Setup a VPN Gateway Server which will use the privateinternetaccess.com (PIA) GUI software.
================================================================================================================================================================


Notes
----------------------------------------------------------------
-- As of this writing on 04/20/2019, here are the software versions I am using:
	-- PIA GUI software v1.1.1
	-- Ubuntu Desktop 19.04




Rename the USB Networks interface name
----------------------------------------------------------------

-- Here are what each network port on the VPN Gateway is suppose to connect to:
	eth1		- WAN
	eth2		- VPN & Firewall. This is where all client PCs/Laptops are to connect to.
	eth3		- VPN Only. Use this if want to bypass the Firewall (Endian Firewall on my setup)

-- Find the example file in PIA/example_files/70-persistent-net.rules.
	-- In that file, only modify the mac address by using the USB Network's mac address. Make sure you pair up the ethernet name (e.g. eth1, eth2) with their corresponding mac address.
           You can find the USB Networks mac address by using the 'ifconfig' linux command and finding the mac address printed physically on the USB Network adapter.

-- Copy or merge the modified PIA/example_files/70-persistent-net.rules.
	-- If the /etc/udev/rules.d/70-persistent-net.rules file exist, then merge the changes into existing file.
	-- If the /etc/udev/rules.d/70-persistent-net.rules file does NOT exist, then just copy that file to that directory path.

-- Next, reboot your VPN Gateway linux machine.

-- Verify by using 'ifconfig' that each USB Network adapter has the correct network adapter name (e.g. eth1, eth2).



Install some Ubuntu packages
----------------------------------------------------------------
-- This installs the 'ifconfig' command
	% sudo apt-get install net-tools



Configure the interfaces.
----------------------------------------------------------------

-- Save the original network interface configurations
	% sudo /etc/network/interfaces /etc/network/interfaces_save_04-20-2019A		# Change the date stamp on the destination filename to todays date.

-- Modify the example interface config file
	% vi PIA/example_files/interfaces.txt
		# Temporarily comment out any 'pre-up' of 'post-down' commands.


-- Copy the modified interface config file to the real one.
	% sudo PIA/example_files/interfaces.txt /etc/network/interfaces

-- Next, reboot your VPN Gateway linux machine.

-- Verify by using 'ifconfig' that the interfaces have the correct IP addresses:
	-- Check that eth1 (WAN) has a WAN IP address. It should not have a 192.168.*.* address. You can use a web tool to determine the origin of that IP address (e.g. it comes from your ISP like Comcast).
           This interface will request a DHCP IP from your ISP (e.g. Comcast). It does not use the VPN Gateways DNS server.
	-- Check that eth2 (VPN & Firewall) has the correct IP address. On my setup, this should be 192.168.3.*.
	-- Check that eth2 (VPN only) has the correct IP address. On my setup, this should be 192.168.101.*.



Install Ubuntu packages
----------------------------------------------------------------
% sudo apt-get update
% sudo apt-get -y install openvpn network-manager-openvpn network-manager-openvpn-gnome



Setup PIA software
----------------------------------------------------------------
-- Download the PIA software from the privateinternetaccess.com site. Download the Linux version since it will be installed on Ubuntu.
-- Install it
	% chmod +x pia-linux-1.1.1-02545.run
	% ./pia-linux-1.1.1-02545.run
		# Do NOT use the 'sudo' command here to run this file.

-- Use the PIA GUI to configure VPN
	-- After installing, the PIA GUI will appear. Use this to configure the VPN.



Set up iptables to use VPN.
----------------------------------------------------------------

% vi PIA/scripts/script_setup_iptables_vpn.sh
	# Modify the interface values (e.g. INTF_LAN, and etc) as needed.

% sudo chmod +x PIA/scripts/script_setup_iptables_vpn.sh

% sudo PIA/scripts/script_setup_iptables_vpn.sh
	# Must use the 'sudo' command here.

-- Verify these files were recently created:
	/etc/iptables.downrules
	/etc/iptables.rules


-- Modify the example interface config file to re-enable the 'pre-up' of 'post-down' commands.

	% sudo vi /etc/network/interfaces
		# Uncomment out any 'pre-up' of 'post-down' commands.


Recommended PIA VPN configuration
----------------------------------------------------------------
-- In Settings/General:
	-- Enable 'Launch on System Startup'.
	-- Enable 'Connect on Launch'.

-- In Settings/Network:
	-- Use the 'PIA DNS'. This will allow web access from the VPN Gateway and the client.

-- In Settings/Privacy:
	-- Set 'VPN Killswtich' to 'Auto'.
	-- Set the 'PIA Mace' to 'On'.

-- In Settings/Connection:
	-- Set 'Data Encryption' to 'AES-256 (CBC)'.
	-- Set 'Data Authentication' to 'SHA256'.

	# These assures the best encryption/authentication strength.

-- After making changes, you must disconnect and then reconnect to apply the changes.



VPN Gateway server should auto login at boot time so PIA GUI can start up.
----------------------------------------------------------------
1) You will need the Ubuntu VPN Server to automatically login at boot up time so that the
   PIA VPN GUI can start up.
        -- In Ubuntu, select:
                System Settings > Details > Users > (select username)
		Click on the Unlock icon at top menu bar.
                Enable the 'Automatic Login'.



Test the PIA VPN connection
----------------------------------------------------------------
-- Reboot the VPN Gateway.
-- From the VPN Gateway server, ping 8.8.8.8, it should pass. Open a web server to yahoo.com, it should pass.
-- From a client, ping 8.8.8.8, it should pass. Open a web browser to yahoo.com, it should pass.
-- From a client, use myip.com to find your client's IP address. It should be different than the VPN Gateway server's eth1 WAN IP address. Also, this IP should match the 'VPN IP' displayed by the PIA GUI.



Notes
----------------------------------------------------------------
-- Restart Networking services in Ubuntu 19.04:
	% sudo service network-manager restart

	% sudo systemctl restart NetworkManager.service

	% sudo netplan apply

-- The scripts:
	# When running these, remember to use the 'sudo' command.

	-- script_pia_tunnel.sh
	   It is used to allow Cisco Anyconnect to work with this VPN Gateway.

	-- script_setup_iptables_open.sh
	   Disables allow of the iptables so both VPN Gateway and clients can use the internet. However, you are NOT protected in this mode.

	-- script_setup_iptables_vpn.sh
           This is used when using PIA VPN GUI software. This is the default way of using the VPN Gateway.

	-- script_setup_iptables_vpn_port_forwarding.sh
	   This is used when using port forwarding with PIA VPN GUI software.