3. Wait about 5 seconds for it to connect to the PIA server. You can check with:

   docker logs -f pia
   

4. Follow the Testing section

Testing

You can simply use the Docker healthcheck. The container will mark itself as unhealthy if the public IP address is not part of the PIA IPs. Otherwise you can follow these instructions:

1. Check your host IP address with:

   wget -qO- https://ipinfo.io/ip
   

2. Run the same command in a Docker container using your pia container as network with:

   docker run --rm --network=container:pia alpine:3.8 wget -qO- https://ipinfo.io/ip
   

   If the displayed IP address appears and is different that your host IP address, the PIA client works !

Environment variables

Environment variable	Default	Description
REGION	CA Montreal	One of the PIA regions
PROTOCOL	udp	tcp or udp
ENCRYPTION	strong	normal or strong
BLOCK_MALICIOUS	off	on or off
USER	``	Your PIA username
PASSWORD	``	Your PIA password
EXTRA_SUBNETS	``	Comma separated subnets allowed in the container firewall

EXTRA_SUBNETS can be in example: 192.168.1.0/24,192.168.10.121,10.0.0.5/28

Connect other containers to it

Connect other Docker containers to the PIA VPN connection by adding --network=container:pia when launching them.

For the paranoids

• You can review the code which essential consits in the Dockerfile and entrypoint.sh

• Build the images yourself:

  docker build -t qmcgaw/private-internet-access https://github.com/qdm12/private-internet-access-docker.git
  

• The download and unziping of PIA openvpn files is done at build for the ones not able to download the zip files

• Checksums for PIA openvpn zip files are not used as these files change often (but HTTPS is used)

• Use -e ENCRYPTION=strong -e BLOCK_MALICIOUS=on

TODOs

• Malicious IPs and hostnames with wget at launch+checksums
• Su Exec (fork and addition)
• SOCKS proxy/Hiproxy/VPN server for other devices to use the container

License

This repository is under an MIT license