> Securing Your Homelab Traffic: Setting Up Private Internet Access (PIA) VPN

$ wg show
interface: wg0
  public key: <masked>
  private key: <masked>
  listening port: 51820
// Encrypted Tunnel: Active (PIA)

Routing your homelab or server traffic through a commercial VPN provider is essential for privacy, securing external container queries, and keeping your external IP masked.

This guide covers how to configure and deploy Private Internet Access (PIA) with the native downloadable file, ensuring your network stack routes securely through the tunnel without leaking real traffic.

Now that the file has been downloaded, navigate to the download directory and run this command:

bash pia-linux-<version>-<revision>.run -- --skip-service

Next is to create an Openrc init script:

sudo nano /etc/init.d/pia-daemon   

#!/sbin/openrc-run

name="pia-daemon"
description="Private Internet Access Daemon"

command="/opt/piavpn/bin/pia-daemon"
command_background=true
pidfile="/run/${name}.pid"
directory="/opt/piavpn"
user="pia"
group="pia"

want net
depend() {
    after firewall
    after dns
    after logger
    need localmount
    need sysfs
    need devfs
}

start_pre() {
    if [ ! -d "/run/pia-daemon" ]; then
        mkdir -p /run/pia-daemon
        chown pia:pia /run/pia-daemon
    fi
    return 0
}   

Make it executable:

sudo chmod +x /etc/init.d/pia-daemon   

Enable the service, start the daemon & check it's status:

sudo rc-update add pia-daemon default   

sudo rc-service pia-daemon start   

sudo rc-service pia-daemon status   

Note: That should work for all desktop environments and window managers both X11 & Wayland except for niri compositor. You will need to add this little step to make it work:

sudo emerge -av xwayland-satellite


sudo nano /usr/local/bin/pia-start.sh

# /usr/local/bin/pia-start.sh
#!/bin/sh
# Give xwayland-satellite a moment to initialize the socket
sleep 3
export DISPLAY=:0
exec /opt/piavpn/bin/pia-client

sudo chmod +x /usr/local/bin/pia-start.sh

Finally, add to autostart in config.kdl:

nano ~/.config/niri/autostart.kdl

// autostart.kdl
spawn-at-startup "xwayland-satellite"
spawn-at-startup "/usr/local/bin/pia-start.sh"

You can add this window rule:

window-rule {
    match app-id="pia-client"
    open-floating true
}