I’m running PIA on Debian 12. Yesterday I started having connectivity issues. After some troubleshooting today, I’ve found that my selected DNS provider stopped working. I was using PIA DNS servers. I tried all the other ones as well. The only one that works is use existing DNS. In addition to that, I only get access to the internet when my kill switch is set to off. Even when PIA shows that it’s connected to the server.
Anyone have any ideas about how to fix it?
I think there are a lot of differences between your situation and mine, but I came to this forum looking for answers, since opening a ticket with PIA provided no help or insight. Their response was that they were aware of the issue, and I should roll back to a previous version of OpenSSL.
In my situation I have a headless arch linux system that’s been up and running for a few years. After an update to openvpn, and openssl to 3.3.0 (I think this is what initiated the problem), if I have my killswitch rules – which have been working, untouched, for several years – as defined with iptables, I cannot connect using openvpn and PIA’s .ovpn files. It fails with:
UDPv4 link local: (not bound)
openvpn[1485]: write UDPv4 : Operation not permitted (fd=3,code=1)
If I strip out my iptable rules to basically allow everything, then I can set up my tun0 just fine. I am not very heavy on iptables, but (again, worked for a long time) I think I have them set up OK in terms of allowing loopback, allowing local network traffic, allowing tunnel, and denying everything else. I *think* the issue is on PIA’s side, but their tech support has been unhelpful. If I wasn’t paid up through 2026 I’d dump them at this point.
Have you tested when the kill switch is off, and the VPN tunnel is established whether or not the web traffic is actually being routed through the VPN IP? So checking some random whatismyipaddress, if it’s point to your isp instead of the VPN IP it could be a misconfiguration.
Either way, I’d say it might be best to do a full uninstall, rollback of your pre-pia IPtables settings, and do a clean install of PIA. I dont use the *nix version but I imagine the kill switch just adds lines into the IPtables configuration
Who would you use if you dumped PIA?
Honestly it sounds like there is some missing configurations to allow the socket to be established properly. Since it’s saying operation no permitted id imagine either the IPTable configuration or a firewall is not allowing traffic to and from the correct ports to establish a connection.
You could probably test out the source and destination ports via a TCP connection and logging to see if you are getting a full handshake.
Not too sure. I already use Cloudflare for some things. I’d probably look into them first, and see how to replicate the functionality I get out of PIA. But the fact that I already paid for years in advance (after already having been a customer for years before that) means that I’d really rather not jump. There are things to like. It just seems like, unless you are using their PIA app, they aren’t that interested in support. Or want to but can’t. Or who knows? I just know I pay for it, my thing is busted, and they don’t seem that interested in helping.
I think you are correct. While it is possible they fixed something on their end, given their response and that a config that had been working correctly suddenly stopped doing so right after an openssl update, it is equally like (if not more so) that something was messed up on my end. In any case, for the benefit of anyone else who may be having similar problems, this is the process I followed, which got me back up to openvpn enabling on boot, ipv6 disabled, and a working killswitch. I am sure there are many guides, equally good, but this is the one I used:
https://linuxconfig.org/how-to-create-a-vpn-killswitch-using-iptables-on-linux
A few notes, because it’s not going to be entirely cut and paste:
The guide assumes your LAN traffic is traversing eth0. That is not the network interface I use. Either “ifconfig” (depricated) or “ip a” will show you what is right for your machine. Also, your LAN IP scope isn’t guaranteed to be 192.168.1.0/24, so you may need to change that.
Likewise, my tunnel interface is “tun0” which is pretty common, but not guaranteed to be yours.
As of this writing, PIA uses:
- DNS 10.0.0.242
- UDP ports 1197, 1198 and TCP ports 501, 502
Lastly, to allow LAN traffic in both directions I had to add the following line. There might be a better way to do it, but I could not ssh into my server without it. With it, everything works. Basically the guide gives you the rule to allow OUTPUT but had no corresponding INPUT. I just took a guess that this would fix it, and it did (note that’s my IP space and probably is not yours)
-A INPUT -d 192.168.86.0/24 -j ACCEPT
I’ve paid for years in advance as well.