Riseup offers Personal VPN service for censorship circumvention, location anonymization and traffic encryption. To make this possible, it sends all your internet traffic through an encrypted connection to riseup.net, where it then goes out onto the public internet.
Unlike most other VPN providers, Riseup does not log your IP address.
Riseup has a VPN client called RiseupVPN. This VPN client is super easy to use! You just install it and run it—no configuration, no account registration.
There is already a riseup-vpn package in AUR. But there a few things I don't like:
- the software is pretty bloated (unnecessary GUI, I got
could not find polkit agent
error messages) - the autostart feature just put's a file into
~/.config/autostart
which doesn't work with i3 - the VPN does not use the best available crypto/ciphers (TLS1.2 instead of TLS1.3)
- it's not possible to exclude routes from the VPN
The riseup-vpn-configurator is a simple command line tool that tries to solve these problems. It generates an OpenVPN configuration file that can be used by systemctl
.
Please don't install it as user and run it as root, as this makes it very easy for an attacker to escalate privileges. You can install the Arch Linux AUR package or use it with pip install --user riseup-vpn-configurator
as root. Check out the How to use it
below to get the VPN up and running. You can start RiseupVPN with systemctl start openvpn-client@riseup
and autostart it with systemctl enable openvpn-client@riseup
. You can also start, stop and debug the VPN by using the --start
, --stop
, --restart
and --log
options. Please keep in mind that the client certificate is only valid for 90 and you have to update it manually.
usage: riseup-vpn-configurator [-h] [-v] [--no-check-certificate] [-d] [-u] [--uninstall] [-l] [-b] [-c] [-g] [-s] [--version]
options:
-h, --help show this help message and exit
-v, --verbose show verbose output
--no-check-certificate
skip ssl certificate check (used by --update to get the config/client private key from the API)
-d, --default-config print default config file risup-vpn.yaml
-u, --update update gateway list and client certificate/key
--uninstall remove all files in /opt/riseup-vpn
-l, --list-gateways show available VPN server
-b, --benchmark use with --list - pings the gateway and shows the latency
-c, --check-config check syntax of /etc/riseup-vpn.yaml. Generates default config
-g, --generate-config
Generate openvpn config (/etc/openvpn/client/riseup.conf)
-s, --status show current state of riseup-vpn
--start starts openvpn service
--stop stops openvpn service
--restart restarts openvpn service
--log show systemd log
--version show version
Default config file /etc/riseup-vpn.yaml
---
# /etc/riseup-vpn.yaml
server: vpn07-par.riseup.net
protocol: udp
port: 53
# excluded_routes: list servcies that should not be routed over VPN
# can be an ipaddress, network or hostname
# your local subnet is excluded by default
excluded_routes:
- 8.8.8.8
- 192.168.123.0/24
- us02web.zoom.us
# os user/group
user: openvpn
group: openvpn
We need to run the tool with root permissions (for example to write to /etc). Running the tests also need root privileges (because we use chown). Therefore, I recommend running the dev environment also as root user.
root@linbox:tmp git clone https://github.com/kmille/riseup-vpn-configurator.git
root@linbox:tmp cd riseup-vpn-configurator
root@linbox:riseup-vpn-configurator poetry install
poetry run python riseup_vpn_configurator/__init__.py --help
root@linbox:riseup-vpn-configurator poetry run pytest -v -s -x --pdb
root@linbox:riseup-vpn-configurator poetry run flake8 --ignore=E501 riseup_vpn_configurator/
root@linbox:riseup-vpn-configurator poetry run mypy riseup_vpn_configurator/
The code for the RiseupVPN Linux client can be found here. It uses OpenVPN. An API gives you valid OpenVPN cient credentials (certificate + key) for authentication. The client certificate is only valid for 90 days, so you have to run --update
once in a while. The VPN gateway list and client certificate can be fetched by a public API.
kmille ALL = NOPASSWD: /usr/bin/riseup-vpn-configurator
If you use py3status as i3bar implementation, you can use monitor_riseupvpn.py for monitoring.
RiseupVPN does not support IPv6. It's routed over the tunnel but then gets blocked. Also, the VPN hangs after suspend (see Arch Wiki). To solve this issue, the AUR package uses openvpn-reconnect as a dependency. The official Linux clients add firewall rules. This client does not touch your firewall.
v1.0.4: You can specify user/group in the config file. For the tests, use VPN_USER/VPN_GROUP env variables to overwrite the default (openvpn). Fixes #5