S14 tunnel
https://e2h.totalism.org/e2h.php?_=X-s14-net


local/ S14 machine

ssh tunnel@10.94.185.76
sudo openvpn --config /home/tunnel/client.conf


HOW TO START OPENVPN ON REBOOT?
https://www.smarthomebeginner.com/configure-openvpn-to-autostart-linux/

sudo openvpn --config <client-name>.ovpn 
Initialization Sequence Completed

####################################
# Run client openvpn as daemon in the background - see `man openvpn` for more options
sudo openvpn --config <client-name>.ovpn --daemon

To stop the daemon:
# Find the daemon process
pgrep -lf openvpn

# Kill the process
sudo kill <process number>

# Run client openvpn in the foreground for troubleshooting the tunnel:
sudo openvpn --config <client-name>.ovpn 
if your verbosity in the client conf file is set to 4, then stdout of the above command should end with
Initialization Sequence Completed

# Run client openvpn systemd unit file:
Copy your client conf file to /etc/openvpn/client/ directory

in this way you can stop, start and check status of the vpn with the systemctl command:
e.x if your client file is called myvpn.conf, then the command goes:

sudo systemctl start|stop|status openvpn-client@anarcha.service

(All system unit files are in /lib/systemd/system/)

Explanation:
the system unit script is in /lib/systemctl/system/openvpn-client@.service
whatever name you put between openvpn-client@ and .service is passed inside this unit file.
This unit file which changes dir to /etc/openvpn/client and executes openvpn --config <name>.conf

# Run server openvpn systemd unit file:
sudo systemctl start|stop|status openvpn@server.service

#Check tunnel is up
sudo ifconfig
ip addr show dev tun0
tun0 should appear


Ping from your pi the server's tun0 IP 10.8.0.1
ping  10.8.0.1
traceroute 10.8.0.1

From your pi run ifconfig and find your  tun0 IP, 
let's say it's 10.8.0.10

Ping from the anarchaserver your pi_tunnel_ip

SSH to tunnel pi from anarchaserver (2 ways)
1. edit /root/.ssh/config and update the Hostname IP to match the one of the pi's tun0
(once pi gets a dns or a static IP we won't have to edit this config file)
then do: ssh tunnel-pi
2. OR do: ssh tunnel@1.8.0.10 
OK*

copy files 

MOUNT HARD DRIVE
tunnel@<pi_tunnel_ip>:/mnt/S14-backup
tunnel@<pi_tunnel_ip>:/mntmeme_bak

STORAGE
Mount disks 

NAS
http://water.local:5000/
sudo mount.cifs -o user=tunnel,password=*****,uid=1001,rw,vers=2.0 //10.94.185.9/web/anarcha /mnt/S14-backup
/mnt/S14-backup

DISK
sudo mount /dev/sda1 /mnt/meme_bak

HOW TO DO THAT IN STARTUP?
add the above mount command in /etc/fstab (double check online tips)
to tell where the storage device will be automatically mounted when the Raspberry Pi starts up.
https://www.raspberrypi.org/documentation/configuration/external-storage.md

REF: 
    https://confluence.jaytaala.com/display/TKB/Mount+drive+in+linux+and+set+auto-mount+at+boot
    https://kwilson.io/blog/force-your-raspberry-pi-to-mount-an-external-usb-drive-every-time-it-starts-up/
    https://raspberrypi.stackexchange.com/questions/46171/how-do-i-mount-my-nas

# DISK
 In the fstab file, the disk partition is identified by the universally unique identifier

sudo blkid

ADD
UUID=a164f220-cc96-450f-aa4a-27849ed21d44       /mnt/meme_bak   ext4    defaults,auto,users,rw,nofail   0       0 

# mount cloud 
NAS

ADD
//10.94.185.9/web/anarcha       /mnt/S14-backup cifs    user=tunnel,password=****,uid=1001,rw,iocharset=utf8,vers=2.0        0       0 


Next challenge
HOW TO REACH NAS water from the browser when tunnel is UP
Need to mount NAS water on startup with adding the mount command also in /etc/fstab
Register a domain name for the pi and either request from your internet provider a fixed IP
or run a script in pi to update the dns service reqularly with its dynamic public IP. (mara has done the latter with her pi)
install samba server on pi, or apache2, or nginx to serve content of the mounted disks
Edit the /etc/openvpn/server.conf to push traffic to pi IP subnet. (lines 134- 140)
The user's device which wants to reach pi or NAS via the browser, needs also to install openvpn and a client certificate 


FIND tunnel pi IP when outside the house 
You need to know the CN in your certificate, Lookup the line starting with Subject: located in the file .cert or in the client conf if all keys and certs are bundled within.
E.x Subject: C=SP, ST=Catalunya, L=Barcelona, O=AnarchaServer, OU=AnarchaServer, CN=FutureVintage/name=EasyRSA/emailAddress=anarchaserver@autistiche.org
SSH to anarcha, and do: tail /var/log/openvpn.log
search for the CN name, in our example FutureVintage, and check the IP
In our example in openvpn.log it looks like:
    Fri Feb  7 21:14:57 2020 us=535934 MULTI: Learn: 10.8.0.10 -> FutureVintage/5.135.58.235:50855


LATER
# Add local subnet to vpn
https://openvpn.net/community-resources/how-to/#pki
https://community.openvpn.net/openvpn/wiki/FAQ
https://forums.openvpn.net/viewtopic.php?t=14358
https://openvpn.net/archive/openvpn-users/2007-09/msg00094.html

# Enable two-way traffic client-server
Reach OpenVPN clients directly from a private network
https://openvpn.net/vpn-server-resources/reach-openvpn-clients-directly-from-a-private-network/

diagram
https://e2h.totalism.org/e2h.php?_=X-s14-net