Pre-requisites

vanilla install of Raspbian (You should be able to login using pi/raspberry)

Ansible setup

To keep things simple, we're going to install directly onto the pi. Ansible is not available in the pi apt repositories, so we'll install it using pip:

ssh-keygen    (go with defaults and no password)
sudo apt-get update
sudo apt-get install python-dev python-pip sshpass git
sudo pip install ansible
git clone https://github.com/coder36/raspi-ansible.git
cd raspi-ansible

bootstrap

The bootstrap playbook will install an ansible user, and give it the appropriate sudoers rights.

ssh 127.0.0.1  (selecting yes when asked about key fingerprint, password: raspberry)

You need to do this to add an entry to the known hosts.

cd ~/raspi-ansible
ansible-playbook -i live bootstrap.yml -k     (provide password for pi user)

From here on in, you will not need to provide a password. You have created effectively an ansible server, with the pi itself acting as a ansible node.

Dev tools

Installs tmux, vim, zsh and git

ansible-playbook -i live dev-tools.yml

Openvpn

The openvpn playbook is configured to use 2 factor authentication using the google authenticator PAM module, so its about as secure as you can get. Once the client has connected, they should have full visiblity of the home local network. As it uses UDP, it should be fairly stable. Once you have vpn'ed in to your home network you can:

Use Remote Desk Top
ssh (it's much more stable over UDP)
Remotely administer your home router

live inventory

Edit the live inventory file, to include your home network specifics:

[pi]
127.0.0.1 isp_ip="123.1.12.22" local_lan="192.168.101.0" local_lan_mask="255.255.255.0" vpn_lan="10.8.0.0" vpn_lan_mask="255.255.255.0"

The isp_ip should be set your ip address. This will change over time, so you could set up a noip url.
The local_lan will be made available on the machine connected by the VPN.
The vpn_lan is the subnet range, which will be allocated to each of the vpn clients.

Certs and private keys

You can use the certs and keys provided, however you should really generate your own.

Place your certs into /home/vagrant/playbooks/roles/vpn-server/templates/etc/openvpn, and also generate a new Diffie hellman parameter using: openssl dhparam -out dh1024.pem 1024

I found a really good windows utility for generating signed certs.

Apply the vpn playbook

cd ~/raspi-ansible
ansible-playbook -i live vpn.yml
sudo /etc/network/if-up.d/openvpn_firewall

I'm not sure of the openvpn_firewall script is needed.

This will create a client config file: /etc/openvpn/client.ovpn which can be imported directly into an openvpn client.

On your router

Forward port 1194 (UDP) to your raspberry pi.

Sign up for noip. It's free and allows you to connect to your home network using a publically avaialle DNS enter... ie. fredshomerouter.hopto.org. You may be able to configure your home router to automatically update noip with your ISP assigned ip address.

Testing

Install openvpn on your phone
Install google authenticator on your phone.
Somehow get the client.ovpn onto your phone. (You could email it to yourself then download it!)

2 factor authentication

For each user of your vpn, you will need to generate a user on the raspberry pi, and a run google-authenticator.

Log onto the raspberry pi using pi/raspberry

sudo adduser fred (provide password as 'monday', and go with defaults for the remaining of the prompts)
su - fred   (password: monday)
google-authenticator  (Answer y to the questions)

This will generate a QR code. Scan this into your phone using the google authenticator app. There is also a URL, which you could email to the user.

On your phone

Disable wifi, to ensure that you are not connecting via your home network. Use mobile data ie. 3g.
Open openvpn and import client.ovpn.

You will be prompted for a username and password:

username: fred password: monday13520

The password, is fred's password concatenated with the google authenticator verification code provided by the app.

You should now be able navigate to your routers home page ie.: http://192.168.101.254