Tags Archives: vpn

How To Configure Wireguard

To quote from Wikipedia:

 

WireGuard is a communication protocol and free and open-source software that implements encrypted virtual private networks (VPNs), and was designed with the goals of ease of use, high speed performance, and low attack surface. It aims for better performance and more power-saving than the IPsec and OpenVPN tunneling protocols. The WireGuard protocol passes traffic over UDP.

 

Wireguard is a peer-to-peer VPN, in other words, it does not use the traditional client-server model. A Wireguard peer can act as a traditional server or a client. Wireguard operates by establishing a network interface on each peer device that then acts as a tunnel.

 

Wireguard peers then authenticate each other by exchanging and validating their public keys. These keys are mapped with a list of IP addresses that are permitted to access the tunnel.

 

In comparison with other VPN solutions, such as OpenVPN and IPsec , WireGuard is much faster, is easier to configure, and also has a smaller footprint. Wireguard will run on Linux, Windows, Android, and macOS.

 

 

 

How to install Wireguard on Ubuntu

 

 

Wireguard is Peer-to-Peer – NOT client-server!

 

NOTE: Wireguard operates using a peer-to-peer architecture, not client-server. In the description below I refer to one of my machines on which I am installing Wireguard as server and the other as client, but this is merely my own designation and has no relevance for Wireguard itself.

 

 

The wireguard package contains two binaries:

 

wg — a tool for managing the configuration of WireGuard interfaces
wg-quick — a tool for easily starting and stopping WireGuard interfaces

 

 

To install on Ubuntu:

 

apt update

apt install wireguard

 

root@intel:/home/kevin# apt install wireguard
Reading package lists... Done
Building dependency tree 
Reading state information... Done
The following packages were automatically installed and are no longer required:
libphonenumber7 libprotobuf17
Use 'sudo apt autoremove' to remove them.
The following additional packages will be installed:
wireguard-tools
The following NEW packages will be installed:
wireguard wireguard-tools
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 86,6 kB of archives.
After this operation, 344 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://de.archive.ubuntu.com/ubuntu focal-updates/universe amd64 wireguard-tools amd64 1.0.20200513-1~20.04.2 [83,3 kB]
Get:2 http://de.archive.ubuntu.com/ubuntu focal-updates/universe amd64 wireguard all 1.0.20200513-1~20.04.2 [3.264 B]
Fetched 86,6 kB in 0s (378 kB/s) 
Selecting previously unselected package wireguard-tools.
(Reading database ... 235908 files and directories currently installed.)
Preparing to unpack .../wireguard-tools_1.0.20200513-1~20.04.2_amd64.deb ...
Unpacking wireguard-tools (1.0.20200513-1~20.04.2) ...
Selecting previously unselected package wireguard.
Preparing to unpack .../wireguard_1.0.20200513-1~20.04.2_all.deb ...
Unpacking wireguard (1.0.20200513-1~20.04.2) ...
Setting up wireguard-tools (1.0.20200513-1~20.04.2) ...
wg-quick.target is a disabled or a static unit, not starting it.
Setting up wireguard (1.0.20200513-1~20.04.2) ...
Processing triggers for man-db (2.9.1-1) ...
root@intel:/home/kevin#

 

Basic Wireguard Configuration

 

The wg and wg-quick Wireguard command-line tools are used to configure and manage the WireGuard interfaces.

 

Each device in the WireGuard VPN network must have a private and public key.  Generate the key pair with this command:

 

wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey | sudo tee /etc/wireguard/publickey

 

root@intel:~# wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey | sudo tee /etc/wireguard/publickey
Y+BuUdkyp+9pJlyfyBcYkCRgcbFqSv/TENH8TGyT6iA=
root@intel:~#

 

(this is your public key)

 

Always keep the private keys private and do not share with anyone!

 

Next, configure the tunnel device that will be used to route the Wireguard VPN traffic.  This tunnel device can be set up either from the command line using the ip and wg commands, or else by creating the configuration file as below.

 

Create a new file named wg0.conf and copy-paste the following contents:

 

nano /etc/wireguard/wg0.conf

 

[Interface]
Address = 10.0.0.1/24
SaveConfig = true
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE

 

NOTE – this is just an initial template. You must replace ens3 after -A POSTROUTING to match the name of your public network interface.  In my case, the public internet interface for my machine is wlp2s0

 

so we have:

 

[Interface]
Address = 10.0.0.1/24
SaveConfig = true
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o wlp2s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o wlp2s0 -j MASQUERADE

 

explanation:

 

Address – A comma-separated list of v4 or v6 IP addresses for the wg0 interface. Use IPs from a range that is reserved for private networks (10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16).

 

ListenPort – The listening port.

 

PrivateKey – A private key generated by the wg genkey command. (To see the contents of the file type: sudo cat /etc/wireguard/privatekey) Replace SERVER_PRIVATE_KEY with your copy-pasted private key – NOT the path to the privatekey file but the actual contents of the file!

 

SaveConfig – When set to true, the current state of the interface is saved to the configuration file when shutdown.

 

PostUp – Command or script that is executed before bringing the interface up. In this example, we’re using iptables to enable masquerading. This allows traffic to leave the server, giving the VPN clients access to the Internet.

 

 

Replace the network interface ens0 with your own public internet interface.

 

 

You can find this with:

 

root@intel:/etc/wireguard# ip -o -4 route show to default | awk '{print $5}'
wlp2s0
root@intel:/etc/wireguard#

Note for this installation instance Wireguard will be listening on port 51820.

 

 

Firewall Config for Wireguard

 

So you must also open this port in your firewall/s:

 

ufw allow 51820/udp

 

Note we are just opening the port for UDP, not for TCP!

 

Activate firewall if necessary with:

 

root@intel:~# ufw status 
Status: inactive
root@intel:~#


root@intel:~# ufw enable
Firewall is active and enabled on system startup
root@intel:~#

check with:

root@intel:~# ufw verbose
Status: active


To Action From
-- ------ ----
2812 ALLOW Anywhere 
51820/udp ALLOW Anywhere 
2812 (v6) ALLOW Anywhere (v6) 
51820/udp (v6) ALLOW Anywhere (v6)

root@intel:~#

 

and make sure you save the firewall config:

 

root@intel:~# iptables-save > /etc/iptables.rules

 

Then set the file permissions:

 

root@intel:/etc/wireguard# chmod 600 /etc/wireguard/{privatekey,wg0.conf}
root@intel:/etc/wireguard#

 

and then you should be all set to start the Wireguard interface:

 

root@intel:/etc/wireguard# wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.0.0.1/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o wlp2s0 -j MASQUERADE
root@intel:/etc/wireguard#

 

ifconfig shows that the device has been created, and has a virtual IP in the range we specified:

 

root@intel:/etc/wireguard# ifconfig wg0
wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP> mtu 1420
inet 10.0.0.1 netmask 255.255.255.0 destination 10.0.0.1
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 1000 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 174 dropped 0 overruns 0 carrier 0 collisions 0
root@intel:/etc/wireguard#

 

 

How To Remove a Wireguard Network Interface

 

 

Normally you would not want to do this, but you may wish to in some cases, including if you are deinstalling or deactivating Wireguard. I needed to do this in order to configure the systemd scripts for Wireguard:

 

root@intel:~# ifconfig wg0
wg0: flags=144<POINTOPOINT,NOARP> mtu 1420
inet 10.0.0.1 netmask 255.255.255.0 destination 10.0.0.1
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 1000 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 1179 dropped 0 overruns 0 carrier 0 collisions 0


root@intel:~# ip link delete dev wg0
root@intel:~# ifconfig wg0
wg0: error fetching interface information: Device not found
root@intel:~#

root@intel:~# ip link delete dev wg0
root@intel:~# ifconfig wg0
wg0: error fetching interface information: Device not found
root@intel:~# 
root@intel:~# systemctl enable wg-quick@wg0
Created symlink /etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service → /lib/systemd/system/wg-quick@.service.
root@intel:~# systemctl start wg-quick@wg0
root@intel:~# systemctl status wg-quick@wg0
● wg-quick@wg0.service - WireGuard via wg-quick(8) for wg0
Loaded: loaded (/lib/systemd/system/wg-quick@.service; enabled; vendor preset: enabled)
Active: active (exited) since Wed 2021-06-02 14:06:48 CEST; 3s ago
Docs: man:wg-quick(8)
man:wg(8)
https://www.wireguard.com/
https://www.wireguard.com/quickstart/
https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8
https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8
Process: 16684 ExecStart=/usr/bin/wg-quick up wg0 (code=exited, status=0/SUCCESS)
Main PID: 16684 (code=exited, status=0/SUCCESS)


Jun 02 14:06:48 intel systemd[1]: Starting WireGuard via wg-quick(8) for wg0...
Jun 02 14:06:48 intel wg-quick[16684]: [#] ip link add wg0 type wireguard
Jun 02 14:06:48 intel wg-quick[16684]: [#] wg setconf wg0 /dev/fd/63
Jun 02 14:06:48 intel wg-quick[16684]: [#] ip -4 address add 10.0.0.1/24 dev wg0
Jun 02 14:06:48 intel wg-quick[16684]: [#] ip link set mtu 1420 up dev wg0
Jun 02 14:06:48 intel wg-quick[16684]: [#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o wlp2s0 -j MASQUERADE
Jun 02 14:06:48 intel systemd[1]: Finished WireGuard via wg-quick(8) for wg0.
root@intel:~#

The device is then automatically created by the systemd scripts:

 

root@intel:~# ifconfig wg0
wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP> mtu 1420
inet 10.0.0.1 netmask 255.255.255.0 destination 10.0.0.1
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 1000 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 144 dropped 0 overruns 0 carrier 0 collisions 0

root@intel:~#


root@intel:~# wg
interface: wg0
public key: Y+BuUdkyp+9pJlyfyBcYkCRgcbFqSv/TENH8TGyT6iA=
private key: (hidden)
listening port: 51820
root@intel:~#

root@intel:~# wg --help
Usage: wg <cmd> [<args>]


Available subcommands:
show: Shows the current configuration and device information
showconf: Shows the current configuration of a given WireGuard interface, for use with `setconf'
set: Change the current configuration, add peers, remove peers, or change peers
setconf: Applies a configuration file to a WireGuard interface
addconf: Appends a configuration file to a WireGuard interface
syncconf: Synchronizes a configuration file to a WireGuard interface
genkey: Generates a new private key and writes it to stdout
genpsk: Generates a new preshared key and writes it to stdout
pubkey: Reads a private key from stdin and writes a public key to stdout
You may pass `--help' to any of these subcommands to view usage.
root@intel:~#

When you want a client to be given permission to connect to your Wireguard VPN tunnel, you add the following to the wg0.conf:

 

[Peer] PublicKey = <public_key_of_your_peer> # OPTIONAL, its also possible to define a pre-shared key for additional security.

 

PresharedKey = <pre-shared key> # at least one peer needs to provide this one.

 

Endpoint = <end_point_hostname_or_ip:port> # in theory this could be restricted to dn42 networks, however it is easier to do this with iptables/bgp filters/routing table instead just like for openvpn-based peering.

 

AllowedIPs = 0.0.0.0/0,::/0

 

Manual Configuration of Wireguard server/client hosts

 

 

syntax:

 

wg set wg0 listen-port 51820 private-key /path/to/peer_A.key

 

so we do ON server, then on client: same but with different ip – also check the respective network interface device names are correct!

 

server:

root@gemini:/etc/wireguard# ip link add dev wg0 type wireguard
root@gemini:/etc/wireguard# ip addr add 10.0.0.1/24 dev wg0
root@gemini:/etc/wireguard# wg set wg0 listen-port 51820 private-key privatekey
root@gemini:/etc/wireguard# ip link set wg0 up



root@gemini:/etc/wireguard# wg
interface: wg0
public key: L+sHb++AKFZkhDzrSLAhhhxM6SfrpQhVmRFDfUp7lSo=
private key: (hidden)
listening port: 51820
root@gemini:/etc/wireguard#



client:
root@intel:/etc/wireguard# ip link add dev wg0 type wireguard
root@intel:/etc/wireguard# ip addr add 10.0.0.2/24 dev wg0 
root@intel:/etc/wireguard# wg set wg0 listen-port 51820 private-key privatekey
root@intel:/etc/wireguard# ip link set wg0 up

root@intel:/etc/wireguard# wg
interface: wg0
public key: F8OQkGTjovRIxzvr4YKfpeq7vhAFqQjPKUyh9Eauf04=
private key: (hidden)
listening port: 51820
root@intel:/etc/wireguard#

 

then – ESSENTIAL – DO NOT FORGET – this sets the peer relationship – else no connection possible:

root@intel:/etc/wireguard# wg set wg0 peer L+sHb++AKFZkhDzrSLAhhhxM6SfrpQhVmRFDfUp7lSo= allowed-ips 10.0.0.1 endpoint 10.147.18.185:51820
root@intel:/etc/wireguard# wg
interface: wg0
public key: F8OQkGTjovRIxzvr4YKfpeq7vhAFqQjPKUyh9Eauf04=
private key: (hidden)
listening port: 51820

peer: L+sHb++AKFZkhDzrSLAhhhxM6SfrpQhVmRFDfUp7lSo=
endpoint: 10.147.18.185:51820
allowed ips: 10.0.0.1/32
root@intel:/etc/wireguard#

 

and on the other machine:

root@gemini:/etc/wireguard# wg set wg0 peer F8OQkGTjovRIxzvr4YKfpeq7vhAFqQjPKUyh9Eauf04= allowed-ips 10.0.0.2 endpoint 10.147.18.84:51280




root@gemini:/etc/wireguard#

root@gemini:/etc/wireguard# wg interface: wg0 public key: L+sHb++AKFZkhDzrSLAhhhxM6SfrpQhVmRFDfUp7lSo= private key: (hidden)

listening port: 51820 peer: F8OQkGTjovRIxzvr4YKfpeq7vhAFqQjPKUyh9Eauf04= endpoint: 10.147.18.84:51280 allowed ips: 10.0.0.2/32 transfer: 0 B received, 1.30 KiB sent

root@gemini:/etc/wireguard# 


 

Set IP Forwarding:

 

root@intel:/etc/wireguard# sysctl -w net.ipv6.conf.all.forwarding=1
net.ipv6.conf.all.forwarding = 1
root@intel:/etc/wireguard# sysctl -w net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1
root@intel:/etc/wireguard# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.ip_forward = 1
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.all.forwarding = 1
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2
root@intel:/etc/wireguard#


root@gemini:/etc/wireguard# sysctl -w net.ipv6.conf.all.forwarding=1
net.ipv6.conf.all.forwarding = 1
root@gemini:/etc/wireguard# sysctl -w net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1
root@gemini:/etc/wireguard# sysctl -p
net.ipv4.ip_forward = 1
net.ipv6.conf.all.accept_ra = 2
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
root@gemini:/etc/wireguard#

 

root@intel:/etc/wireguard# ifconfig wg0
wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP> mtu 1420
inet 10.0.0.2 netmask 255.255.255.0 destination 10.0.0.2
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 1000 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 117 dropped 0 overruns 0 carrier 0 collisions 0

root@intel:/etc/wireguard# wg
interface: wg0
public key: F8OQkGTjovRIxzvr4YKfpeq7vhAFqQjPKUyh9Eauf04=
private key: (hidden)
listening port: 48886
root@intel:/etc/wireguard#


server:

root@gemini:/etc/wireguard# wg
interface: wg0
public key: L+sHb++AKFZkhDzrSLAhhhxM6SfrpQhVmRFDfUp7lSo=
private key: (hidden)
listening port: 43193

peer: F8OQkGTjovRIxzvr4YKfpeq7vhAFqQjPKUyh9Eauf04=
endpoint: 10.147.18.84:36244
allowed ips: 10.0.0.2/32
root@gemini:/etc/wireguard#

root@gemini:/etc/wireguard# cat wg0.conf
[Interface]
Address = 10.0.0.1/24
SaveConfig = true
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ztppizdp4o -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ztppizdp4o -j MASQUERADE
ListenPort = 43193
PrivateKey = (hidden)

[Peer]
PublicKey = F8OQkGTjovRIxzvr4YKfpeq7vhAFqQjPKUyh9Eauf04=
AllowedIPs = 10.0.0.2/32
Endpoint = 10.147.18.84:36244
root@gemini:/etc/wireguard#

 

 

Demo Wireguard Server Connection for Testing Purposes

 

Wireguard also provides a test script and external server facility for demo purposes which you can use. See below.

 

After installing WireGuard, you can test your connection using the Wireguard script client.sh located in
/usr/local/bin/wireguard-tools/plain/contrib/examples/ncat-client-server#

 

$ sudo contrib/examples/ncat-client-server/client.sh

 

 

Run this script and it will automatically setup interface wg0, though using a very insecure transport link only suitable for demo purposes:

 

 

root@intel:/usr/local/bin/wireguard-tools/plain/contrib/examples/ncat-client-server# ./client.sh
root@intel:/usr/local/bin/wireguard-tools/plain/contrib/examples/ncat-client-server# 



root@intel:/usr/local/bin/wireguard-tools/plain# wg
interface: wg0
public key: RORt0LWXzqYdeJ1YYusvyly5JdiBmWrT8hmNgfNlVkk=
private key: (hidden)
listening port: 49101


peer: JRI8Xc0zKP9kXk8qP84NdUQA04h6DLfFbwJn4g+/PFs=
endpoint: 163.172.161.0:12912
allowed ips: 0.0.0.0/0
latest handshake: 1 minute, 25 seconds ago
transfer: 40.77 KiB received, 114.82 KiB sent
persistent keepalive: every 25 seconds
root@intel:/usr/local/bin/wireguard-tools/plain#




root@intel:/usr/local/bin/wireguard-tools/plain/contrib/examples/ncat-client-server# ifconfig wg0
wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP> mtu 1420
inet 192.168.4.46 netmask 255.255.255.0 destination 192.168.4.46
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 1000 (UNSPEC)
RX packets 102 bytes 47496 (47.4 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1173 bytes 227352 (227.3 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

root@intel:/usr/local/bin/wireguard-tools/plain/contrib/examples/ncat-client-server#



root@intel:/usr/local/bin/wireguard-tools/plain/contrib/examples/ncat-client-server# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.178.1 0.0.0.0 UG 600 0 0 wlp2s0
10.147.18.0 0.0.0.0 255.255.255.0 U 0 0 0 ztppizdp4o
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 virbr0
192.168.4.0 0.0.0.0 255.255.255.0 U 0 0 0 wg0
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0
192.168.178.0 0.0.0.0 255.255.255.0 U 600 0 0 wlp2s0
root@intel:/usr/local/bin/wireguard-tools/plain/contrib/examples/ncat-client-server#



You can then test loading the hidden website at http://192.168.4.1 in a web-browser and sending pings: (you can use any browser, just point browser at the http://192.168.4.1

 

 

To redirect your internet traffic using the Wireguard demo server, you can configure it as:

 

$ sudo contrib/examples/ncat-client-server/client.sh default-route
$ curl zx2c4.com/ip
163.172.161.0
demo.wireguard.com
curl/7.49.1

However, as Wireguard states, “By connecting to this server, you acknowledge that you will not use it for any abusive or illegal purposes and that your traffic may be monitored.”

 

 

When you have finished the test you should disconnect the link:

 

wg-quick down wg0

root@intel:~# wg-quick down wg0
[#] wg showconf wg0
[#] ip link delete dev wg0
[#] iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ztppizdp4o -j MASQUERADE
root@intel:~# wg
root@intel:~#

 

Wireguard Debug Info

If you’re using the Linux kernel module and your kernel supports dynamic debugging, you can get useful runtime output by enabling dynamic debug for the module:

 

# modprobe wireguard && echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control

 

If you’re using a userspace implementation, set the environment variable export LOG_LEVEL=verbose.

 

 

For more info, visit https://www.wireguard.com/quickstart/

 

Continue Reading