Use OpenVPN to connect a remote RasPlex-client to your Plex media server

Plex is great. So is RasPlex, the Raspberry Pi distribution that is a fully-functioning Plex client. I would like to take my Raspberry Pi with me to be able to remotely connect to my server and view media.

Prerequisites

I will assume that you have the following setup:

• A Plex media server that is accessible from the internet for OpenVPN traffic (UDP port 1194), either directly or by port forwarding in your router. The server should have a static IP address, or at least a domain name at which it is always reachable. I will assume the Plex media server is an Ubuntu server machine.
• A Raspberry Pi with a standard RasPlex installation on the memory card. It should already have an internet connection, which loads when the Rasberry Pi is booted.

Install OpenVPN on your server

We will install OpenVPN and create a static key to secure access. After all, we have only one client, and the traffic is not so sensitive that we insist upon having forward secrecy.¹

First, install the OpenVPN package: sudo apt-get install openvpn.

Next, generate a static key: sudo openvpn --genkey --secret /etc/openvpn/static.key.

Copy the key to your local machine over a secure channel (such as SCP or SFTP).

Create the server config (/etc/openvpn/server.conf):

dev tun
ifconfig 10.8.0.1 10.8.0.2
secret static.key

Start the OpenVPN service: sudo service openvpn start.

Connecting the RasPlex instance

Do not use the OpenVPN config in the RasPlex GUI. It will not allow you to use the static key setup, nor will it automatically start OpenVPN upon boot.

Connect the RasPlex Pi to your local network. Connect to it using SSH (username/password is root/rasplex).

Upload the static key to the server, and put it in /storage/keys/static.key.

Go to the directory where we will create the OpenVPN config: cd /storage/.config/. There, create myvpn.ovpn:

remote <IP address or domain name of your server> 1194
dev tun
ifconfig 10.8.0.2 10.8.0.1
secret /storage/keys/static.key

Now, test if the VPN works:

# openvpn --config /storage/.config/myvpn.ovpn

You should be able to ping 10.8.0.1.

Make the OpenVPN client start automatically

RasPlex uses the system.d method of starting services. Therefore, you need to create a new service and enable it.

First, go to the directory where we will create the service file: cd /storage/.config/system.d.

There, create a file openvpn-autostart.service:

[Unit]
Description=openvpn-autostart
After=network-online.service
Requires=network-online.service

[Service]
Type=forking
ExecStart=/usr/sbin/openvpn --daemon --config /storage/.config/myvpn.ovpn
Restart=always
RestartSec=15

[Install]
WantedBy=plexht.target

Enable this service with systemctl enable openvpn-autostart.service.

Reboot, ready!

Reboot the Pi to check that you’re done. The VPN connection should come up immediately. Add the server to which you want to connect manually in Preferences -> Network settings -> Media Server -> Add server manually (IP is 10.8.0.1, port is 32400). If it does not, try the following:

• Log in to your Pi and check whether you can ping the server (ping 10.8.0.1) . If not, check if the tun0 device exists (ifconfig). If not, check whether the OpenVPN config actually works (openvpn --config /storage/.config/myvpn.ovpn).
• Check whether the Systemd service is started properly. This page may be of help.