FreshTomato (OpenVPN Setup)

This tutorial will walk you through configuring an OpenVPN connection using Private Internet Access (PIA) server files on a router using FreshTomato firmware version 2022.5.

Jump To…

• Step 1: Download the OpenVPN Configuration File
• Step 2: Router Timezone Settings
• Step 3: Set Up the OpenVPN Connection
• Step 4: Verify the VPN Connection

Step 1: Download the OpenVPN Configuration File

Download the OpenVPN configuration set you want to use:

• Default
• Strong
• Static IP
• TCP
• Strong TCP

Note: To learn more about these available configurations, please read this guide.

Also, extract the server location file you plan on using and open it with a text editor. You will need the information in that file when setting up the VPN connection. This tutorial uses the US West server file from the Default collection set. 

Step 2: Router Timezone Settings

You need to make sure you are using the correct timezone settings for your location. Otherwise, you may experience connectivity issues. 

To configure timezone settings: 

1. Sign into your router dashboard. 
2. Navigate to Basic > Time. 
3. From the Time Zone dropdown menu, select your real local timezone. 
4. From the NTP Time Server dropdown menu, select the server you want to use. One that is closer to your physical location is better for an optimal connection.
5. When done, click Save. 

Step 3: Set Up the OpenVPN Connection

Navigate to VPN Tunneling > OpenVPN Client > Client 1. You will now have to input and adjust settings in the Basic, Advanced, and Keys tabs:

Basic

1. Click the Basic tab. 
2. Click the Enable on Start option. This ensures the VPN connection starts up whenever you turn on the router. 
3. For Protocol, select the communication protocol option that matches your OpenVPN server configuration file. You can see if UDP or TCP is used on the proto line. 

4. For Server Address/Port: 

• Enter the server name from the OpenVPN file, which is located on the remote line. This guide uses us3.privacy.network.
• Input the port number found on the remote line in the OpenVPN server file, right after the server hostname. 

5. Next, check the Username/Password Authentication option to reveal the input for those fields. Then, enter the following details: 
   • Username: Enter your PIA username, which follows the p1234567 format.
   • Password: Enter your PIA password. 
6. From the Auth digest dropdown menu, select the option that matches the auth row in your OpenVPN server file. In our case, it was the SHA1 option.

7. Click Save when done. 

Advanced

1. Click the Advanced tab. 
2. From the Redirect Internet traffic dropdown menu, select All. This ensures the VPN connection will redirect all web traffic to the VPN tunnel. 
3. From the Accept DNS configuration dropdown menu, select Relaxed. This allows the VPN connection to accept DNS configurations from the VPN server. 
4. Check the Verify Certificate option to prevent potential spoofing of the VPN server. 
5. In the Custom Configuration field, copy-paste the following lines:
   • resolv-retry infinite
   • nobind
   • persist-key
   • persist-tun
   • cipher aes-128-cbc
   • tls-client
   • verb 1
   • reneg-sec 0
   • disable-occ
6. Click Save. 

Keys

1. Click the Keys tab. 
2. In the Certificate Authority field, copy-paste the certificate found in your OpenVPN configuration file. It’s a string of characters contained between the <ca> and </ca> lines. Make sure you include the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

3. When done, click Save. 
4. Finally, click Start Now to initiate the VPN connection.

Step 4: Verify the VPN Connection

To see if the VPN connection is active, navigate to VPN Tunneling > OpenVPN Client > Client 1 > Status. To make sure the connection is running well, use PIA’s IP checker tool to make sure the VPN connection is working well. Verify if the Location field matches your chosen OpenVPN server location. 

Note: If you experience connectivity issues, repeat the steps above. If the problem persists, try using a different OpenVPN configuration set or server file.