UM3 Remote Monitoring Raspberry Pi VPN Tutorial

[Nicolinux 288]

DISCLAIMER: I created this tutorial and I wanted to share with you how you can set up a VPN connection. It is not an official Ultimaker tutorial. It should be pretty safe, but any attempt is at your own risk. Proceed with caution (and common sense).

 

Introduction

The new Ultimaker iOS and Android apps allow you to connect to an Ultimaker 3 printer and monitor its print state providing a live preview through the printer's built-in camera. The apps need to be connected to the same network as the printer in order to access it. To overcome this restriction and to be able to remotely monitor the printer from anywhere in the world, one can create a VPN tunnel and connect through it to the printer.

Arguably a VPN is not only useful for printer remote monitoring because it basically allows you to create a secure tunnel into your home network and relay all network traffic from your connected device (smartphone or computer) through the VPN. There are numerous benefits using a VPN. Accessing the internet from insecure locations like internet cafe's or airports can be dangerous and a VPN helps to mitigate the risks.

There are no advantages without disadvantages, though. You need to guard your VPN connection credentials or else anybody who has access to them, could break into your home network which can result in all kinds of privacy issues.

This guide is divided into three parts. The overview provides a birds-eye view of the entire structure. The preparation lists all components that need to be downloaded and/or procured. The implementation proceeds with the installation process.

 

Overview

A VPN needs an active component to run the software which accepts connections from your devices. Any inexpensive computer which is able to run Linux would do. In this guide, we are using the popular Raspberry Pi - the credit card sized single-board computer for this task. The VPN software is powered by OpenVPN, another popular component. OpenVPN is a very capable tool but it is not easy to set up. For this reason, another helper needs to be employed. PiVPN is a set of scripts which make it easy to setup OpenVPN on the Raspberry Pi.

Conceptually all components present in this guide are depicted in the following image.

You initiate a connection from your device of choice and connect to your home network through the VPN tunnel. Your router at home (usually, the one that has been provided to you by your internet service provider), forwards the connection to the Raspberry Pi "PiVPN". After the connection has been established, your device joins the home network and you are ready to use the Ultimaker app(s).

 

Preparation

 

Hardware

There are several revisions of the Raspberry Pi available. Except for the Raspberry Pi 1 Model A+, any of the other recent models are suitable.

 

• Raspberry Pi models
  

 

You can find many kits on Amazon. Depending on the way you want to connect the Raspberry Pi to your home network, you are either set with an ethernet cable or you need to purchase a wifi usb dongle.

If you are looking for a complete solution, take the Raspberry Pi 3 into account. Alternatively, the Raspberry Pi Zero is a very low-cost option. It costs around 5$ (without a wifi dongle and power supply). Now that the Raspberry Pi Zero W has been released, this is the best/chepest option because it provides a cheap solution (around 10$) and features a wifi chip built in.

 

Note

Not all wifi usb dongles are easy to setup. Except from the official Raspberry Pi dongle, the one from Edimax seems to work fine:

 

• https://www.amazon.com/Edimax-EW-7811Un-150Mbps-Raspberry-Supports/dp/B003MTTJOY/
  
• https://www.amazon.com/Official-Raspberry-Pi-WiFi-dongle/dp/B014HTNO52/
  

 

The Raspberry Pi needs a way to store its files. Depending on the model you choose, don't forget to get either a sd card or a micro-sd card. Any size above 4GB is fine.

 

Software

These are all software tools needed in this guide:

 

1. Raspbian - Linux Distribution for the Raspberry Pi
   
2. Etcher - flash Raspbian to sd card
   
3. Atom - proper text editor
   
4. Putty - connect to the Raspberry Pi via ssh (Windows only)
   
5. Ultimaker App
   
6. OpenVPN Client
   

 

 

1. Raspbian

Here you'll have two choices. Download the full "Jessie with Pixel" version or just the "Jessi Lite" version. The difference is the easier network setup if you choose to connect the Raspberry Pi via wifi with the full version.

 

• https://www.raspberrypi.org/downloads/raspbian
  

 

 

2. Etcher

After downloading Raspbian, you will need to flash the big .zip file (which includes a Linux system/image). Etcher is an open source tool which is very easy to use and available for all major operating systems.

 

• https://etcher.io
  

 

 

3. Atom

If you are going to edit configuration text files, better use a proper editor. Atom is available for all major operating systems for free.

 

• https://atom.io
  

 

 

4. Putty

After the sd card is ready, you will need to power up the Raspberry Pi and connect to it via SSH. Windows lacks an SSH client and therefore you need to use Putty.

 

• http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
  

 

 

5. OpenVPN Client

The OpenVPN Client is used to create the network connection between your smartphone and the Raspberry Pi within your home network.

 

• iOS - https://itunes.apple.com/us/app/openvpn-connect/id590379981?mt=8
  
• Android - https://play.google.com/store/apps/details?id=net.openvpn.openvpn
  

 

 

6. Ultimaker Apps

Finally, the Ultimaker app can be used to access the printer.

 

• https://ultimaker.com/en/products/ultimaker-3-app
  

 

 

Implementation

 

Prepare the sd card

Depending on the way you want to connect the Raspberry Pi to your home network, there are two options available:

 

1. Connect the Raspberry Pi via an ethernet cable
   
2. Connect the Raspberry Pi via wifi
   

 

If you choose approach Nr. 1. - you should download the Raspbian lite image.

For approach Nr. 2. - you should download the bigger image with Pixel. The reason behind these choices and especially the one involving downloading a much bigger Raspbian image is that once the Raspberry Pi is powered up and you don't have a keyboard and monitor attached to it, there is no easy way to access the Raspberry Pi. If you have chosen wifi to connect the Raspberry Pi and you are on Windows or Mac and don't want to go through the hoops to install additional (and potentially dangerous software), you are better off with the bigger image. This one allows you to edit a simple text file which will setup the wifi access. The downside of the bigger image is that it will install a non-lightweight desktop-like system on the Raspberry Pi.

If you are on Linux, you are lucky since you can already edit the file with wifi access credentials and the lite Raspbian image is fine.

If you are on Mac and want to go through the ordeal of accessing "Linux type partitions" (ext2), you need to install the following additional packages on your Mac before downloading the lite image:

 

• https://osxfuse.github.io
  
• https://github.com/osxfuse/osxfuse/wiki/Ext
  

 

The reason behind all this is that the full image supports putting the wifi network configuration on the /boot partition which is easily accessible from any operating system. The lite image lacks this feature and expects the wifi network configuration in /etc/wpa_supplicant/wpa_supplicant.conf which sadly resides on a partition of the type ext3/ext4 which can not be accessed easily from Mac or Windows (hence the additional software). Newer Raspbian releases might fix this problem and accept the wifi configuration on the /boot partition.

After downloading Raspbian, you need to flash the resulting file (at the time of writing this was 2017-03-02-raspbian-jessie-lite.zip) with Etcher to the sd card. Insert the sd card into your computer, start Etcher and select the .zip file you have downloaded. Be aware that all contents of your sd card will be erased! Pay attention to the device Etcher selects as the sd card.

 

Network configuration

 

Note

If you are using an ethernet cable to connect the Raspberry Pi, you can skip this step and continue with "Powerup".

 

Wifi

If you are on Linux (or if you are on Mac and have installed the FUSE tools mentioned earlier), insert the sd card into your computer and select the second mount (not /boot). Then edit the /etc/wpa_supplicant/wpa_supplicant.conf file.

Add your wifi network credentials to it:

 

network={       ssid="Your wifi network name"       psk="your wifi network password"}

 

If you have downloaded and flashed the full Raspbian image, insert the sd card into your computer, select the device with the /boot label and create a text file on it named wpa_supplicant.conf.

The file needs to have the following content:

 

country=GBctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdevupdate_config=1network={       ssid="Your wifi network name"       psk="your wifi network password"}

 

Here you need to fill in your wifi network name and its password.

 

Note

Remember to use the Atom editor for this task.

 

Powerup

Safely remove the sd card and insert it into the Raspberry Pi. Turn it on and wait for a minute or two. If you don't have a monitor attached to it, you need to find out which IP address the Raspberry Pi was assigned so you can connect to it via SSH.

The easiest way to do that is to login into your router (the one your internet service provider most likely provided) and take a look at the list of DHCP clients. There are many router models out there and they all have different web interfaces.

On a FritzBox (very popular in Germany), the interface looks like this:

Watch out for a device bearing "raspberry" in its name, or for any unusual devices and note down the IP address.

For the rest of the tutorial, the following IP address will be used 192.168.0.100. Please make sure to replace it with the one you wrote down.

 

Note

When you need to enter commands in the terminal while connected to the Raspberry Pi, the command to be entered is denoted/indicated by an # sign. Do not type this sign, just ignore it. If you get errors like "permission denied", then precede your commands with the sudo command. Example:

 

# sudo reboot

 

 

Connect to the Raspberry Pi

If you are using Mac or Linux, start a new terminal and connect to the Raspberry Pi.

 

• username: pi
  
• password: raspberry
  

 

Enter the following in your terminal:

 

# ssh -lpi 192.168.0.100

 

For Windows use Putty to connect to the Raspberry Pi. Enter the IP address 192.168.0.100 in the "Hostname (or IP address)" field. Remember to use the IP you wrote down earlier.

In both cases, you should see a warning / question which prompts you to add / save the key. This is fine and can be accepted.

 

Note

If you can't connect to your Raspberry Pi, it could be that SSH access is disabled. Turn off the Raspberry Pi, remove the sdcard, insert in into your computer and access the boot partition/drive. There just create an empty text file named ssh.txt. Eject the sdcard, put it back into your Raspberry Pi and try again to access it via SSH.

 

Start the VPN Configuration

As soon as you successfully logged in, you can start the PiVPN installation. You can read more about the PiVPN project on its official homepage:

 

• http://www.pivpn.io
  

 

Start the installation with the following command and press enter:

 

# curl -L https://install.pivpn.io | bash

 

You will see the following screen:

Press enter to select "OK"

 

Static IP

On the next three screens you will be informed that the OpenVPN software needs a static IP address in order to work correctly. There is some accompanying info to that:

 

Network Interface

Next up you need to select a network interface. Choose here the same connection type you have decided to connect the Raspberry Pi to your home network (cable or wifi)

 

• eth0 - cable
  
• wlan0 - wifi
  

 

 

User and Upgrades

Now you need to select an user. There is nothing else to do other than to confirm with enter:

On the next two screens, you are asked to enable unattended upgrades. You can select either here, just make sure you are comfortable with your choice:

 

Network Protocol and Port

The next two screens concern the network protocol and port for the OpenVPN server. You can accept the defaults here:

After you have selected the protocol and port, fire up a web browser and connect to your router in order to forward that port to your Raspberry Pi. Depending on the router brand, you need to look for the "Forwarding" configuration. Once there, enter the IP address and the port and protocol you chose earlier. If you are unable to find the forwarding configuration on your router, usually a quick Google search helps "your router model + port forwarding".

 

Encryption (takes a LONG time)

Now you need to select the encryption strength. You can accept the default here.

 

Note

This will take a very long time (more than half an hour):

 

Public IP or Hostname

OpenVPN needs to be publicly available from the Internet. If you know that your internet service provider offers you a static IP address, then you can accept the first choice. Otherwise it is recommended to create a Dynamic DNS hostname. There are several online services which offer dynamic hostnames for free. Before you select one, make sure it is supported by your router. Login to your router and look for "Dynamic DNS" or "DnyDNS". Most routers these days support at least DynDNS or No-IP.com. After you have created a dynamic hostname, enter the details into your router's web management interface and select "DNS Entry" here:

 

• http://www.noip.com
  

 

You will then be asked to provide your dynamic hostname.

The next screen asks you about the external DNS server. You can accept the default here.

 

Make it so

You are almost done. Confirm the next two screens and wait until the Raspberry Pi reboots.

 

Add an OpenVPN Client

After the Raspberry Pi is accessible again, connect to it via SSH. Now it is time to add a new VPN client. Enter the following command:

 

# pivpn add

 

You will be asked to select a name and a password. If you don't want to use a password, enter:

 

# pivpn add nopass

 

The implication of choosing a password (or not), is that later on, every time you want to connect to your home network, the OpenVPN client on your smartphone or computer will ask for that password.

PiVPN informs you that the configuration file is ready. The easiest way to copy/export this file is to simply output it to the terminal and then copy and paste it into a text editor (use Atom). Enter the following commands (replace "client_name" with the name you chose )

 

# cat ovpns/.ovpn

 

Copy the contents bit by bit into a new text file. Be very careful to have all lines in the correct order and don't leave anything out. When you are finished, save the .ovpn file on your computer somewhere handy (on the desktop for example).

This is how such a file might look like:

 

clientdev tunproto tcpremote xxxxxxx.ddns.net 1194resolv-retry infinitenobindpersist-keypersist-tunkey-direction 1remote-cert-tls servertls-version-min 1.2verify-x509-name server namecipher AES-256-CBCauth SHA256comp-lzoverb 1-----BEGIN CERTIFICATE-----MIICJjCCAY+gAwIBAgIJANODNs/AcmQLMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNVBAMMCENoYW5nZU1lMB4XDTE2MTIxMTE4NDkxNVoXDTI2MTIwOTE4NDkxNVowEzERMA8GA1UEAwwIQ2hhbmdlTWUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL7Rq0nwfeGX+kT5qXMdFtdS4elkjUQjtkwy+yIr5gSonzQWp3o0eK+rARMgxw94JysIdQjNT7O11cGCnk6jJbwyqTWlM9HMZ8qsPxwokAYCmeF+102De5dltGH0p/U6feN5/+Q4yxNyE6iiJ1Q/BTExBoefmYUrf+zG6i9SOWiLAgMBAAGjgYEwfzAdBgNVHQ4EFgQUSBCzhn9Kb3w25g1RQxSd1S4qJMYwQwYDVR0jBDwwOoAUSBCzhn9Kb3w25g1RQxSd1S4qJMahF6QVMBMxETAPBgNVBAMMCENoYW5nZU1lggkA04M2z8ByZAswDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAC/8skfj9NvxxTJV0Nv2ZWp0+ZgVvtvQiy6fJw6wbKpq8W3Z/c56o6HJ03Hrr4ugWvw/feAaU2oVUHI1wLirgU1YAB1ZVdYO88oRHQQLs+8P02SEzjL4lMsSeuIIzjT7c5hkX1fbLZQxewOWJFzCCDbE+ywccFLsBkbRjK8KQoBw=-----END CERTIFICATE----------BEGIN CERTIFICATE-----MIICPzCCAaigAwIBAgIRANcOgLtTyiAsoqHoXLyOSV8wDQYJKoZIhvcNAQELBQAwEzERMA8GA1UEAwwIQ2hhbmdlTWUwHhcNMTYxMjExMTg1MTUzWhcNMjYxMjA5MTg1MTUzWjARMQ8wDQYDVQQDDAZzdGVmYW4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJrdzjAs98NwxQF2SbvoU2zgwMGjrSaBqoCzry0zgdVPAi0VL2g5yHNbkkLlMV+xNX6jW+EGwc53KntDYJW0w87ZOa3UVuESbZmKAzgwTFHrAPYaiyC/43jgsGGiA4sY1IZbO+qsL9JN78OF9gTuLHLAZFihOZCRdJZlQmArcQkdAgMBAAGjgZQwgZEwCQYDVR0TBAIwADAdBgNVHQ4EFgQUeJiYoe7nSkd7crUIQk6yaWuV3zMwQwYDVR0jBDwwOoAUSBCzhn9Kb3w25g1RQxSd1S4qJMahF6QVMBMxETAPBgNVBAMMCENoYW5nZU1lggkA04M2z8ByZAswEwYDVR0lBAwwCgYIKwYBBQUHAwIwCwYDVR0PBAQDAgeAMA0GCSqGSIb3DQEBCwUAA4GBAF0tDpHk0V3k463Yfg9mtiS1YleCj0KcJiglT5DWqLWmIIxRvDPJT/W52q5oGDiot3y+D0zAiR/WTYbe9IHfsvCRvu/vNErjPGBVP0zCOA/fu281f6dTTonn/8m0Et9BEcM/Wzh7okwcQ7qc9v1IIgoJOca1L+01uqRWpqRBzD/J-----END CERTIFICATE----------BEGIN ENCRYPTED PRIVATE KEY-----MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIFGtZYc7ZurwCAggAMBQGCCqGSIb3DQMHBAgn2J7Z4I9gigSCAoD11Xr3zU9zg3rAjP4f1I84J/P+5j1y0cYnyOLNPvA1eOrhYMaPT5kNmKW8Mio8OfxhqljK6eB1xckUkNl0K/sf2j9+iXS93yiRqveXg1dNoDxDm/ETMSXfWeOujyzNls87ggQpwKMsBlOtf9VUiJUGR6a2q+gjv0+Qy1JFhALjdDdN0hmQ6R+VqhJUFz0X+AYRZyM8xBW0h95T+agbcLdOx9R7hnyweIFL8oGVGdujG0fVtyyyU1I1eg/4wduDoBYY+XiYNxutP1g+KjjP0imxB/iDOSgh7OG8w8wqvuU4NrV29DJweDbYWRaHETFOJRA/zQNWldGMsrefiaBQpPhDyekfEaEZDIxdzOs4fczQpZJiRtoRzrqwFGSY66prVd6PuW72YRF+fFBlU5qYkAnhTcCFccKOgP5+0jc8Bh1luNUWg7u2iYxBxOcTL1FDWC6JKLUgEg3L7Taq3erX/2BYwnx3hhhQO2PrGKxKG3U/03u6oTmSLoVdcQE15+jnfboIuZupdCCJB+ixV4FChomRs4u8N63+skvNGAscoMV160D9abrzgtM9/95XQkAhzEBerKrNyQzEbBedN7BL1T2iLIOmPqbJ/k7HpPfx0RAr4ctg1ZlK9wpIzU9OiU9hr1YKms44zwsYA+far/pc9ozB8aAKYfzL1uC+UwKXPn9ieO/E7FGC/XZGR7HXhrm+VZUpqlSCfRICL3nKqN7sXzKtY/r2/0RO0fkS7GE/YB2RquJOOlwTn5TBp8Jvz/F2/CwnKjuibZGBnp8c8UWsxqDr4FQ1303uN6K5tSBcF+zo7ypiWoR8jhetXYHy3HulNcKCjIQYFazYm8Wxwvsa7bmR-----END ENCRYPTED PRIVATE KEY-----## 2048 bit OpenVPN static key#-----BEGIN OpenVPN Static key V1-----934e171b8d4e5c55ecf86743a89100746dcb6b187f8fcd3433087ac34257da36ebbf2408481b9a9ea8557262b3b7d7019b54efc4f8b2bbaa2bb72942d39353f2569c363e95f84f2f9c69d08e399112af49a138c2a9e357c0df2310346bffd032c4a98d789c4e3f36d51ccbb7d781a55e6d690a247f3ca669d763ea01beb162c40bf284323732a3fed9204fd99743ee0a66598c190abe829eae0f6471a7f566dbaffee53eeb40fbfe338937262b6102cd565ba919e3678fd047d04b750282ccc654f203bc4850fc8ed65d16fee2c32ffe66c147b9077d30e9f408e7a02eff80d67a8a63517f65443e1af6636c1f86a71d1fe497d6fe161665d68fb546f706476b-----END OpenVPN Static key V1-----

 

 

Import OpenVPN Configuration

You can now import the .ovpn file on your client (smartphone for example). If you want to test the VPN connection from your desktop first, you can use one of the following tools matching the operating system on your computer:

 

• Windows
  
• Mac
  
• Linux
  

 

After you have imported your .ovpn file, you can connect to your Raspberry Pi (using Mac / Tunnelblick here):

In order to test the VPN tunnel properly, you need to be outside of your home network. One easy way to do that is to use the personal hotspot feature of your smartphone and connect your computer (temporary) through it.

 

• Android
  
• iOS
  

 

If everything worked as expected - if you are able to join your home network, proceed to configure OpenVPN on your smartphone. Use the respective iOS or Android OpenVPN apps. You will need to import the .ovpn file on your smartphone. Follow the instructions provided by the respective apps. But whatever you do, don't share the .ovpn file with anyone!

 

Ultimaker App

After the VPN tunnel has been established on your smartphone, start the Ultimaker 3 app and enjoy effortless remote monitoring

Edited March 27, 2017 by Guest