Linux - Justin Foell

Skip to Ubuntu 13.04 Update

This post was originally supposed to be titled “My commitment to Ubuntu.” But I couldn’t take it. After 2 years of using Unity and watching it evolve one step forward and then dwindle two steps back, I decided it was time to give GNOME another chance.

Don’t get me wrong… I’m still committed to Ubuntu, and moreover Linux and Open Source in general. I’ve tried quite a few Linux distributions: Slackware, RedHat, Fedora, Gentoo, Debian, and Ubuntu. I don’t mean I installed and tried them for a week, I’ve used each of those distributions for over a year on a day-to-day basis.
Continue reading →

I have stuck with Ubuntu since 2008 because it seemed to have the most momentum, the most desktop distribution market share (which equates to better support), and the most polished overall package.

As such, I’ve always tried to stick with whatever Canonical recommends for mainline Ubuntu Desktop. That meant using atrocious iTunes wanna-be softwares like Rhythmbox and Banshee (to this day I’m unclear as to the difference between these two). However, I’d stick it out just so I knew what the normal user experience was – feeling the average users’ pain, and reporting bugs along the way.

Why Ubuntu decided to drop GNOME in favor of Unity has always puzzled me. As per my rule, I went along for the ride into the Unity experience. I like the simplicity of Unity, having used it as part of the Ubuntu Netbook Remix / Edition or whatever it is/was called. But I feel it was moved into prime-time a little too early.

No Man’s Land

All of my complaints with Unity are in regards to hardware support (or lack there-of). For my office, I prefer to use my laptop (a huge desktop replacement) with an external monitor in “portrait” mode:

In the beginning (Ubuntu 11.04), multi-monitor support was abysmal. My monitor setup would get rendered as one large canvas. The laptop & monitor are like a backwards “L” and the rest of the area (above the laptop and to the left of the monitor) becomes what I call “No Man’s Land.”

System tray icons that were written for “legacy” GNOME support, like Skype, would be rendered up in No Man’s Land, where no one can see them. The only reason I knew is because you could see a tiny green icon up there when using Unity’s “Expo” feature. The mouse cursor could go up into No Man’s Land (confusing), and application windows could also be moved there accidentally.

Then on a later release all of the system tray icons needed to instead use a different “indicator” API. So every system tray app that was previously working in GNOME and hadn’t kept up with the Unity trend, now had to have an indicator wrapper to make it useful (or even visible).

The Last Straw

So after two years of Unity advancements, you’d think it would be awesome now, right? Nope – 12.10 is the slowest Unity ever. I tried it for a month and decided it was the final straw. I don’t know exactly what happened. Maybe I was previously using Unity 2D or had shut off all of the effects. Frankly I’m glad I don’t have to remember all the stupid minutia anymore. But in Ubuntu 12.10 there is no “giant off switch” for all Unity effects, and my computer feels like everything is “Powered by Java.” ™ Slow menus, slow window switching, slow window moving, slow desktop switching! I thought I had fixed the slowness by turning off vblank_mode for my Intel GM45 graphics card, but when I attached my external monitor, slowness resumed.

Maybe the Unity slowness is caused by the sheer size of my desktop, since it is effectively rendering a 3000×1920 pixel area. Maybe my graphics card is just a wimp. What ever it is, I give up. I found that GNOME is still alive and well in the Ubuntu repositories. I suggest to anyone that is stuck in the muck with Unity, exorcise your demons! Execute the `apt-get install` command from that page. Don’t bother with activating GDM over LightDM – GNOME really only recommends it because GDM is themed to look like GNOME “Remix” (see below). You can also skip the `apt-get remove` in case you want to go back to Unity – especially if you’re a masochist. If your user account was set to automatically log in, turn it off so you can choose between GNOME/Unity when you restart.

I tried the GNOME “Remix” and it was cute, but seemed to be plagued with similar issues that Unity had in the beginning: in-configurable virtual desktop switching, poor multi-monitor support, limited flexibility with system-tray apps/indicators.

Classic

GNOME Classic. Like Coke Classic, this is it. Why did we ever abandon this? It felt so comforting to be using GNOME again. Everything works just as I remember, plus it’s a little more polished. The ironic thing is, GNOME also uses the Compiz 3D compositing system, but it performs far better on my hardware/monitor configuration than Unity. Like I said, I don’t care what magic makes it work, as long as I can get back to work.

Update: Unity in Ubuntu 13.014

I’m happy to report that Unity in Ubuntu 13.04 is much better regarding performance specifically with my Intel graphics chipset. After 2 months of solid use I can report that it’s definitely back in a usable state (for me at least).

Unity, Ubuntu, and all Linux distros (including the Linux kernel itself), have always suffered from 1000 paper cuts. It’s always been useful for me as a tech geek, but I see and can understand how the minor annoyances add up to someone not being able to make the switch to Linux full-time.

My current issue with Unity is a strange bug where if I have a browser maximized on my 2nd display and I try to open a new tab from a different workspace (via Instant Messenger usually), when I switch back to the workspace containing my browser, it has magically moved to the primary display.

It’s not enough to make me abandon Unity again, but combined with something else it might be.

← Summary Only

I was given a Raspberry Pi for my birthday last week, and I’ve already got it up and running, doing what I intended it to do: be an audio sink for iPhone and my laptop – which has terrible speakers.

I knew it would be a PulseAudio sink for my laptop. There’s also neat piece of software called shairport that will act as an AirPlay sink – and people are using it on Raspberry Pi’s.

By default, the common Linux Distribution “Raspbian” for this tiny computer uses ALSA for sound. This is fine for basic stuff, but I was reminded that when two things ever try to play sound at the same time, contention issues arise. It reminded me of a earlier day in Linux history, before the advent of PulseAudio and the magic it imparts.
Continue reading →

I made it my mission to set up Pulse as the default audio handler and make sure shairport would still play nicely in this setting. I want to state that despite what I’ve read, the built-in mini-jack on my Raspberry Pi has been working fine (no USB sound needed). Also, many shairport write-ups have wifi configuration sections – but AirPlay has been working fine for me with the Raspberry Pi wired into the same router my iPhone connects to. No need for extra hardware, just some know-how. So far, it’s been a success, so I thought I’d share my configuration.

I’ve used some conventions in this writeup:

BOLD text where I’ve added or changed something (a new line or configuration setting)
[…] where I’ve omitted the unchanged contents of a file
commands in code tags
```
file contents
```
in pre tags
In the case where commands are extraordinarily long or there are several sequential commands, I’ve used pre tags for those as well

Install & Configure PulseAudio

I found there are a few “tricks” to getting Pulse to work the way I wanted. Some of it involved going against conventional wisdom and running Pulse in “system” mode. To me this isn’t an issue at all as the Raspberry Pi sits on my desk to provide audio service to anyone that’s legitimately connected to my network.

Start by installing PulseAudio and its Zeroconf module:

sudo apt-get install pulseaudio pulseaudio-module-zeroconf

Set Pulse to run as a system daemon:

sudo vi /etc/default/pulseaudio

[...]
PULSEAUDIO_SYSTEM_START=1
[...]
DISALLOW_MODULE_LOADING=0

At this point you can turn on the PulseAudio system service:

sudo /etc/init.d/pulseaudio start

You can test the sound by running:

paplay /usr/share/scratch/Media/Sounds/Vocals/Singer1.wav

However, I was getting strange errors like

pa_context_connect() failed: Connection refused

even though Pulse was up-and-running. I think Pulse on my Raspberry Pi was getting confused because my desktop system also runs PulseAudio as well and some connection info was transferred in my SSH session. To convince Raspberry Pi’s Pulse to play locally, I set the PULSE_SERVER environment variable:

sudo vi /etc/environment

PULSE_SERVER=localhost

Uncomment the following lines and change the resample method and resampling rate. The sample rate was needed to allow playback from my Ubuntu laptop, the resample method was needed to allow playback from iPhone.

sudo vi /etc/pulse/daemon.conf

[...]
resample-method = trivial
[...]
default-sample-rate = 48000

Comment out the suspend-on-idle module to prevent all the clicks & pops. Turn on anonymous network access and publish the configuration using zeroconf. Change “192.168.0.0” if your network uses a different numbering scheme.

If we were running PulseAudio in user mode, these next changes would be the equivalent of running paprefs visiting the Network tab and checking:

Enable network access to local sound devices
- Allow other machines on the LAN to discover local sound devices
- Don’t require authentication

sudo vi /etc/pulse/system.pa

[...]
#load-module module-suspend-on-idle
[...]
load-module module-native-protocol-tcp auth-ip-acl=127.0.0.1;192.168.0.0/24 auth-anonymous=1
load-module module-zeroconf-publish

Move your /etc/asound.conf to /etc/asound.old:
sudo mv /etc/asound.conf /etc/asound.old
Then create a new one with PulseAudio as the default:
sudo vi /etc/asound.conf

pcm.pulse {
    type pulse
}
ctl.pulse {
    type pulse
}
pcm.!default {
    type pulse
}
ctl.!default {
    type pulse
}

Tell libao (shairport’s sound library) to use Pulse instead of ALSA directly:
sudo vi /etc/libao.conf

default_driver=pulse
quiet

Install & Configure shairport

This is basically a re-hashing of several other useful installs I found. I felt the need to include it here for completeness.

Start by installing the necessary Git & Perl build packages:

sudo apt-get install git libao-dev libssl-dev libcrypt-openssl-rsa-perl libio-socket-inet6-perl libwww-perl avahi-utils libmodule-build-perl

Unlike other shairport write-ups, I installed the Perl module ‘Net::SDP’ (needed for iOS6 support) via CPAN instead of Git. Adding this library supposedly enables shairport to work with iOS6 devices, but my wife’s phone (which is iOS6) doesn’t work, however my iOS5 phone does. Anyway, it doesn’t hurt to install it:

sudo cpan install Net::SDP

Then clone, and build shairport from GitHub:

git clone https://github.com/albertz/shairport.git shairport
cd shairport
make
sudo make install
sudo cp shairport.init.sample /etc/init.d/shairport
sudo chmod a+x /etc/init.d/shairport
sudo update-rc.d shairport defaults

I went an extra step and made the shairport service run as the pulse user, and to write the process ID file to the pulse-owned /var/run/pulse directory:

sudo vi /etc/init.d/shairport

[...]
NAME=AirPi
USER=pulse
DAEMON="/usr/local/bin/shairport.pl"
PIDFILE=/var/run/pulse/$NAME.pid
DAEMON_ARGS="-w $PIDFILE -a $NAME"

[ -x $binary ] || exit 0

RETVAL=0

start() {
    echo -n "Starting shairport: "
        start-stop-daemon --start --quiet --pidfile "$PIDFILE" \
                          --chuid $USER \
                          --exec "$DAEMON" -b --oknodo -- $DAEMON_ARGS
        log_end_msg $?
}
[...]

You can now start shairport like any other service:

sudo /etc/init.d/shairport start

Did I mention you should do some testing after each of these steps? I forgot to mention it, but you probably should just to make sure everything is heading in the right direction. If I’ve forgotten anything, let me know and I’ll post an update.

← Summary Only

This article assumes you fave a few things:

A Linux server with:
- root SSH access
- BIND installed
- a domain already set up and working with BIND
An OpenWrt router at home to send updates

The OpenWrt router isn’t strictly necessary. You could, of course do the dynamic DNS updates with a cheap Linux firewall, but I’ll cover the configuration for OpenWrt.

Continue reading →

DNS Server Configuration

The file naming conventions used here are for a BIND installation on Debian. Your distribution may use a different naming convention, however, the concepts should be the same.

On the DNS server (as root):

# dnssec-keygen -C -a HMAC-MD5 -b 512 -n HOST sub.domain.com.

You can use your domain name (or subdomain) as the key name if you’d like. That’s what I did in this example – it helps me keep things straight. The -C switch is for compatibility mode since it’s likely the nsupdate binary on OpenWrt will be older than the BIND installation on your DNS server. The contents of the key file will look something like this:

# cat Ksub.domain.com.+157+54658.key
sub.domain.com. IN KEY 512 3 157 GWruXog5QO20QSB2YvLJp60DwlfJhq0hQ9KiAXFRNDHlrhSSjGBtGlM8 wSJpWNlUbhdkBnV3Or41s1iedLoDwg==

I like to keep BIND’s key configuration in a separate file to make sure it doesn’t get overwritten with software upgrades, so I created a file called /etc/bind/keys.conf. Using the MD5 from the key file (the cryptic string(s) that ends in ‘==’, after the sets of numbers), create a keys.conf file:

key sub.domain.com.
{
	algorithm HMAC-MD5;
	secret "GWruXog5QO20QSB2YvLJp60DwlfJhq0hQ9KiAXFRNDHlrhSSjGBtGlM8 wSJpWNlUbhdkBnV3Or41s1iedLoDwg==";
};

Then in /etc/bind/named.conf, add this at the top:

include "/etc/bind/keys.conf";

In my /etc/bind/named.conf.local (which has all of the zones actually hosted on the server), the zone for the domain I want to make dynamic has the following:

zone "domain.com" IN {
        type master;
        file "/etc/bind/db.domain";
        update-policy {
               grant sub.domain.com. name sub.domain.com. A TXT;
        };
        notify no;
};

You would substitute your domain for “domain.com” and “sub.domain.com,” and have your own zone file in a different file named after your domain (/etc/bind/db.yourdomainname).

The “update-policy” section is the part that is added. The first parameter to the “grant” statement is the name of the key, and the “name” parameter is the domain name – which I’ve made the same in this case. There’s nothing different about /etc/bind/db.domain than any of my other zone db files, except it’s owned by the “bind” user & group — that way when it receives a DNS update, it can change the file (dynamically!).

Also the /etc/bind directory should be owned by group “bind” so that it can create /etc/bind/db.domain.jnl — a journal file BIND will use.

OpenWrt Configuration

Install the “bind-client” package on your OpenWrt router. I like to use the LuCI web interface. In LuCI you can find it by searching under the software administration menu.

SCP the private & key files you created on your DNS server to your OpenWrt router. I keep my DNS files in root’s home directory: /root.

Create a hotplug file to update the DNS when the WAN interface obtains an address. Put it in /etc/hotplug.d/iface/30-nsupdate:

[ "$INTERFACE" != "wan" ] && ( [ "$ACTION" != "ifup" ] || [ "$ACTION" != "update" ] ) && exit 0

rdate -s time.nist.gov
include /lib/network
scan_interfaces
config_get ipaddr wan ipaddr

echo "server your.bindserver.com
zone domain.com
update delete sub.domain.com A
update add sub.domain.com. 86400 A $ipaddr
show
send" | nsupdate -k /root/Ksub.domain.com.+157+54658.key -v

Again, Replace “domain.com” with the name of your zone, and “sub.domain.com” with the name of your dynamic domain (they could be named the same). Replace “your.bindserver.com” with the name or IP of your DNS server. The rdate command is in there to make sure your time is set correctly before running nsupdate. BIND will complain if the time difference between the client & server differs too much. While only the key file is referenced in the script, both files need to be present (usually in the same directory as each other) for nsupdate to make a valid request.

You can (and should) test the script without disrupting your network connection by SSHing into your OpenWrt router and running the following command:

# ACTION=update INTERFACE=wan /sbin/hotplug-call iface

Often BIND will complain about time, permissions, auth keys, etc. Running the test above is the best way to find out what’s going on. If there’s no output, the update probably went through. Try to ping your dynamic domain name and see if all is well.

← Summary Only

Update

I have a new post about SSHFS that highlights the latest operating systems, including MacOS. However, I’m leaving this post here for historical purposes.

Original

At home I have what some may call a “back-office” server. Technically it’s in the laundry room, but it does all sorts of home automation type stuff: record TV, download files, store and play music, distribute files, run backups, etc. I may do a post on it later, but the gist is that it’s running Ubuntu Server with a bunch of disk drives.

Far and above, it’s main purpose in life is being a file server. There are several ways to connect to it: Samba (Windows file sharing), NFS (Unix Network File System). The server also runs SSH (Secure Shell) for terminal access – which can also be used a pass-through for secure local and remote file sharing.

Continue reading →

The Advantage of SSHFS

Windows shares don’t have options to change ports, SSH does – and internet service providers often block Windows file sharing ports both for their own customers safety and to CYOA (cover your [their] own a$$) regarding file sharing. SSH, however, can be run on any port and it’s secure. I simply set up a firewall rule on my router (OpenWrt) to pass SSH traffic to my file server.

Why not use “the cloud?”

I firmly believe that by putting your files in “the cloud” (whether it be with Google, Apple, Amazon, Dropbox, etc.) you lose a little freedom. That doesn’t mean I don’t use any of those services, I just use them selectively. For the record Dropbox is a great service that works cross-platform and you’ll get some extra space if you sign up using this link.

Connecting with SSHFS in Linux

The simplest way to connect to another computers file-system using SSHFS is to do it through the UI using the Nautilus file manager. This is default file manager for several Linux distributions. In Ubuntu with Unity, click the folder icon in the launcher to bring a Nautilus window showing your home folder. From Nautilus you can click the file menu and choose Connect to Server…

Which will bring up a dialog where you can input the info for your SSH server. Change the Type drop-down to “SSH” and you’ll see all of these options:

Once you’ve connected, you’ll have a folder on the left side of Nautilus (under Network) that you can click on to browse files on the file server. You can right click the folder and choose Add Bookmark which will make it a breeze to connect to again and again:

You’ll notice I have two folders under “Bookmarks”: sshfs-Local and sshfs-Remote. I set up an additional connection for when I’m away from home which uses my outside IP and port I set up on my firewall/router.

Nautilus uses the GVFS FUSE (filesystem in userspace) module to mount the remote drive. To make it easy to access from the command line I created a symbolic link from ~/Documents/sshfs-Local-Documents to my SSHFS directory. All of the GVFS mounts (on Ubuntu 12.04 and earlier) can be found in your ~/.gvfs folder. Mine is linked as such:

justin@lappy64:~$ ls -l ~/Documents/sshfs-Local-Documents
lrwxrwxrwx 1 justin justin 72 Oct 17  2011 /home/justin/Documents/sshfs-Local-Documents -> /home/justin/.gvfs/SFTP for justin on ghettivo/srv/home/justin/Documents

Starting with Ubuntu 12.10, the GVFS mounts are in /var/run/user. So my symlink in 12.10 looks like:

justin@lappy64:~$ ls -l ~/Documents/sshfs-Local-Documents
lrwxrwxrwx 1 justin justin 82 Nov  1 09:44 /home/justin/Documents/sshfs-Local-Documents -> /var/run/user/justin/gvfs/sftp:host=ghettivo,user=justin/srv/home/justin/Documents

Connection with SSHFS in Windows

To connect to the same files using Windows, there’s Dokan SSHFS. I will say that at the moment this library is a little buggy, but it will work in a pinch. I get the feeling that it probably works better in 32-bit windows, but I don’t have any claims to back that up – I just know it’s a bit unstable in 64-bit windows.

Since Dokan is a .NET application, you’ll need to install a couple of things (maybe 3), slightly better than installing a Java application 😉

There’s a small chance that you have the latest “Redistributable Package” already on your Windows computer, so you can maybe skip it, but honestly it doesn’t hurt to install.

Once you’ve got everything installed you can run DokanSSHFS.exe to connect to your SSHFS drive:

Happy (secure) file sharing!

← Summary Only

This is part three of a three part series covering Dnsmasq’s uses regarding:

Local Development DNS
Local Area Network (LAN) DNS
Virtual Private Network (VPN) routing

IT savvy business often use a Virtual Private Network (VPN) connection to allow employees to connect to the (normally internal) work network while they’re traveling or working from home. Many VPNs (once connected) act at the default gateway for your computer. This is effectively like unplugging your computer from your local network and plugging it in at your workplace. This is probably for security reasons, and it’s certainly a simple configuration for most, as your computer is truly now on a remote network as if you were at your desk at work. But for some, this is becomes a restriction, and we’ll examine some cases and a workaround.

Continue reading →

Let’s say I’m connected to the VPN. All of my internet traffic goes through the VPN which is a thousand miles away. If I’m streaming a local radio station, that’s a long way to go out-and-back for something that is truly local. In addition, all of my local network resources are less usable because the VPN has instructed my computer to use the VPN’s DNS servers, so I can now only access them by IP.

It is possible to be connected to the VPN and still have access to local resources, and route (non-VPN) traffic though your normal gateway. Your VPN administrator might say this is poses a security risk, but s/he’ll be none the wiser if you don’t let on.

This configuration is for Dnsmasq and NetworkManager, which is used by Ubuntu & Fedora. But there’s no reason the concepts here can’t be applied to other Linux distributions and/or OSX.

VPN Gateway

Connect to your VPN per normal using NetworkManager. Once you’re connected you can probably deduce the default gateway by looking at output from running a traceroute to a known computer on the VPN (such as the nameserver – see below).

$ traceroute 10.20.0.26
traceroute to 10.20.0.26 (10.20.0.26), 30 hops max, 60 byte packets
 1  * * *
 2  10.20.44.253 (10.20.44.253)  101.294 ms  101.715 ms  102.610 ms
 3  10.20.0.26 (10.20.0.26)  100.205 ms  101.022 ms  101.486 ms

The first IP is likely the VPN’s default gateway, 10.20.44.253 in this case.

VPN Name Servers

You’ll also want to grab the name servers for your VPN. You can probably just inspect your /etc/resolv.conf file for this information:

$ cat /etc/resolv.conf
...
nameserver 10.20.0.26

Add new VPN connection

With this information at hand, disconnect from the VPN and create a new VPN connection in NetworkManager that is essentially the same as the existing one. Name the new connection something that indicates it’s custom (we’ll use this name later). In NetworkManager on the IPv4 Settings tab, set the Method to Automatic (VPN) addresses only:

Then click the Routes… button. In the Routes dialog you’ll want to put in the network information for your work, using the information you deduced using traceroute. My VPN addresses are all 10.x.x.x, and the VPN gateway is 10.20.44.253. So I added a line to the route table like this:

You can find the network address and netmask from the Private Network table on Wikipedia. The metric number should be fine at 10. Check the boxes to ignore obtained routes and to only use this network for resources contained within.

That gets you essentially halfway there, you can connect to the VPN and only requests for resources with network addresses that are part of the VPN will be routed through the VPN connection, everything else will gateway through your normal ISP. You can (and probably should) test this configuration by connecting to the VPN and ping-ing or traceroute-ing to a computer on the VPN (such as the nameserver) just to make sure the custom routing established is indeed working. Once routing is working, we need to fix the DNS as it’s kind of useless without it.

Create a NetworkManager dispatcher.d script to start Dnsmasq

In /etc/NetworkManager/dispatcher.d add a file called 05vpn:

#!/bin/sh

if [ "$2" = "vpn-up" ]; then
        CONN_NAME=`/usr/bin/nm-tool | grep VPN | sed 's/^.*\[\(.*\)\].*$/\1/'`
        if [ "$CONN_NAME" = "VPN Custom" ]; then
                /etc/init.d/dnsmasq start
        fi
fi

if [  "$2" = "vpn-down" ]; then
        /etc/init.d/dnsmasq stop
fi

Set the comparison to $CONN_NAME to the name of your new VPN connection. After saving the file, set it to be executable:

$ sudo chmod 755 /etc/NetworkManager/dispatcher.d/05vpn

The /etc/NetworkManager/dispatcher.d files are executed whenever a network interface goes up or down. The 05vpn file will start/stop Dnsmasq when the “custom” VPN connection is turned on/off.

Configure Dnsmasq for your VPN

Configuring Dnsmasq for your VPN really boils down to adding server entries for every domain that either resides on the VPN, or that you want to route through the VPN. Add a file in /etc/dnsmasq.d for your VPN DNS settings, such as /etc/dnsmasq.d/02_vpn

If your work has it’s own Top Level Domain (TLD), add a server line with the VPN DNS server IP and the TLD:

server=/tld/10.20.0.26

Similarly, if there are certain domains (like your company’s domain name) that act differently when you’re on the VPN, you’ll want to have them route through the VPN:

server=/mywork.com/10.20.0.26

That’s all there is to it. I’ve noticed some (newer) versions of NetworkManager automagically employ Dnsmasq to let you use any LAN resources, but other traffic (such as streaming music) would still go through the VPN.

Happy Hacking!

← Summary Only

Justin Foell

Technology, Bicycling, Hobbies, Kids, Life.

Tag Archives: Linux

GNOME sweet GNOME

Skip to Ubuntu 13.04 Update

No Man’s Land

The Last Straw

Classic

Update: Unity in Ubuntu 13.014

Raspberry Pulse: Raspberry Pi + PulseAudio + Shairport

Install & Configure PulseAudio

Install & Configure shairport

DIY Dynamic DNS with OpenWrt & BIND

DNS Server Configuration

OpenWrt Configuration

Cross-platform file sharing with SSHFS

Update

Original

The Advantage of SSHFS

Why not use “the cloud?”

Connecting with SSHFS in Linux

Connection with SSHFS in Windows

(Re)routing VPN traffic with Dnsmasq

VPN Gateway

VPN Name Servers

Add new VPN connection

Create a NetworkManager dispatcher.d script to start Dnsmasq

Configure Dnsmasq for your VPN