Private Internet Access/AUR

This article details the installation and usage of private-internet-access-vpn^AUR. For the general information on the service and additional packages, see Private Internet Access.

Note: In 2019, PIA merged with Kape Technologies, and this event has been surrounded by a lot of controversy, especially via reddit posts. However since the merger, the following improvements have been made to the PIA infrastructure:

All PIA applications got released as Open Source: https://github.com/pia-foss
WireGuard got added to the VPN servers and VPN Apps
VPN servers got migrated from Ubuntu 14 LTS to Arch Linux
All VPN servers now are encrypted via dm-crypt, following advice from Arch devs
All VPN services now run in memory via ramdisk

Installation

Install the private-internet-access-vpn^AUR or private-internet-access-vpn-dev^AURpackage.

Note: This is not meant to be installed through python-pip directly. See for more information.

The package provides a tool that downloads the OpenVPN configuration files and stores them in . However, it updates the file names to better support using them on the command line.

Configuration for the package is stored in .

After installation

If there are any issues with connectivity and you are running , please restart .

Usage

Enabling auto-login allows a user to connect to the VPN service without having to type any passwords on the command line (needed when using ). To set this up, you must do the following:

Create /etc/private-internet-access/login.conf
Add your username and password in the file. Make sure LINE 1 is your username and LINE 2 is your password. Do not add any other text to the file or it will not work (this is a limitation of OpenVPN):

/etc/private-internet-access/login.conf

USERNAME
PASSWORD

Change permissions of the file to 0600 and owner to root:root:

 This secures the access to the file from non-root users. Read more on File permissions and attributes. It is required when activating auto-login.

Run as root.
- If you have installed, it will create the configuration files for . Make sure to restart to see them.
- If you have installed, it will create the configuration files for . Start if not running already. It will auto load the profiles.
- Regardless, it will create the OpenVPN files in .

Manually connecting to VPN

 will be listed in the /etc/openvpn directory or run .

For connman:

enable the .
Run as root (if you have not already)

Get a list of all connman services and find the name of the VPN config in the second column

Connect to your VPN chosen VPN config to create a connman settings file for it:

Edit the relevant settings file:

# vim /var/lib/connman/vpn_fi_privateinternetaccess_com_privateinternetaccess_com/settings

Change the line to , save, exit, reboot

Advanced options

Create
For the section:

option	option values	description
openvpn_auto_login	True,False	Default: True; Configures if OpenVPN configuration files should have auto-login enabled. See #Enabling auto-login

For the section:

option	option values	description
apps	cm, nm	Default: all; This configures which applications are configured. The application will configure all applications installed; however, if a user only needed configurations for Conman, then setting this to 'cm' would generate only those configurations even if they had NetworkManager installed. OpenVPN configurations are always generated. cm = Conman; nm = NetworkManager
port	See for list: PIA's Support - Which encryption/auth settings should I use for ports on your gateways?	Default: 1198

Example configuration

The configuration enables auto-login, configures only Connman and OpenVPN, uses port 8080 over UDP, and configures only US East, US West, Japan, UK London, and UK Southampton VPN endpoints. OpenVPN is always configured.

Troubleshooting

Using NetworkManager's applet

In order to use the to connect:

Right click the NetworkManager icon in the system tray
and click Configure Network Connections...
then click Add
choose Import VPN...
browse to /etc/openvpn/client/CA_Toronto.conf or whichever configuration you would like to use
then click Open
Remove only the from the (if present) as only the domain name should be in this box
for the Username: type in your username
for the type in the password that goes with your username
then click Advanced...
set and set it to
click on the Security tab
set the to
set the to
click OK
click OK again

DNS Leaks

Concerning DNS Leaks (see python-pia/#13), NetworkManager leaks information due to how /etc/resolv.conf is setup. The script below was posted by @maximbaz to work around the problem. You may need to disable IPv6 if you continue to get leaks.

/etc/NetworkManager/dispatcher.d/pia-vpn

#!/bin/bash
#/etc/NetworkManager/dispatcher.d/pia-vpn

interface="$1"
status=$2

case $status in
  vpn-up)
    if [[ $interface == "tun0" ]]; then
      chattr -i /etc/resolv.conf
      echo -e "nameserver 209.222.18.222\nnameserver 209.222.18.218" > /etc/resolv.conf
      chattr +i /etc/resolv.conf
    fi
    ;;
  vpn-down)
    if [[ $interface == "tun0" ]]; then
      chattr -i /etc/resolv.conf
    fi
    ;;
esac

gollark: Gold is only valuable because people *think it is*; this also applies to paper money.

gollark: There is no intrinsic value. The lack of gold just means you can trivially print it.

gollark: Ah yes, "intrinsic monetary value" TOTALLY EXISTS.

gollark: I'm not in the US, though.

gollark: As far as I can tell, I can buy those things from multiple places.