Package: riseup-vpn-configurator
riseup-vpn-configuratorRiseup offers Personal VPN service for censorship circumvention, location anonymization and traffic encryption. To make this possible, itsends all your internet traffic through an encrypted connectionto riseup.net, where it then goes out onto the public internet.Unlike most other VPN providers, Riseup does not log your IP address.Riseup has a VPN client calledRiseupVPN. This VPN client is super easy to use! You just install it and run it—no configuration, no account registration.There is already ariseup-vpnpackage in AUR. But there a few things I don't like:the software is pretty bloated (unnecessary GUI, I gotcould not find polkit agenterror messages)the autostart feature just put's a file into~/.config/autostartwhich doesn't work with i3the VPN does not use the best available crypto/ciphers (TLS1.2 instead of TLS1.3)it's not possible to exclude routes from the VPNThe riseup-vpn-configurator is a simple command line tool that tries to solve these problems. It generates an OpenVPN configuration file that can be used bysystemctl.InstallationPlease don't install it as user and run it as root, as this makes it very easy for an attacker to escalate privileges. You can install theArch Linux AUR packageor use it withpip install --user riseup-vpn-configuratoras root. Check out theHow to use itbelow to get the VPN up and running. You can start RiseupVPN withsystemctl start openvpn-client@riseupand autostart it withsystemctl enable openvpn-client@riseup. You can also start, stop and debug the VPN by using the--start,--stop,--restartand--logoptions. Please keep in mind that the client certificate is only valid for 90 and you have to update it manually.usage:riseup-vpn-configurator[-h][-v][--no-check-certificate][-d][-u][--uninstall][-l][-b][-c][-g][-s][--version]options:-h,--helpshowthishelpmessageandexit-v,--verboseshowverboseoutput--no-check-certificateskipsslcertificatecheck(usedby--updatetogettheconfig/clientprivatekeyfromtheAPI)-d,--default-configprintdefaultconfigfilerisup-vpn.yaml-u,--updateupdategatewaylistandclientcertificate/key--uninstallremoveallfilesin/opt/riseup-vpn-l,--list-gatewaysshowavailableVPNserver-b,--benchmarkusewith--list-pingsthegatewayandshowsthelatency-c,--check-configchecksyntaxof/etc/riseup-vpn.yaml.Generatesdefaultconfig-g,--generate-configGenerateopenvpnconfig(/etc/openvpn/client/riseup.conf)-s,--statusshowcurrentstateofriseup-vpn--startstartsopenvpnservice--stopstopsopenvpnservice--restartrestartsopenvpnservice--logshowsystemdlog--versionshowversionDefault config file/etc/riseup-vpn.yaml---
# /etc/riseup-vpn.yaml

server: vpn07-par.riseup.net
protocol: udp
port: 53

# excluded_routes: list servcies that should not be routed over VPN
# can be an ipaddress, network or hostname
# your local subnet is excluded by default
excluded_routes:
  - 8.8.8.8
  - 192.168.123.0/24
  - us02web.zoom.us

# os user/group
user: openvpn
group: openvpnHow to use itInstallation (as a dev)We need to run the tool with root permissions (for example to write to /etc). Running the tests also need root privileges (because we use chown). Therefore, I recommend running the dev environment also as root user.root@linbox:tmpgitclonehttps://github.com/kmille/riseup-vpn-configurator.git
root@linbox:tmpcdriseup-vpn-configurator
root@linbox:riseup-vpn-configuratorpoetryinstall
poetryrunpythonriseup_vpn_configurator/__init__.py--help
root@linbox:riseup-vpn-configuratorpoetryrunpytest-v-s-x--pdb
root@linbox:riseup-vpn-configuratorpoetryrunflake8--ignore=E501riseup_vpn_configurator/
root@linbox:riseup-vpn-configuratorpoetryrunmypyriseup_vpn_configurator/How it worksThe code for the RiseupVPN Linux client can be foundhere. It uses OpenVPN. Everyone uses the same client certificate/key to authenticate. The client certificate is only valid for 90 days. The VPN gateway list and client certificate can be fetched by a public API.Allow for non-root userkmilleALL=NOPASSWD:/usr/bin/riseup-vpn-configuratorMonitoring with py3statusIf you usepy3statusas i3bar implementation, you can usemonitor_riseupvpn.pyfor monitoring.Known issuesRiseupVPN does not support IPv6. It's routed over the tunnel but then gets blocked. Also, the VPN hangs after suspend (see Arch Wiki). To solve this issue, the AUR package usesopenvpn-reconnectas a dependency.Changelogv1.0.4: You can specify user/group in the config file. For the tests, use VPN_USER/VPN_GROUP env variables to overwrite the default (openvpn). Fixes#5