This will use a RaspberryPi as a VPN gateway for your whole network using an wired ethernet on eth0 and a wireless USB dongle or internal wifi (depending of signal strength and your location)

1. Set up static IP for the Pi

We want the Pi to always be reachable at 192.168.1.54 on your LAN (eth0).

Edit netplan config:

sudo vi /etc/netplan/50-cloud-init.yaml

Example config:

network:
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: false
      dhcp6: false
      addresses:
        - 192.168.1.54/24
      nameservers:
        addresses: [1.1.1.1,1.0.0.1]
      routes:
        - to: 0.0.0.0/0
          via: 192.168.1.254

    wlx24050faaad43:
      dhcp4: false
      dhcp6: false
      addresses: [192.168.55.1/24]
      optional: true

Apply:

sudo netplan apply

Check:

ip a show eth0
ping 192.168.1.254

Disable IPv6

sudo vi /boot/firmware/cmdline.txt

append to end

ipv6.disable=1

---

2. Install required packages

sudo apt update && sudo apt upgrade -y
sudo apt install wireguard openresolv net-tools hostapd dnsmasq inetutils-traceroute -y

• wireguard → VPN
• hostapd → WiFi AP service
• dnsmasq → DHCP for clients

---

3. Get ProtonVPN WireGuard config

1. Log into ProtonVPN Dashboard
2. Go to Downloads → WireGuard Config
3. Generate a config (choose server, protocol, port).
4. Save it as /etc/wireguard/wg0.conf.

---

4. Enable WireGuard

Move the Proton config:

sudo mv ~/Downloads/proton-XXXX.conf /etc/wireguard/wg0.conf
sudo chmod 600 /etc/wireguard/wg0.conf

[Interface]
# Key for NJ-VPN
# Bouncing = 18
# NetShield = 1
# Moderate NAT = off
# NAT-PMP (Port Forwarding) = off
# VPN Accelerator = on
PrivateKey = xxxxxxxxx
Address = 10.2.0.2/32
DNS = 10.2.0.1

[Peer]
# US-NJ#68
PublicKey = xxxxxx
#AllowedIPs = 0.0.0.0/0, ::/0
AllowedIPs = 0.0.0.0/0
Endpoint = 163.5.171.29:51820

Bring interface up:

sudo wg-quick up wg0

curl ipinfo.io

Enable on boot:

sudo systemctl enable wg-quick@wg0

Check status:

sudo wg show
curl ifconfig.io

→ Should now show ProtonVPN exit IP.

5. System, config

sudo vi /etc/sysctl.conf
sudo sysctl -p

net.ipv4.ip_forward=1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

6. Configure wlan1 as an Access Point (SSID)

Check adapter name:

iw dev

(We’ll assume it’s wlan1.)

Create hostapd config:

sudo vi /etc/hostapd/hostapd.conf

Example:

interface=wlx24050faaad43
driver=nl80211
ssid=VPN-Gateway
hw_mode=g
channel=6
wmm_enabled=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=StrongWiFiPassword123
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP

Tell systemd where config is:

sudo vi /etc/default/hostapd

Set:

DAEMON_CONF="/etc/hostapd/hostapd.conf"

Enable & start:

sudo systemctl unmask hostapd
sudo systemctl enable hostapd
sudo systemctl start hostapd

---

7. Configure DHCP (dnsmasq)

Backup default config:

sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.backup

Create new one:

sudo vi /etc/dnsmasq.conf

Example:

port=0
interface=wlx24050faaad43
dhcp-range=192.168.55.10,192.168.55.50,255.255.255.0,24h
dhcp-option=6,10.2.0.1

sudo systemctl restart dnsmasq
sudo systemctl status dnsmasq

Assign static IP to it

Give it a gateway address for the subnet:

sudo ip addr flush dev wlx24050faaad43
sudo ip addr add 192.168.55.1/24 dev wlx24050faaad43
sudo ip link set wlx24050faaad43 up

---

8. Enable routing through WireGuard

Enable packet forwarding:

sudo vi /etc/sysctl.conf

Uncomment or add:

net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

Apply:

sudo sysctl -p

For now (no kill switch yet), add a simple NAT rule so clients route via ProtonVPN:

sudo iptables -t nat -A POSTROUTING -o proton -j MASQUERADE

Persist with:

sudo apt install iptables-persistent -y
sudo netfilter-persistent save

---

9. Test setup

1. Connect a laptop/phone to SSID PiVPN-Gateway
2. It should get IP in 192.168.55.x
3. Run:

curl ifconfig.io

sudo tcpdump -i wlx24050faaad43 -n

cat /var/lib/misc/dnsmasq.leases

It should show ProtonVPN exit IP, not your home IP.

---

At this point you’ll have:

• Pi on 192.168.1.54 (LAN)
• WireGuard tunnel active to ProtonVPN
• wlan1 broadcasting SSID
• Clients connected via SSID are tunneled through ProtonVPN

Here’s a minimal, safe “kill switch”: Wi-Fi clients only work when the WireGuard interface wg0 is up; if it goes down, they have no internet, and you can still SSH from your LAN.

Replace wlx24050faaad43 with your Wi-Fi IF name (yours) and keep eth0/proton as is.

Firewall Rules

1) Make sure forwarding + NAT are set

# forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# NAT to VPN (idempotent)
sudo iptables -t nat -C POSTROUTING -o wg0 -j MASQUERADE 2>/dev/null || \
sudo iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE

2) Allow SSH from your LAN (defensive even if INPUT policy is ACCEPT)

sudo iptables -C INPUT -i eth0 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT 2>/dev/null || \
sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

3) The simple kill-switch rules (only touch the FORWARD chain)

These two ACCEPTs let Wi-Fi ↔ VPN; the two DROP rules block any Wi-Fi ↔ eth0 path (so no leak if VPN dies).

We insert so they sit at the top and take effect regardless of other rules.

# Allow Wi-Fi -> VPN (new + established)
sudo iptables -I FORWARD 1 -i wlx24050faaad43 -o wg0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
# Allow VPN -> Wi-Fi (return traffic)
sudo iptables -I FORWARD 1 -i wg0 -o wlx24050faaad43 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Block any Wi-Fi -> eth0 leak (and reverse)
sudo iptables -I FORWARD 1 -i wlx24050faaad43 -o eth0 -j DROP
sudo iptables -I FORWARD 1 -i eth0 -o wlx24050faaad43 -j DROP

That’s it. No default DROP policies, so you won’t lock yourself out. Behavior now:

• VPN up ➜ clients work (NAT via proton).
• VPN down ➜ clients can’t reach internet (blocked from eth0).
• SSH from 192.168.1.x ➜ still works.

4) Verify

sudo iptables -S FORWARD
sudo iptables -t nat -S
wg show

Then test:

• iPhone online
• sudo wg-quick down wg0 → iPhone loses internet ❌, SSH still fine
• sudo wg-quick up wg0 → iPhone back online

5) Persist (optional, after you’re happy)

sudo apt -y install iptables-persistent
sudo netfilter-persistent save

If you ever want to remove just these four FORWARD rules:

sudo iptables -D FORWARD -i wlx24050faaad43 -o eth0 -j DROP
sudo iptables -D FORWARD -i eth0 -o wlx24050faaad43 -j DROP
sudo iptables -D FORWARD -i wg0 -o wlx24050faaad43 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -D FORWARD -i wlx24050faaad43 -o wg0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT

.