Important:I am not affiliated with any of the manufacturers, brands, services, or websites listed on this page and this is my personal experience. If you find this helpful and want to say thanks, pleasebuy me a coffeeortake a look at my book on Amazon. It keeps this page ad-free. Thank you!
Background
The Raspberry Pi is a great sub-US$200 device that offers great value for hobby projects and educational purposes. In this review, I’ll share my experience and instructions for setting up a Raspberry Pi with PiVPN using NoIP.com, a free Dynamic DNS service. If you need a list of PiVPN commands, check this link.
Running your own Raspberry PiVPN can be useful if you want a free VPN for when you’re traveling (great if you live in the US and want a US VPN when overseas), if you want to VPN into your home network, or if you want to use local file storage at home. If you don’t own a Raspberry Pi, I recommend a Pi 4B kit. If you need a microSD card reader, this one is great and it’s both USB A and USB C – so works on macOS and Windows devices.
Assumptions
This guide assumes the following:
- You have a Raspberry Pi already setup and running Rasbian Pi OS
- That you know how to set a static IP address on your router and assign it to your Pi
- That you will be able to find how to forward a port on your router to your Pi
- That you know how to SSH into or connect to your Pi and access the command line
- That you won’t email me for technical support if you get stuck or confused. Sorry.
If you don’t know how to do any of the above, don’t panic. I will note at the appropriate stage where you will need this information, and search will be your friend. There are a lot of steps, and you should give yourself a good hour to go through this properly.
To make it easier, this guide consists of 4 Parts.
- Part 1: Setup the Basics
Everything you need to configure on your router and accounts you need to setup before you begin. - Part 2: Installing WireGuard PiVPN
This is the software you need to run a WireGuard VPN. - Part 3: Setting up NoIP on a Raspberry Pi
You’ll need to do this, so you have a static address to connect to from your remote device. - Part 4: Set up a WireGuard Account
How to create and connect to your new WireGuard Pi setup. - PiVPN Troubleshooting
Some general PiVPN troubleshooting tips if you’re having issues.
FYI, if you want to use NoIP on your PiHole for some other purpose, like a Minecraft Server, you can jump to and follow everything in Part 3, which is all the instructions you need to set up NoIP on a Raspberry Pi.
Part 1: Setup the Basics
Set a Static IP Address
You will need to ensure your Raspberry Pi has been assigned a static IP address by your router. Every router works differently, so I cannot give you exact instructions. I did write up how to set a static IP address for the G3100, which help you directionally understand what you need to do.
As you set this up, you may want to know the current IP address of your Pi; you can find this out using the shell command on your Pi.
hostname -I
I’ll wait here while you go search for details on how to configure your router.
Once you have set the static IP configured, it’s a good idea to restart your Pi. You should then verify that the static IP address is correctly saved (both by your Router and the Pi).
Setup Port Forwarding on Your Router
Now that you have a static IP address, you will need to forward a port to the PI’s static IP address. It’s easier to do this now, as this information is required during the PiVPN setup.
One of the reasons you need to do this now is the open port will be required during setup. For security reasons, it is better not to use the default VPN port suggested by PiVPN because open port scanning is a prime attack method for hackers.
The port should be opened for UDP.
You should avoid using a commonly used port 21, 22, 24, 80, 443, and I could go on, Wikipedia has a great list of ports to avoid.
Note down the port you selected, you’ll need that later.
Create a NoIP Account
In Part 2, you will need to use your NoIP account details during the PiVPN setup. NoIP has both free and paid plans. On the NoIP free plan, you will need to confirm your account every 30 days. It’s worth spending the US$25 to avoid having to reconfirm your account, plus it also gives you access to some better and more memorable domains. I’m not affiliated with NoIP and don’t earn a commission, so do what’s best for you.
When you create your NoIP account, you will need to note down:
- the Dynamic DNS Hostname you selected
- your username and password
A reminder, please note these down; you will need them later.
Update your Raspberry Pi
You will need to make sure your Rasberry Pi is up to date, so via SSH or in the terminal, enter the following:
- Update System Packages
sudo update
- Then do a software upgrade of your Raspberry Pi
sudo full-upgrade
- Then remove any un-needed packages for software that is no longer installed
sudo apt autoremove
- Then restart your Pi
sudo reboot
Once your Raspberry Pi restarts, you’re ready to move on to Part 2.
Part 2: Installing PiVPN (with Wireguard) on a Raspberry Pi
- Login to your Raspberry Pi via SSH or in the terminal and enter the following to install curl (some Pi OS versions don’t have it) and to install PiVPN:
sudo apt install curl -y
curl -L https://install.pivpn.io | bash
- During the setup, select the WireGuard option on the “Installation Mode” page. Wireguard is much more secure (and faster to connect to) than OpenVPN.
When prompted, set up the WireGuard port to the port number that was forwarded on your router (you noted this down in Part 1).
If you would like to use PiHole DNS for your VPN traffic, PiVPN automatically detects the PiHole installation and gives you the option to select PiHole DNS for your VPN traffic. Select the option if you have PiHole installed
After the server installation is complete, reboot the Pi.
But you’re still not done.
Part 3: Setting up NoIP on your Raspberry Pi
To be able to use Wireguard as a VPN on your Pi, you need to be able to remotely connect to it, which means you need to have a static IP address for your Pi. NoIP has detailed Raspberry Pi static IP instructions, which I am resharing below.
- Connect to your Raspberry PI via SSH or the terminal prompt, and create a directory for the NoIP software.
mkdir /home/pi/noip
- Now change to the directory.
cd /home/pi/noip
- Now you need to download the NoIP Client Software to your Raspberry Pi.
wget https://www.noip.com/client/linux/noip-duc-linux.tar.gz
- Now unzip the software (technically untar but anyway…)
tar vzxf noip-duc-linux.tar.gz
- Now you change to the directory where the software is going to be installed.
cd noip-2.1.9-1
- And install the NoIP Raspberry Pi client with the following commands to build:
sudo make
- then install the NoIP software
sudo make install
- At this point, you will be prompted to enter your NoIP username and password, which you noted down way back during Part 1 basics setup.
Tip: This is probably where you’ll encounter an issue if you miskey your username or password. If you get stuck, you can always log back into NoIP on the web and change your username and password.
- Once you have successfully logged in, you will be prompted to set an update interval, anywhere between 5 and 30minutes. It’s perfectly OK to do a 30minute update, which is more than adequate for most people.
- Now execute this command to ensure the process is active. You will need to set it to autorun at boot.
sudo /usr/local/bin/noip2
- You can check NoIP is successfully installed and running with this command (the S MUST be capitalized).
sudo noip2 -S
- The NoIP client will not start on reboot, so now you need to set up a cron job. Run this command (you may be prompted to select the file editor).
sudo crontab -e
- Paste this line at the end of the file.
@reboot /usr/local/bin/noip2
- Press Ctrl+X to Exit, select Y to save the buffer, and press Enter.
- Now reboot your Pi.
After reboot, you can check the NoIP service has started by running this command.
sudo noip2 -S
The output should say something along the lines of:
1 noip2 process active.
Followed by some other stuff about your configuration (username, etc.). If it doesn’t, it’s likely you didn’t save the cron job, so go back to Step 11 above and try again.
Tip
If you want to change the update interval later, you can use the following command:
sudo noip2 -U <minutes>
Please note the U is CaSe SeNsItiVe, where <minutes> is the number of minutes you want between updates between 5 and 30. If you get told that -u must be used with -p, then you didn’t enter an upper case U.
Part 4: Setup a WireGuard Account on your Pi
This is probably the easiest part of the whole process.
First, make sure you have the WireGuard client installed on your device. If you’re in a hurry, here’s the link to WireGuard for Android and the link to WireGuard for iOS. For every other device, you can find WireGuard clients here.
Now you need to SSH or open a terminal window on your Raspberry Pi.
- To create a WireGuard user account, enter:
pivpn add
- You will be prompted to enter a profile name, aka client, aka username, so pick something that works for you. Write down and remember this username, you’ll need it later.
- Now you need to configure your device to connect and login to the WireGuard. You can either go through the pain of transferring the .conf file or do it the easy way, using a QR code. Here’s how to do it the easy way.
- To generate the WireGuard QR code, type the following, where <ProfileName> is the name of the profile you entered earlier.
pivpn -qr <ProfileName>
- You will see a QR code on your screen, which you can then scan with the WireGuard app. To do that (on mobile), click the plus “+” sign in the top right-hand corner of the WireGuard app, select Create from QR code, and follow the prompts. You can give the connection any name you want.
- Now to test the connection, turn it on the profile in the WireGuard app.
Troubleshooting: PiVPN Connects but No Internet
This could be an IP routing table issue, you can run this command and itshouldfix the problem. No guarantees, but it will work 9 times out of 10. If it doesn’t, I can’t provide any other tech support – but this is worth a shot.
pivpn -d
If PiVPN tells you
Iptables MASQUERADE rule is not set, attempt fix now?
Select Yes, and this should resolve your problem. You may need to reboot your Raspberry Pi for this to take full effect.
For what it’s worth, pivpn -d is the diagnostic tool built into PiVPN.
Other Troubleshooting
Unlike other guides you might read, I did all of the above myself and know it works. I don’t provide technical support (Sorry). If you have issues, the steps that you should check are:
- not having a static IP address on your Raspberry Pi
- not setting the firewall rules correctly on your router
- misconfigured port numbers/not opening the right port on your router
- not using the correct port number when you set up PiVPN
- errors in your username/passwords for NoIP
(or some issue with NoIP not resolving to your DNS – router firewall issues) - misconfiguring your PiVPN client
(it’s best to set up using a phone with WiFi off and the QR code setup to test it all works) - don’t forget to try the pivpn – d diagnostic command to double-check your PiVPN configuration
(routing table issues can happen during setup)
The best advice I can give is to check that your NoIP setup is working 100% OK as that can be a big headache. If NoIP is working, then go through and repeat each step just in case you missed something.
Sorry, but please don’t email me asking for help, as this is just too hard to troubleshoot remotely.
List of PiVPN Commands
If you need a list of PiVPN commands, check this link.
Important:I am not affiliated with any of the manufacturers, brands, services, or websites listed on this page and this is my personal experience. If you find this helpful and want to say thanks, pleasebuy me a coffeeortake a look at my book on Amazon. It keeps this page ad-free. Thank you!
