"Automatic" Wireguard config file generator for PIA (Private Internet Access)
Getting tired of manually generating config files for use in wireguard with PIA, I think that this script may help out others... With the Firewall unit having curl, jq, ip (iproute2), wg (wireguard-tools) and qrencode already installed, the script should work well enough, but...
The heavy lifting goes to the pia-wg.sh scripting on which it is based.
In any case, quick and dirty github repo...
https://github.com/JasonMeudt/Firewalla-pia-wireguard/tree/main
# PIA WireGuard Setup and Monitoring for Firewalla
This repository contains two scripts for automating the setup and maintenance of **Private Internet Access (PIA) WireGuard VPN** on Firewalla.
## 📜 Scripts Overview
### 🔹 `pia-firewalla.sh` - Setup and Configure PIA WireGuard on Firewalla
This script automates the process of setting up **PIA WireGuard VPN** on Firewalla.
#### ✅ Features:
- **Clones or updates** the `pia-wg` repository (handles PIA authentication)
- **Generates a new WireGuard configuration** (since PIA tokens expire regularly)
- **Copies the `.conf` file** to Firewalla’s WireGuard profile directories
- **Creates Firewalla-specific support files:**
- `.endpoint_routes`
- `.json`
- `.settings`
#### 🚀 How to Use:
1. Copy this script to Firewalla and make it executable:
```bash
chmod +x pia-firewalla.sh
```
2. Run the script:
```bash
sudo ./pia-firewalla.sh
```
3. Once completed, go to the Firewalla GUI and manually activate the WireGuard profile.
---
### 🔹 `firewalla-vpn-monitor.sh` - Monitor and Reload WireGuard on Token Expiration
This script continuously monitors the WireGuard VPN connection on Firewalla and **automatically restarts it if necessary**.
#### ✅ Features:
- **Monitors** the WireGuard VPN connection
- **Detects inactivity** (no handshake for 2+ minutes)
- **Checks VPN traffic** (via a ping test)
- **If the VPN is down for 5+ minutes, reloads the configuration**
- **Regenerates WireGuard configuration when the PIA token expires**
#### 🚀 How to Use:
1. Save this script to a file (e.g., `~/firewalla-vpn-monitor.sh`).
2. Make the script executable:
```bash
chmod +x ~/firewalla-vpn-monitor.sh
```
3. Run it in the background:
```bash
nohup ~/firewalla-vpn-monitor.sh &
```
4. *(Optional)* Add it to system startup using systemd (see instructions below).
---
## 🔧 Systemd Setup (Optional)
For automatic startup and monitoring, you can create a systemd service:
1. Create a new systemd service file:
```bash
sudo nano /etc/systemd/system/firewalla-vpn-monitor.service
```
2. Add the following content:
```ini
[Unit]
Description=Firewalla VPN Monitor
After=network.target
[Service]
ExecStart=/path/to/firewalla-vpn-monitor.sh
Restart=always
User=root
[Install]
WantedBy=multi-user.target
```
3. Save and exit, then enable the service:
```bash
sudo systemctl enable firewalla-vpn-monitor
sudo systemctl start firewalla-vpn-monitor
```
Now, the monitoring script will run automatically on system startup.
---
## 📜 License
This project is licensed under the MIT License.
---
## 💡 Contributions
Pull requests and improvements are welcome! If you find issues, please open an issue on GitHub.
---
## 🔗 Related Resources
- [Private Internet Access (PIA) WireGuard Setup](https://www.privateinternetaccess.com/)
- [Firewalla Official Site](https://firewalla.com/)
- [Private Internet Access wireguard shell scripts github](https://github.com/triffid/pia-wg)
---
## 📥 Download Instructions
To download this file directly from GitHub:
1. Navigate to the repository on GitHub.
2. Click on the `README.md` file.
3. Click the **Raw** button.
4. Right-click anywhere on the page and select **Save As** to download the file.
Alternatively, you can clone the repository and access the file locally:
```bash
git clone <repository-url>
cd <repository-name>
```
-
Thanks for sharing this. I had to jump through a couple of hoops to get it to work. While connecting from a Windows host through SSH, I couldn't use SCP to transfer files from my host over to FWG. The connection would time out on port 22. I added a Windows firewall rule (New-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -DisplayName "OpenSSH Server (SSH)" -Enabled True -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow) to allow SSH traffic through port 22, but SCP still wouldn't work. Then I thought, if I successfully started a SSH session with FWG, port 22 was definitely open. I checked 'netstat -an | findstr :22' and saw the connection between my host and FWG on port 22. Also, 'telnet host_ip 22' resulted in the connection timing out.
I ended up finding a solution on Reddit, which recommended using the command 'ssh -CD 33333 user@machine'. After starting a new SSH session, I configured the Windows proxy (Network & internet > Proxy) with Proxy IP address 'localhost' and Port '33333'. By doing this, I could use the command '$ ssh user@machine "wget https://raw.githubusercontent.com/JasonMeudt/Firewalla-pia-wireguard/refs/heads/main/firewalla-vpn-monitor.sh -O -" > firewalla-vpn-monitor.sh' and '$ ssh user@machine "wget https://raw.githubusercontent.com/JasonMeudt/Firewalla-pia-wireguard/refs/heads/main/pia-firewalla.sh -O -" > pia-firewalla.sh' to grab the two raw files.
The next issue came up when I executed pia-firewalla.sh. The password entered was incorrect, so I had to update it under PIA_PASSWORD using nano in '/etc/pia-wg/pia-wg.conf'. After doing that, I noticed the error '/home/pi/.config/pia-wg/pia.conf not found!'. I checked '/tmp/pia-wg-output.log' and saw the file was created in '/var/cache/pia-wg/pia.conf' when I ran the script as sudo (later I found out it will appear in the correct directory if you run the script without sudo). I tried moving it with mv, but the file was deleted. I had to run pia-firewalla.sh again to generate the file and move the file to the expected directory. It wouldn't move because '/home/pi/.config/' didn't have the folder pia-wg. So I had to add the folder with mkdir and then finally move the file as sudo. I ran pia-firewalla.sh again and finally saw the final message say, "Setup complete. WireGuard configuration copied as WG_USSilic.conf."
While performing the steps for firewalla-vpn-monitor.sh, I saw the message, "nohup: ignoring input and appending output to 'nohup.out'". That can be ignored and just informs you that once started the input/output is removed from the console. To avoid the message you could use the command 'nohup php server1.php </dev/null &>/dev/null &', but I chose not to do that. The last command I ran 'cat nohup.out' displayed the error 'WireGuard config file not found: /etc/wireguard/vpn_SWISS_PIA.conf', so setup for that region wasn't completed. I checked '/home/pi/.firewalla/run/wg_profile' and saw the config, json, and settings were missing.
It's been awhile since I've used bash, so setting this up was a challenging but rewarding experience. Hopefully this will help someone out.
Please sign in to leave a comment.
Comments
3 comments