What is the most efficient way of connecting to Pritunl via raspberry pis?

Pritunl
1

@zach (Sorry to bring you into this but you have been the most helpful)

Looking for the best approach to have our multiple raspberry pis connect to our Pritunl server. 2 approaches we are looking into are the following:

  1. Setup Ansible to upload the ovpn-profile onto our Raspbery pi devices and have it connect locally.
  2. Install pritunl-client cli onto our Raspberry pis and have 1 user be used to connect a number of devices to it using the profile link.
    1. Installed it via these instructions: Help to build arm client - #2 by zach
    2. Once here, we would need to have all raspberry pis open to connect to our server which is not ideal for security sakes.

Wondering if this has been brought up on here in Pritunl.

2

The CLI client has commands to import profiles. There is an API handler GET /key/<org_id>/<user_id> that will return a JSON struct with the uri_url. This can then be added to pritunl://domain to create the URI that can be imported into the client.

1 Like
3

Hey @zach, coming back to this.

Since I got the VPN server working on Pritunl, we want to create mapping of the MAC SSID being like so: 3f3f3ff3gg.foo.com, 2h3h3h43kk.foo.com, etc.

Previous concept:

  1. Use Ansible to ssh into IoT devices
  2. Add a ovpn.profile
  3. Connect to the openvpn server

New concept:

  1. Use Ansible to ssh into the IoT devices
  2. Upload api token and secret onto IoT devices
  3. Create the user using the MAC SSID and upload to Pritunl Server to be synced
  4. Use the Python API Client to grab the temp URL token
  5. Install pritunl-client and grab the temporary token URL that was pulled to import the profile and add via pritunl://domain

The issue that we are facing is our current IoT devices are on our original OpenVPN server. The connection will fail if we switch from the OpenVPN server to Pritunl where the SSH connection will drop.

What would be the most best/secure route to this?

UPDATE: I have been brainstorming where I create a Pritunl Bastion Host which communicates to the Pritunl Server. When a IoT device boots up for the first time, it will ssh into the Bastion Host which holds the API token and secret, create a user, pull the profile link, grab the tar file, and move the tar file to the IoT Device, and finally use pritunl-client to add the profile and connect.

image
image788×663 7.26 KB

4

The connection can be set to enable with sudo pritunl-client enable <conn_id> this will enable it to start on the next restart. The existing OpenVPN connection can be set to disconnect on the next restart.

The OpenVPN ChaCha20-Poly1305 cipher option in the Pritunl server settings should also be used for ARM devices. This will provide better performance as ARM devices don’t have AES-NI.

1 Like
5

Thank you on the cipher option! We have a process of curling into our server and have that be used to access our devices rather than our previous being sshing.