[SOLVED] PIA over Port 53 assistance please.

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
Egotistical
DD-WRT Novice


Joined: 29 Aug 2020
Posts: 10

PostPosted: Tue Sep 01, 2020 22:35    Post subject: [SOLVED] PIA over Port 53 assistance please. Reply with quote
PIA is confirmed up, running, and opperational... see following screen shots:

https://imgur.com/a/HzmwlpK


Now I would just like to get it to work with remote OpenVPN Port 53. I know this is possible from the PC side using PIA application, and that it removes all bandwith throttling as I have run extensive tests. I am hoping to accomplish this on my personal router as there is no application for setting up VPN on some of the devices I intend to use, such as gaming consoles. Here is what I have tried so far:

Use settings found at: https://www.privateinternetaccess.com/helpdesk/kb/articles/which-encryption-auth-settings-should-i-use-for-ports-on-your-gateways-2

and also using what little information I can gather here:https://www.reddit.com/r/PrivateInternetAccess/comments/gqdly2/ddwrt_port_53/
(note: the user in this Reddit post does not have NAT enabled as seen in their screenshot)

fails with the ca.rsa.2048 cert as well as ca.crt cert, please see the following screenshots:

https://imgur.com/a/indSHwe


TP-Link Archer C7 V5
Firmware: DD-WRT v3.0-r44236 std (08/22/20)


Any assistance with getting this to work would be greatly appreciated!


Last edited by Egotistical on Thu Sep 03, 2020 3:21; edited 1 time in total
Sponsor
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 8348

PostPosted: Wed Sep 02, 2020 4:38    Post subject: Reply with quote
The router doesn't care what destination port you need to use on the remote system. As long as it's the valid port for the OpenVPN server being hosted by PIA, it should work like any other remote port.

Also, those screenshots are too small for me to read.

If I had to guess, what's more likely the problem is that when using a different port, PIA has changed the certs and/or keys required for that port. Something you wouldn't typically notice when using their app.

_________________
DD-WRT: DNS Leak Detection w/ VPNs (updated 6/5/19)
ddwrt-ovpn-split-basic.sh (UPDATED!)
ddwrt-ovpn-split-advanced.sh (UPDATED!)
ddwrt-blacklist-domains.sh (UPDATED!)
ddwrt-ovpn-client-backup.sh
ddwrt-mount-usb-drives.sh
ddwrt-ovpn-remote-access.sh
ddwrt-pptp-policy-based-routing.sh
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 3862
Location: UK, London, just across the river..

PostPosted: Wed Sep 02, 2020 6:19    Post subject: Reply with quote
first have a read on this thread.. https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=326273

second regarding settings on the PIA app or PC you have to look for help on PIA forums or their support line...

than if you want to use any DNS port permitted by PIA on router level (you should know what port public servers allow)

you can specify port via DNSmasq (the default DDWRT DNS manager)

add those lines to advanced DNSmasq box

no-resolv
server=1.1.1.1#53

you can choose any other DNS server and allowed port to use...
do not confuse VPN ports with DNS

by default DNS servers used from router side are passed inside the VPN channel...at least it used to be like that, i haven't tried it recently, as i use Stubby for DNS over TLS....(you can see the link in my sig)...its working inside the VPN channel too...

p.s.
egc certs seems ok https://www.privateinternetaccess.com/helpdesk/guides/routers/dd-wrt-v40559-openvpn-setup ,but settings are mess, your settings are working well..

_________________
Atheros
TP-Link WR740Nv1 -----DD-WRT 44538 BS AP,NAT
TP-Link WR740Nv4 -----DD-WRT 44251 BS WAP/Switch
TP-Link WR1043NDv2 ---DD-WRT 44538 BS AP,NAT,AP Isolation,Firewall,Local DNS,Forced DNS,DoT,VPN,VLAN
TP-Link WR1043NDv2 ---DD-WRT 44538 BS AP,NAT,AD Block,Firewall,Local DNS,Forced DNS,DoT,VPN,VLAN
TP-Link WR1043NDv2 ---Gargoyle OS 1.12.0 AP,NAT,QoS,Quotas
Qualcomm/IPQ8065
Netgear R7800 -----DD-WRT 44538 BS AP,NAT,AD-Block,AP&Net Isolation,VLAN's,Firewall,Local DNS,DoT
Broadcom
Netgear R7000 -----DD-WRT 44538 BS AP,Wi-Fi OFF,NAT,AD-Block,Firewall,Local DNS,Forced DNS,DoT,VPN
-----------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 by mac913


Last edited by Alozaros on Wed Sep 02, 2020 9:34; edited 1 time in total
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6371
Location: Netherlands

PostPosted: Wed Sep 02, 2020 8:09    Post subject: Reply with quote
The picture is really small but I see you have a good connection on port 1198 with the settings I provided.

I have a limited experience with different ports i tried some and although they say that it should work for all of their servers this is not the case it is just a matter of trial and error some servers work with some ports others with other ports.

1198 UDP and TCP 502 with ca.rsa.2048.crt usually work

You can try port 53 but try different servers

For the fun I took a look their ca.crt it has a size 1024 and is expired so much for PIA.
Code:
20200902 09:55:33 N VERIFY ERROR: depth=1 error=certificate has expired: C=US ST=OH L=Columbus O=Private Internet Access CN=Private Internet Access CA emailAddress=secure@privateinternetaccess.com


Maybe they have a valid certificate somewhere else

Like I already said their current setup instructions are wrong (as of August 24th) I contacted their helpdesk and they say the are in a transitional state because of changing owner ship

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 3862
Location: UK, London, just across the river..

PostPosted: Wed Sep 02, 2020 9:39    Post subject: Reply with quote
as BS did some changes to OpenVPN recently, its always good to see what settings are in /tmp/openvpn/openvpn.conf
and then add/remove things in case they are needed/not needed...

_________________
Atheros
TP-Link WR740Nv1 -----DD-WRT 44538 BS AP,NAT
TP-Link WR740Nv4 -----DD-WRT 44251 BS WAP/Switch
TP-Link WR1043NDv2 ---DD-WRT 44538 BS AP,NAT,AP Isolation,Firewall,Local DNS,Forced DNS,DoT,VPN,VLAN
TP-Link WR1043NDv2 ---DD-WRT 44538 BS AP,NAT,AD Block,Firewall,Local DNS,Forced DNS,DoT,VPN,VLAN
TP-Link WR1043NDv2 ---Gargoyle OS 1.12.0 AP,NAT,QoS,Quotas
Qualcomm/IPQ8065
Netgear R7800 -----DD-WRT 44538 BS AP,NAT,AD-Block,AP&Net Isolation,VLAN's,Firewall,Local DNS,DoT
Broadcom
Netgear R7000 -----DD-WRT 44538 BS AP,Wi-Fi OFF,NAT,AD-Block,Firewall,Local DNS,Forced DNS,DoT,VPN
-----------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 by mac913
Egotistical
DD-WRT Novice


Joined: 29 Aug 2020
Posts: 10

PostPosted: Wed Sep 02, 2020 19:47    Post subject: Reply with quote
Okay, so I've done some poking around at some of their servers with nMap and found one that does have an open UDP Port 53:

PORT STATE SERVICE

53/udp open|filtered domain


So, I went in and used it to set up a new VPN connection with port 1198:

State
Client: CONNECTED SUCCESS

change to port 53 and I get the following error:

20200902 22:44:52 TLS: Initial packet from [AF_INET]156.146.41.129:53 sid=4b8b250e 90c10012
20200902 22:44:52 W WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
20200902 22:44:53 N VERIFY ERROR: depth=1 error=self signed certificate in certificate chain: C=US ST=OH L=Columbus O=Private Internet Access CN=Private Internet Access CA emailAddress=secure@privateinternetaccess.com
20200902 22:44:53 N OpenSSL: error:1416F086:lib(20):func(367):reason(134)
20200902 22:44:53 N TLS_ERROR: BIO read tls_read_plaintext error
20200902 22:44:53 NOTE: --mute triggered...
20200902 22:44:53 2 variation(s) on previous 3 message(s) suppressed by --mute
20200902 22:44:53 I SIGUSR1[soft tls-error] received process restarting
20200902 22:44:53 Restart pause 5 second(s)

So, it is absolutely the cert that is blocking this from working, but it works just fine using the desktop app, and cell phone app as well, releasing the bandwidth restrictions and allowing full access. So I guess, unless there is a valid certificate floating around for Port 53 somewhere, we are hosed on PIA using UDP 53 on the router... Any suggestions?
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6371
Location: Netherlands

PostPosted: Wed Sep 02, 2020 20:04    Post subject: Reply with quote
Contact PIA for a valid certicate
_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Egotistical
DD-WRT Novice


Joined: 29 Aug 2020
Posts: 10

PostPosted: Wed Sep 02, 2020 21:55    Post subject: Reply with quote
I have, and I am awaiting response now.


-------


Heard back:

Apologies as currently, UDP port 53 is not working on a router right no.

Hopefully we can get this back soon.

To use port 53, you can use the PIA client directly onto your devices.

Appreciate your understanding on this matter.

Let us know if you need anything else.

Best Regards,

Alyanna C.
Customer Support Agent

I'm not sure what "soon" is, but I may be looking for an alternative service, at least temporarily...
Egotistical
DD-WRT Novice


Joined: 29 Aug 2020
Posts: 10

PostPosted: Thu Sep 03, 2020 3:27    Post subject: Reply with quote
Okay, should be my last post for a while.

Went shopping around for another VPN that supported DD WRT, found one with a 7 day free trial: https://www.le-vpn.com/

Signed up, updated settings with the requirements from their website (with a few additional settings that I learned during this process) and bam,... success! Getting between 8-15MBPS on speedtest.net (I know, it's not the most accurate, but it was showing my throttled speeds prior as what the ISP was advertising so it is a confirmation of sorts)

Did a couple test-downloads on Steam and a torrent, averaging 2-4 MBPS on steam now (was 300-400kbps while throttled) and torrents getting up to 12MBPS.

Thank you, egc, Alozaros, and eibgrad for all the assistance with this learning experience!
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 6371
Location: Netherlands

PostPosted: Thu Sep 03, 2020 6:04    Post subject: Reply with quote
Nice make sure they also support Wireguard on a router.
Wireguard is a much faster VPN but does not support port 53

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard Server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard Client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum