A few months ago based on the laws being brought in around the snoopers charter and digital economy bill in the UK, I decided that I needed to start pushing most of my traffic over VPN.
The thing is I really don't want to run a VPN client for every …
I've been using systemd-networkd quite a bit recently, so this focuses on setting up the interfaces via that. I'm going to be setting up two VLANs on the router, 100 will be my protected vlan that will force all traffic via VPN and 200 will be a completely unprotected network that will go directly out over the WAN.
So lets get a DNS server set up for your network, I'm using unbound for this as it's way easier than setting up a recursive BIND server and really I'm not wanting to do anything advanced other than serve out DNS requests and maybe serve out a local zone.
We have a few requirements for VPN:
We want to aggregate VPN tunnels so we can use multiple of them on a per stream basis, mainly we want this because with more streams we can distribute CPU load.
Push all DNS traffic over the tunnels
Push all traffic from the protected VLAN (192.168.1.0/24) over the tunnels.
Any traffic going via the Unprotected VLAN goes directly out over the WAN.
I want to use two VPN providers, PIA and AirVPN for different purposes.
To give you a bit of a background as to how I'm collecting these metrics, I have a Graphite setup here with a Grafana frontend. I'm using a local collector on each of my boxes called Diamond which collects metrics every 5 seconds and reports this via statsdaemon into Graphite.