Package: openpyn
openpynA python3 script (systemd service as well) to manage OpenVPN connections. Created to easily connect to and switch between, OpenVPN servers hosted by NordVPN. Quickly Connect to the least busy servers with lowest latency from you (using current data from NordVPN’s API). Find servers in a specific country or even a city. It Tunnels DNS traffic through the VPN which normally (when using OpenVPN) goes through your ISP’s DNS (unencrypted) and compromises Privacy!FeaturesAutomatically connect to least busy, low latency servers in a given country.Systemd integration, easy to check VPN status, autostart at startup.Find and connect to servers in a specific city or state.Uses NordVPN’s DNS servers and tunnels DNS queries through the VPN Tunnel.Use Iptables rules to prevent IP leakage if tunnel breaks (Experimental), ie KILL SWITCH.Quickly Connect to any specific server. i.e au10 or us20.Downloads and Updates (modifications) the latest config files from NordVPN.Option to run the script in background (as a systemd service).Options to finetune server selection based on "Server Load" or "Ping Latency".Auto excludes the servers if a ping to them fails or some packets drops when pinging
or if they don’t support OpenVPN (TCP or UDP depending upon which one you are trying to use).Finds and displays NordVPN servers (with extra info) in a given country.Now list and connect to servers with "Netflix" --netflix, "Peer To Peer" --p2p, "Dedicated IP" --dedicated,
"Tor Over VPN" --tor, "Double VPN" --double, "Anti DDos" --anti-ddos support.Desktop notification are shown when VPN connects and disconnects. (needs to run without sudo)Auto retry if [soft,auth-failure] received, auto failover to next best server if connection dies.NVRAM support for Asuswrt-merlinPass through OpenVPN options, e.g. openpyn uk -o '--status /var/log/status.log --log /var/log/log.log'Logs are stored in '/var/log/openpyn/' for information and troubleshooting.Temporarily disable IPv6 to prevent leakage (when using -f).DemoInstructionsInstall dependencies if they are not already present.# common dependenciessudoaptinstallopenvpnpython3-setuptoolspython3-pipThe following Python dependencies are needed and will be installed when using pip.requestscoloramacoloredlogsverboselogstqdmjsonschemaInstallation MethodsInstall openpyn with pip3 (Python=>3.5)Recommended method to get the latest version and receive frequent updates.Do not install with --user switch, as OpenVPN needs to run as sudo and sudo won’t be able to locate openpyn.sudopython3-mpipinstall--upgradeopenpynAlternatively clone and install.gitclonehttps://github.com/jotyGill/openpyn-nordvpn.gitcdopenpyn-nordvpn/
sudopython3-mpipinstall--upgrade.For the latest in development features, try the 'test' branch insteadgitclone--branchtesthttps://github.com/jotyGill/openpyn-nordvpn.gitcdopenpyn-nordvpn/
sudopython3-mpipinstall--upgrade.On macOS (credit:1951FDG)# install Xcode command line toolsxcode-select--install# install Homebrewcurl-fsSLhttps://raw.githubusercontent.com/Homebrew/install/HEAD/install.shecho'export PATH="/usr/local/sbin:$PATH"'>>~/.bash_profile# common dependenciesbrewinstallpython3openvpn
sudobrewservicesstartopenvpngitclone--branchtesthttps://github.com/jotyGill/openpyn-nordvpn.gitcdopenpyn-nordvpn/
sudopython3-mpipinstall--upgradepip
sudopython3-mpipinstall--upgrade.On Asuswrt-merlin, standard installationEntware(credit:1951FDG)Steps belowmayalso work for OpenWrt# common dependenciesopkginstallgitgit-httpiputils-pingprocps-ng-pgreppython3python3-pipsudounzip# allow admin user to run sudosed-i's~root ALL=(ALL) ALL~admin ALL=(ALL) ALL~g'/opt/etc/sudoerscd/tmp/share/
gitclone--branchtesthttps://github.com/jotyGill/openpyn-nordvpn.gitcdopenpyn-nordvpn/
python3-mpipinstall--upgradepip
python3-mpipinstall--upgrade.Steps belownotrequired if only using --nvram option# steps need to be done once after every device rebootmodprobetun
iptables-AFORWARD-ieth0-otun0-s192.168.1.0/24-mconntrack--ctstateNEW-jACCEPT
iptables-AFORWARD-mconntrack--ctstateESTABLISHED,RELATED-jACCEPT
iptables-APOSTROUTING-tnat-otun0-jMASQUERADESteps belowmaybe required ifnotusing --nvram option# change the DNS, either in LAN or WAN settings**DNSServer1**103.86.96.100
**DNSServer2**103.86.99.100SetupInitialise the script with "--init" (store credentials, install Systemd service, update/install VPN config files)sudoopenpyn--initNote: if you get ' openpyn: command not found' when using sudo on Fedora, create a symbolic link.sudo ln -s /usr/local/bin/openpyn /bin/openpynThat’s it, run the script! when done with it, press "Ctr + C" to exit.Basic UsageAt minimum, you only need to specify the country-code, default port is UDP-1194, If you want to use
TCP-443 instead, use "--tcp" switch.openpynusNow, you can also specify a city or state, useful when companies (like Google) lock your
account if you try to login from an IP that resides in a different physical location.openpynus-any
openpynus--area"new york"To enforce firewall rules to prevent DNS leakage, also from IP leakage if tunnel breaks. i.e KILL SWITCH
also temporarily disables IPv6 by running "sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1"openpynus-f# Experimental!, Warning, clears iptables rules!# (changes are non persistent, simply reboot if having networking issues)When using "-f", To allow custom ports (from internal IP ranges, i.e 192.168 or 10.) through the firewall.openpynus-f--allow2280443# only accessible from local networkTo allow ports from other ranges use the--allow-configor--allow-config-jsonoptions. More details can be foundhereTo quickly connect to a specific server.openpyn-sau10To list all the Countries and their Country Codes where NordVPN hosts servers.openpyn-lTo find detailed information about the available servers in a given country.openpyn-lukTo find servers with features like "peer-to-peer", "netflix", "tor over vpn",
"double vpn" in all countries or a given country.openpyn-luk--p2p
openpyn--listuk--dedicated
openpyn-l--tor# Tor over VPN in all countriesTo find the least loaded 10 NordVPN servers in US that support "peer-to-peer",
sort them by the lowest latency from you, connect to the best one, if connection fails
try the next one and so on.openpynus-t10--p2pTo update and run the systemd openpyn.service, use "-d" or "--daemon"sudoopenpynus-dTo check the status of the systemd openpyn.service.systemctlstatusopenpynTo kill a running OpenVPN connection.sudoopenpyn-kTo flush the iptables and kill any running OpenVPN connections.sudoopenpyn-x# optionally --allow 22 if using as SSH serverTo download/update the latest VPN config files from NordVPN.openpyn--updateTo quickly connect to United States "OpenVPN Client 5" (Asuswrt-Merlin).openpynus--nvram5To kill "OpenVPN Client 5" (Asuswrt-Merlin).openpyn-k--nvram5Usage Optionsusage:openpyn[-h][-v][--init][-d][-k][-x][--update][--skip-dns-patch][--silent][--test][-nNVRAM][--no-redirect-gateway][-oOPENVPN_OPTIONS][-sSERVER][-cCOUNTRY_CODE][--tcp][-aAREA][-mMAX_LOAD][-tTOP_SERVERS][--p2p][--dedicated][--tor][--double][--anti-ddos][--netflix][-l[LIST_SERVERS]][--status][--stats][-f][-r][--allow-locally][--allowINTERNALLY_ALLOWED[INTERNALLY_ALLOWED...]][--allow-configINTERNALLY_ALLOWED_CONFIG][--allow-config-jsonINTERNALLY_ALLOWED_CONFIG_JSON][country]Apython3script/systemdservice(GPLv3+)toeasilyconnecttoandswitch
between,OpenVPNservershostedbyNordVPN.QuicklyConnecttotheleastbusy
servers(usingcurrentdatafromNordVPNwebsite)withlowestlatencyfrom
you.FindNordVPNserversinagivencountryorcity.TunnelsDNStraffic
throughtheVPNwhichnormally(whenusingOpenVPNwithNordVPN)goesthrough
yourISP’sDNS(stillunencrypted,evenifyouuseathird-partyDNSservers)positionalarguments:countryCountrycodecanalsobespecifiedwithout"-c,"i.e."openpyn au"optionalarguments:-h,--helpshowthishelpmessageandexit-v,--versionshowprogram’sversionnumberandexit--initInitialise,store/changecredentials,download/updateVPNconfigfiles,needsroot"sudo"access.-d,--daemonUpdateandstartsystemdserviceopenpyn.service,runningitasabackgroundprocess,tocheckstatus"systemctl status openpyn"-k,--killKillanyrunningOpenVPNprocess,veryusefultokillopenpynprocessrunninginbackgroundwith"-d"switch-x,--kill-flushKillanyrunningOpenVPNprocess,andflushiptables--updateFetchthelatestconfigfilesfromNordVPN’ssite--skip-dns-patchSkipsDNSpatching,leaves/etc/resolv.confuntouched.(Notrecommended)--silentDonottrytosendnotifications.Useif"libnotify"or"gi"arenotavailable.Automaticallyusedinsystemdservicefile--testSimulationonly,donotactuallyconnecttotheVPNserver-nNVRAM,--nvramNVRAMSpecifyclienttosaveconfigurationtoNVRAM(Asuswrt-Merlin)OpenVPNOptions:ConfigurableOptionsBeingPassedDownedToOpenVPN--no-redirect-gatewayDon’tset--redirect-gateway-oOPENVPN_OPTIONS,--openvpn-optionsOPENVPN_OPTIONSPassthroughOpenVPNoptions,e.g.openpynuk-o'--status /var/log/status.log --log /var/log/log.log'ConnectOptions:ConnectToASpecificServerOrAnyInACountry;TCPorUDP-sSERVER,--serverSERVERservername,i.e.ca64orau10-cCOUNTRY_CODE,--country-codeCOUNTRY_CODESpecifycountrycodewith2letters,i.e.au--tcpuseportTCP-443insteadofthedefaultUDP-1194

FilterOptions:FindSpecificTypesOfServers-aAREA,--areaAREASpecifyarea,citynameorstatee.g"openpyn au -avictoria"or"openpyn au -a 'sydney'"-mMAX_LOAD,--max-loadMAX_LOADSpecifyloadthreshold,rejectsserverswithmoreloadthanthis,DEFAULT=70-tTOP_SERVERS,--top-serversTOP_SERVERSSpecifythenumberoftopserverstochoosefromtheNordVPN’sserverlistforthegivencountry,thesewillbepinged,DEFAULT=10--p2pOnlylookforserverswith"Peer To Peer"support--dedicatedOnlylookforserverswith"Dedicated IP"support--torOnlylookforserverswith"Tor Over VPN"support--doubleOnlylookforserverswith"Double VPN"support--anti-ddosOnlylookforserverswith"Obfuscated"support--netflixOnlylookforserversthatareoptimisedfor"Netflix"DisplayOptions:TheseOnlyDisplayInformation-l[LIST_SERVERS],--list[LIST_SERVERS]IfnoargumentgivenprintsallCountryNamesandCountryCodes;Ifcountrycodesupplied("-l us"):DisplaysallserversinthatgivencountrywiththeircurrentloadandOpenVPNsupportstatus.Worksinconjunctionwith(-a|--area,andservertypes(--p2p,--tor)e.g"openpyn -l it --p2p --area milano"--statusShowlastchangeinconnectionstatus--statsShowOpenVPNconnectionstats

FirewallOptions:Firewall,KillSwitchandRouteOptions-f,--force-fw-rulesEnforcefirewallrulestodroptrafficwhentunnelbreaks,forcedisableDNStrafficgoingtoanyotherinterface-r,--add-routeAddroutetodefault-gateway;NeededtocontinueservinganyserviceincludingSSH.RequiredonVPSs.Toensureitdoesn’tleaktrafficuseitwith-fand--allow--allow-locallyTobeusedwith"-f"toallowinputtrafficonallportsfromlocallyconnected/INTERNALIPSUBNET.forexample192.168.1.*range--allowINTERNALLY_ALLOWED[INTERNALLY_ALLOWED...]Tobeusedwith"-f"toallowTCPconnectionstogivenportsbutONLYtoINTERNALIPRANGE.forexample:youcanuseyourPCasSSH,HTTPserverforlocaldevices(i.e.192.168.1.*range)by"openpyn us -f --allow 2280"--allow-configINTERNALLY_ALLOWED_CONFIGTobeusedwith"-f"toallowacomplexsetofallowportrules.ThisoptionrequiresapathtoaJSONfilethatcontainstherelevantconfig--allow-config-jsonINTERNALLY_ALLOWED_CONFIG_JSONTobeusedwith"-f"toallowacomplexsetofallowportrules.Thisoptionworksthesameas"--allow-config"optionbutacceptsaJSONobjectasastringinsteadTodofind servers with P2P support, Dedicated IPs, Anti DDoS, Double VPN, Onion over VPNutilise the frequently updated api at "api.nordvpn.com/server"clean exit, handle exceptionsstore credentials from user input, if "credentials" file exists use that insteadsane command-line options following the POSIX guidelinesability to store profiles (sort of works as the systemd service file stores last state)find and display server’s locations (cities)accept full country namescolourise outputmodularizecreate a combined config of multiple servers (on the fly) for auto failoveruninstall.sh # sudo pip3 uninstall openpynview status of the connection after launching in --daemon modedesktop notificationsinitd script for Asuswrt-merlin: "/opt/etc/init.d/S23openpyn start"