Skip to content

Wireguard 101

Install Wireguard - Ubuntu

Setup:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
                    Server: sec1 wg0 interface IP: 10.255.0.1/24                       
                                 lan interface IP: 10.200.0.129/24                     
                    Client: sec2 wg0 interface IP: 10.255.0.2/24                       
                                 lan interface IP: 10.200.0.1/24                       


   10.255.0.2/24                                                       10.255.0.1/24   
       +-+wg0                                                              +-+wg0      
+------|-|------+                 +--------------+                   +-----|-|-------+ 
|      +-+      |                 |              |                   |     +-+       | 
|               |.2             .1|              |.1               .2|               | 
|      sec2     +-----------------+     rtr      +-------------------+     sec1      | 
|    (client)   |   10.1.2.0/30   |              |    10.2.2.0/30    |   (server)    | 
|               |                 |              |                   |               | 
+-------+-------+                 +--------------+                   +------+--------+ 
        |.1                                                                 |.129      
        |                                                                   |          
        |                                                                   |          
   10.200.0.0/25                                                      10.200.0.128/25

Errr.... 

1
sudo apt install wireguard

Generate private and public keys

Server keys

We need:

  • Private Key
  • Public Key
  • Pre-Shared Key to be shared with the peer

Generate private key:

1
2
umask 077
wg genkey | tee sec1privkey |

Get public key from private key:

1
wg pubkey < sec1privkey > sec1pubkey

Or, allinone:

1
2
wg genkey | tee sec1privkey | wg pubkey | tee sec1pubkey
lT61L0T8aWqYY8V8G+EZcOjgALpYNxP4kKguJYn9m10=

Generate one PresharedKey:

1
2
wg genpsk | tee peer1psk
yj3y2tPbKYfqY1J+JKJhlC8z3+/fYn/AEDFLdU2LJ+U=

Client Keys

Generate both private (sec2privkey) and public (sec2pubkey) keys.

1
2
$ wg genkey | tee sec2privkey | wg pubkey | tee sec2pubkey
grJVna5varQsSRxhw4bd5WHG5njbWhzAMz9VISXC6nw=

Create tunnels

Imperative approach (using command line)

Server

1
2
3
4
sudo ip link add wg0 type wireguard
sudo ip address add 10.255.0.1/24 dev wg0 
sudo ip link set wg0 up
sudo wg set wg0 listen-port 51999 private-key /home/benoit/sec1privkey peer grJVna5varQsSRxhw4bd5WHG5njbWhzAMz9VISXC6nw= preshared-key /home/benoit/peer1psk persistent-keepalive 5 allowed-ips 10.255.0.0/24,10.200.0.0/24

Client

1
2
3
4
5
sudo ip link add wg0 type wireguard
sudo ip address add 10.255.0.2/24 dev wg0 
sudo ip link set wg0 up
sudo wg set wg0 private-key /home/benoit/sec2privkey peer lT61L0T8aWqYY8V8G+EZcOjgALpYNxP4kKguJYn9m10=  preshared-key /home/benoit/peer1psk endpoint 10.1.2.2:51999 persistent-keepalive 5 allowed-ips 10.255.0.0/24,10.200.0.0/24
sudo ip route add 10.200.0.0/24 via 10.255.0.1 dev wg0

Should be working now.

Declarative approach (as a service)

Server

Set the configuration file as wg0.conf in /etc/wireguard/ 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
[Interface]
Address = 10.255.0.1/24
ListenPort = 51999
PrivateKey = ODu244dm66Q1oyzuoW/YSordd4KoAxiBtWW2CHwwkFU=

[Peer]
PresharedKey = yj3y2tPbKYfqY1J+JKJhlC8z3+/fYn/AEDFLdU2LJ+U=
PublicKey = grJVna5varQsSRxhw4bd5WHG5njbWhzAMz9VISXC6nw=
AllowedIPs = 10.255.0.0/24, 10.200.0.0/24
PersistentKeepalive = 5

Client

Create the configuration file wg0.conf in /etc/wireguard/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
[Interface] 
Address = 10.255.0.2/24
PrivateKey = kF+G/mY6wPeKbdmwNqgTQINvMZ22ygnfQWBtPg0ufm4= 

[Peer]
PresharedKey = yj3y2tPbKYfqY1J+JKJhlC8z3+/fYn/AEDFLdU2LJ+U=
PublicKey = lT61L0T8aWqYY8V8G+EZcOjgALpYNxP4kKguJYn9m10= 
AllowedIPs = 10.255.0.0/24, 10.200.0.0/24 
Endpoint = 10.1.2.2:51999
PersistentKeepalive = 5

Action commands with wg-quick

Bring up the tunnel:

1
wg-quick up wg0

Bring down the tunnel:

1
wg-quick down wg0

Enable the service

First ensure tunnel is down with wg-quick down wg0 Then start wg-quick service:

1
2
3
sudo systemctl enable wg-quick@wg0.service
sudo systemctl start wg-quick@wg0.service
sudo systemctl status wg-quick@wg0.service

Checks

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
sudo wg show all
interface: wg0
  public key: lT61L0T8aWqYY8V8G+EZcOjgALpYNxP4kKguJYn9m10=
  private key: (hidden)
  listening port: 51999

peer: grJVna5varQsSRxhw4bd5WHG5njbWhzAMz9VISXC6nw=
  preshared key: (hidden)
  endpoint: 10.2.2.2:34467
  allowed ips: 10.255.0.0/24, 10.200.0.0/24
  latest handshake: 17 minutes, 31 seconds ago
  transfer: 436 B received, 348 B sent

Additional stuff

Exclusive VPN

If you want to send all traffic through the tunnel, update AlloweIPs

1
2
3
4
[Peer]
<...>
AllowedIPs = 0.0.0.0/0
<...>

DNS

You can add your own DNS that will override configured DNS (useful with AllowedIPs = 0.0.0.0/0):

1
2
3
4
[Interface]
<...>
DNS = 8.8.8.8, 9.9.9.9
<...>

Kill-Switch

To prevent the flow of unencrypted packets through the non-WireGuard interfaces, add the following lines to the [Interface] section:

1
2
PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL --jump REJECT

Debug

1
2
$ sudo modprobe wireguard 
$ echo module wireguard +p | sudo tee  /sys/kernel/debug/dynamic_debug/control

Check message with:

1
sudo dmesg