This post will demonstrate how to configure Unifi to route network traffic via ProtonVPN. These steps can be applied to other VPNs if they support OpenVPN or WireGuard.
Prerequisites:
<ul>
<li>You'll need a ProtonVPN account</li>
<li>You'll need access to your Unifi dashboard</li>
<li>You'll need to have a network setup in Unifi</li>
</ul>
I'll be using WireGuard with ProtonVPN however this will work with any VPN client that supports OpenVPN.
Steps for Creating WireGuard VPN Client Configuration:
1. Firstly login into your ProtonVPN account and go to downloads: <a href="https://account.protonvpn.com/downloads">https://account.protonvpn.com/downloads</a>
2. Once there scroll down to the WireGuard Configuration section: <a href="https://account.protonvpn.com/downloads#wireguard-configuration">https://account.protonvpn.com/downloads#wireguard-configuration</a>
3. Fill in the first 3 options as follows:
<ul>
<li>Device/Certificate Name: Choose a meaningful name, like Proton Secure Core UK</li>
<li>Select Platform: Choose GNU/Linux</li>
<li>Select VPN Options: Choose Block malware, ads and trackers (leave VPN Accelerator selected)</li>
<li>Your setup should look like: <img src="//images.ctfassets.net/ifshb5hrrgy8/48oGS63rzN8goQDNP0jzeZ/7cf45cfc2fccf37ff8033a9334520d16/image.png" alt="WireGuard Configuration Screen"></li>
</ul>
<ol start="5">
<li>For option 4 Select a server to connect to: Choose Secure Core configs and then select a country closet to your location to reduce latency.</li>
<li>Click Create and store the file for later use in Unifi</li>
</ol>
Steps for Creating VPN routing in Unifi:
1. Login to your Unifi dashboard and navigate to the VPN client page: <a href="https://unifihost/network/default/settings/vpn/client">https://unifihost/network/default/settings/vpn/client</a>
<ul>
<li>Navigate to settings</li>
<li>Then VPN</li>
<li>Then VPN Client
<img src="//images.ctfassets.net/ifshb5hrrgy8/2r1qTETm9YsUDDQy4RPrmT/b182deaf7b554d2cbb8006a333189efb/image.png" alt="Unifi VPN Client Page"></li>
</ul>
<ol start="2">
<li>Ensure that the WireGuard option is selected for the VPN Type</li>
<li>Give the VPN client a suitable name</li>
<li>Ensuring that the File option is selected in Setup click Upload and selected the <code>.conf</code> file that was downloaded from ProtonVPN <ul>
<li>The screen will update with the config info
<img src="//images.ctfassets.net/ifshb5hrrgy8/4dbKhnrVJgiRUklWQPfL9a/92882d6f5b9c2494b6e01da2d3086fbd/image.png" alt="Unifi VPN Client Config Upload"></li>
<li>Hit Apply Changes </li>
<li>Supply your credentials for ProtonVPN</li>
</ul></li>
<li>It make take a couple of minutes but your VPN client should be Connected
<img src="//images.ctfassets.net/ifshb5hrrgy8/3ecZGNgev3v6s5SBnEx8jg/cf35e133c028ad9c65bf0ef1c9a07fe9/image.png" alt="Unifi VPN Client Connected"></li>
</ol>
Now that we successfully created the VPN client with Unifi we now need to route traffic from our network into that VPN. There are many possible options when it comes to routing traffic via the VPN, however for this post I will be routing the entire traffic from a network via the VPN.
Steps for routing network traffic via a VPN in Unifi:
(These next steps assume that you have created private networks within Unifi already)
1. Firstly navigate to the routing page: <a href="https://_unifihost">https://_unifihost</a>/network/default/settings/routing_
<ul>
<li>This can be found by going to Settings</li>
<li>Then going to routing</li>
</ul>
<ol start="2">
<li>Click Create Entry<ul>
<li>You should see a screen similar to the below:
<img src="//images.ctfassets.net/ifshb5hrrgy8/72T3Kqt5dMg04jsazAeoJe/49413620b9df48c0d97a3e4dad765cdb/image.png" alt="Unifi Routing Page"></li>
</ul></li>
<li>For What to Route? leave All Traffic. For the other options select the following:<ul>
<li>For Device/Network select the name of the network that you want to force VPN traffic through</li>
<li>For Interface select the Client VPN Connection that was setup in the previous steps</li>
<li>Give a meaningful description for this route
<img src="//images.ctfassets.net/ifshb5hrrgy8/5hAZu7rMGL9WPrpKRP7Tay/712255ab80fcfc44ab64fc8eaec4dcbc/image.png" alt="Unifi Route via VPN Creation"></li>
<li>Then select Add Entry</li>
</ul></li>
</ol>
That network should now be routing traffic via the VPN (you may need to wait a while for the connection to take effect). 
You should be able to verify your VPN connection by visiting <a href="https://whatismyipaddress.com/">https://whatismyipaddress.com/</a> from a device connected to that network and confirming that it's an IP issued from ProtonVPN

Configuring Unifi to route network traffic via Proton VPN

Configure Proton VPN in Unifi

When running my legacy pipeline on Azure devops I ran into the following issue when running AZCopy.
<pre><code class="language-bash">2020-11-15T12:30:03.1523563Z ##[error]Upload to container: 'css' in storage
account: 'tmdn' with blob prefix: '' failed with error: 'AzCopy.exe exited with
non-zero exit code while uploading files to blob storage.' For more info please
refer to https://aka.ms/azurefilecopyreadme 
</code></pre>
<hr>
After some investigation I discovered that I had to apply the following roles to the service principal at the Storage Account IAM level:
<ul>
<li>Storage Blob Data Contributor</li>
<li>Storage Blob Data Owner</li>
</ul>
Once the above roles were applied the issue was resolved and I was able to copy items into Azure Storage.

Solving the Azure Copy permissions by ensuring that the correct roles are applied to the service principal at the storage account IAM level.

Azure Copy Permissions Error

I decided to setup my local NAS server using a raspberry Pi and a USB connected SSD. This will involve installing and configuring samba on the raspberry Pi to allow access from Windows.
Here are the steps I followed in order to get everything working.
<ul>
<li>If your setting up your raspberry Pi for the first time, install the <a href="https://www.raspberrypi.com/software/">Raspberry Pi Imager</a> which will allow you to install the Raspberry Pi OS (aka Raspbian) onto an SD card.</li>
<li>Once you installed the Raspberry Pi Imager install the latest headless (aka desktop free) software. Ensure that you give your Pi a hostname and enable SSH.</li>
<li>Connect your raspberry Pi to your network. My raspberry Pi has the <a href="https://www.raspberrypi.com/products/poe-hat/" title="PoE hat">PoE hat</a> hence once I connect it to my network via Ethernet it will recieve power. </li>
<li>Connect your external SSD drive ensuring that it has been formatted correctly. SSH to your pi and run the following to determine whether your SSD has connected: </li>
</ul>
<code>sudo lsblk -o UUID,NAME,FSTYPE,SIZE,MOUNTPOINT,LABEL,MODEL</code>
<ul>
<li>You should see a similar result to this:</li>
</ul>
<img src="//images.ctfassets.net/ifshb5hrrgy8/4tOw3ZBDf9IygaKxp29Cam/4ad31eac608abba88e28d6b7c8ca565d/image.png" alt="List Disks">
<ul>
<li>You should be able to see your drive in the list, take note of the path at the beginning and the label.</li>
<li>You'll need to create a folder of the location where you would like to mount your external device<ul>
<li><code>sudo mkdir /mnt/main-share-1</code></li>
</ul></li>
<li>Mount the external drive onto the share locations.<ul>
<li><code>sudo mount /dev/sda2 /mnt/main-share-1</code></li>
</ul></li>
<li>Change permissions on /mnt directory<ul>
<li><code>sudo chmod 775 /mnt/main-share-1</code></li>
</ul></li>
<li>Create a separate user for accessing the media files. Follow all the steps in the user creation wizard.<ul>
<li><code>sudo adduser mediapi</code></li>
</ul></li>
<li>List the users just to confirm that the creation went successfully
<img src="//images.ctfassets.net/ifshb5hrrgy8/3fGFDA2rzZWs2EMzhIpa4a/47cf701e46ede52b0506ec2a25ea3e42/image.png" alt="List users"></li>
<li>Install samba and then backup the config<ul>
<li><code>sudo apt install samba</code></li>
<li><code>sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bk</code></li>
</ul></li>
<li>Edit samba config<ul>
<li><code>sudo nano /etc/samba/smb.conf</code></li>
</ul></li>
<li>Add the share info at the bottom</li>
</ul>
<pre><code> [main-share-1]
 comment = Samba on Ubuntu
 path = /mnt/main-share-1
 read only = no
 browsable = yes
</code></pre>
<ul>
<li>Then save the file</li>
<li>Restart samba server<ul>
<li><code>sudo service smbd restart</code></li>
</ul></li>
<li>Update firewall rules to allow samba<ul>
<li><code>sudo ufw allow samba</code></li>
</ul></li>
<li>Setup samba user <ul>
<li><code>sudo smbpasswd -a mediapi</code></li>
</ul></li>
</ul>
The NAS configuration is complete and you should be able to access the server from a Windows PC.
<ul>
<li>Go to your Windows PC and open a run dialog and type in the IP address followed by the share path in the UNC format:</li>
</ul>
<img src="//images.ctfassets.net/ifshb5hrrgy8/0DZuHAS7Kq8Ik0RccTK4m/15211d0104b20a3d4a8017246f3762db/image.png" alt="UNC share for NAS drive">
If you want you can add the network location share permantley in Windows.

Creating a NAS drive can be a simple affair however maintainability becomes an issue when you are beholden to specific OEMs. An alternative is to try and configure your server as much as possible using this method of a Pi and a SSD.

M is for Mackolicious

Developer

Blogger

Services