<h2 id="wireguard-how-to">Wireguard How To</h2>
<p>Firstly, I am not an expert. These are just my findings setting up wireguard at home and in my office at work.</p>
<p>I've used a program called <code>sshuttle</code> for 7/8 years to attach myself to my home and work networks when on public/untrusted networks or if I need to access some resource at work from home.</p>
<p>Sshuttle for the main part works great and the main benefit is that the only port you ever need to open on the server network is whichever port you have your ssh server running on.</p>
<p>The downside to sshuttle is that it won't work with my android devices so I've been using a paid for VPN called PIA on untrusted networks or just staying on 3g/4g and not have any way to connect to my home or work network.</p>
<p>Sshuttle is written in python and a few weeks ago Arch Linux moved to python 3.8 which broke sshuttle. There is a workaround using pyenv and a bug has been filled with the python team and a it's already been fixed upstream <a href="https://bugs.python.org/issue35415" class="uri">https://bugs.python.org/issue35415</a>.</p>
<p>Anyway.</p>
<p>I thought it was about time I looked at setting up a proper VPN on my work network.</p>
<p>So I spent a couple of hours reading up on openVPN and creating client and server certificates making a server config on the work server forwarding the port on the router to the server.</p>
<p>Then I spent a couple more hours poking around trying to figure out why it wouldn't work.</p>
<p>I eventually gave up frustrated.</p>
<p>I'm not blaming openVPN, I know it works for many many people, but I couldn't see what was wrong.</p>
<p>So I did what we all do in a situation like this.</p>
<p>I took to social media, which in my case is my pleroma server and posted a message to the fediverse.</p>
<p><em>"OpenVPN has fried my brain. Need booze"</em><br />
Then I had a beer, a nice cold Stiegl goldbrau if I remember right.</p>
<p>A few minutes later a message popped up from theru, it contained one word with a smiley face. Wireguard.</p>
<p>Now I had looked at wireguard a while ago. You might remember it hit the headlines because Linus Torvalds had praised how beautifully written the code was for it. It turns out what he said was "It's beautiful when compared to openVPN's code". Back then the how to guides were really hard, for me anyway to follow.</p>
<p>There were just examples of two machines on the same LAN connected together and I really struggled to get my head around it being serverless and both machines being peers to each other; after all openVPN has clients and servers and even sshuttle on my laptop connects to a server machine.</p>
<p>There where a couple of wiki pages that I read on Christmas Eve that gave me a lightbulb moment and some clarity on the way it worked. So I decided to try and set it up.</p>
<p>The articles acknowledge that it is a peer to peer technology and then go on to call one peer a server and the other peer the client.</p>
<p>Also I would recommend for your first client use an android device with the wireguard app. It's more user friendly in that some of the config is auto filled for you and then you can export the config file and examine it in a text editor later to get a better handle on things.</p>
<p>I'm going to assume that you have installed the wireguard packages for your system and that you have given your server a static IP on your network.</p>
<p>I'm using Arch linux on my servers but I see the Linode Debian 'how to' works in the same way.</p>
<p>So we are going to log into the server and start the setup.</p>
<h3 id="st-create-private-and-public-keys">1st create Private and Public keys</h3>
<p>Create directory for Keys</p>
<pre><code>cd ~
mkdir wireguard
cd wireguard</code></pre>
<p>Create Server Keys</p>
<pre><code>umask 077
wg genkey | tee privatekey | wg pubkey &gt; publickey</code></pre>
<p>Create sub directory for client1 keys</p>
<pre><code>mkdir client1
cd client1
wg genkey | tee privatekey | wg pubkey &gt; publickey</code></pre>
<p>Repeat for as many clients as needed</p>
<h3 id="createedit-wireguard-config">Create/edit wireguard config</h3>
<p>Check the interface name facing the internet is correct before copy/paste</p>
<pre><code>ifconfig</code></pre>
<p>Before you continue you will need to forwrd a port from your internet facing router to your server. Somewhere in your router settings you'll find a port forward setting. At home I have a Fritzbox and it's buried under network / permitted access. At work it's a Linksys ac1200 and it's under gaming / apps / single port forwarding. I'm sure you will find it.</p>
<p>The wireguard default port is 51820 and you'll find this port named in most of the how to's on the web. I use a different port number just to add a little bit of obsurity/security to my setup so if you choose to forward a different port from your router then remember to use that number in the configs.</p>
<p>Below is the working <code>wg0.conf</code> file from my arch server with one client</p>
<pre><code>[root@arch-server marshall]# cat /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.1/24
MTU = 1500
SaveConfig = false
ListenPort = 8801
PrivateKey = sBNF2igw+xxxxxHh0HWJL2SHZ0ltR+xxxxxaCN/Wu3o=
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D
POSTROUTING -o enp2s0 -j MASQUERADE

[Peer]
# BBKey2
PublicKey = Aeo8ya/wCW9dlfO1a5cEaApLTbCfqJVw/stVDi2gDh8=
AllowedIPs = 10.0.0.2/32</code></pre>
<p>Below is the working <code>wg0.conf</code> file from my archarm server with one client</p>
<pre><code>[root@alarmpi wireguard]# cat wg0.conf
[Interface]
Address = 10.0.0.1/24
MTU = 1500
SaveConfig = false
ListenPort = 8801
PrivateKey = GOzcxxxxx4+Gjs/50Ln+XFrlX0XXXXXKpeuf59IDnc=
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D
POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# BBKey2
PublicKey = CSJyWwknPQyhF+dRrB6TOBX55gJXnreNIpBiz3qsSm0=
AllowedIPs = 10.0.0.2/32</code></pre>
<h3 id="enable-ipv4-forwarding">Enable IPv4 forwarding</h3>
<p>On the server enable IPv4 forwarding using sysctl</p>
<pre><code>sysctl -w net.ipv4.ip_forward=1</code></pre>
<p>To make the change permanent. Add</p>
<pre><code>net.ipv4.ip_forward = 1</code></pre>
<p>to <code>/etc/sysctl.d/99-sysctl.conf</code></p>
<h3 id="check-if-everything-works">Check if everything works!</h3>
<p>Bring the tunnel up.</p>
<pre><code>wg-quick up wg0</code></pre>
<p>Check tunnel state and see currently connected peers.</p>
<pre><code>wg</code></pre>
<p>If it all works then use systemd to start the tunnel on boot.</p>
<pre><code>systemctl enable wg-quick@wg0.service</code></pre>
<h3 id="if-it-doesnt">If it doesn't</h3>
<p>More than likely it's IPv4 forwarding.</p>
<p>Try running <code>sysctl -w net.ipv4.ip_forward=1</code> again, or DNS on the client is set wrong.</p>
<h2 id="arch-linux">Arch linux</h2>
<pre><code>pacman -S wireguard-tools wireguard-arch dkms linux-headers</code></pre>
<p>ArchArm dkms + headers</p>
<pre><code>pacman -S dkms wireguard-tools wireguard-dkms linux-raspberrypi-headers</code></pre>
<h2 id="links">Links</h2>
<ul>
<li><a href="https://hackerpublicradio.org/eps.php?id=1263" class="uri">https://hackerpublicradio.org/eps.php?id=1263</a> &lt;--- the old sshuttle episode with NYbill</li>
<li><a href="https://aur.archlinux.org/packages/networkmanager-wireguard-git/" class="uri">https://aur.archlinux.org/packages/networkmanager-wireguard-git/</a></li>
<li><a href="https://github.com/max-moser/network-manager-wireguard" class="uri">https://github.com/max-moser/network-manager-wireguard</a></li>
<li><a href="https://wiki.archlinux.org/index.php/WireGuard" class="uri">https://wiki.archlinux.org/index.php/WireGuard</a></li>
<li><a href="https://www.linode.com/docs/networking/vpn/set-up-wireguard-vpn-on-ubuntu/" class="uri">https://www.linode.com/docs/networking/vpn/set-up-wireguard-vpn-on-ubuntu/</a></li>
</ul>
