Wireguard is the new kid on the block to open source VPN servers, let’s check it out.
The code base is described as slim, quick, and easy to set up.
I’m starting off with a new and ready to go Ubuntu 20.04 installation, let’s check out Wireguard
I start things off with installing the WireGuard package
sudo apt install wireguard
I switch to the root user and navigate to the /etc/wireguard folder, we can’t access the /etc/wireguard folder being just a normal user. That’s for a good reason too.
sudo -i
cd /etc/wireguard
Now that we are in the folder, we want to create our private key and public key.
The private and public keys make up the main security border to getting access to the Wireguard server so we will want to be careful with these.
We restrict access with our certificates by creating them with special file permissions to allow the ‘root’ user to only have access.
By setting the command umask 077; only the owner and group ‘root’ will have access to these certificates
umask 077
We can now safely generate our private and public keys, we accomplish this by running the command below:
wg genkey | tee privatekey | wg pubkey > publickey
This command generates a private key, sends that output to a file ‘privatekey’ and also sends it to another Wireguard command to generate a public key.
A key part to remember here is that that the private key is to be kept private!
Let’s create a configuration file for Wireguard within /etc/wireguard with nano
nano wg0.conf
Populate the file with the information below
[Interface]
# A seperate IP range for your VPN clients
Address = 10.X.X.254/24
# VPN Server Port
ListenPort = 51820
# The Servers Private Key
PrivateKey = Enter the value from the privatekey file here
We’ll likely want the server to run at boot time which can be enabled with this command
sudo systemctl enable wg-quick@wg0
And we can switch Wireguard on now with this command:
sudo systemctl start wg-quick@wg0
To verify the server has started OK, check that it’s IP address shows with network status:
# ip a show wg0
3: wg0: mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 10.X.X.254/24 scope global wg0
valid_lft forever preferred_lft forever
Great! The server is running. Port forwarding to the server is outside of the scope of this post, but I have forwarded UDP 51820 on my router to the private IP address of the Ubuntu system.
Let’s set up a client to test with, I’ll use my Android Phone with the WireGuard app below:
https://play.google.com/store/apps/details?id=com.wireguard.android&hl=en_GB
After setting up the WireGuard app on the phone, creating a new profile will require copying the public key from the server to the phone.
The settings I went for on the phone app are as follows:
Name – Whatever
Private Key – Tapped a few times to generate
Public Key – Copy this and keep it safe for your server configuration
Addresses: Enter the clients IP address here
DNS Servers: Enter the DNS server you want to use whilst connected to the VPN
There is an option to add a peer, this is where the server details go:
Public Key – Public key from the server
Pre-shared key – Blank
Persistent keepalive – Blank
Endpoint – Enter the VPN server address, if you have port forwarded this will be the WAN IP
Allowed IP/s – Traffic that should be routed to the VPN server, if you want to route all traffic enter 0.0.0.0/0
The phone will generate it’s own public key which will need to be copied back to the server.
Add the section of the client to the wg0.conf file with nano:
[Peer]
# The Public Key Provided By The Client
PublicKey = ThePublicKeyCopiedFromTheClient
# The Clients IP Address
AllowedIPs = 10.X.X.1/32
Once that is done we can restart the client:
sudo systemctl stop wg-quick@wg0
sudo systemctl start wg-quick@wg0
At this stage if you connect the client to the server, both sides should be able to ping each other.
As I’ll be using this to access the rest of my LAN, it will be good to allow the Ubuntu OS to forward packets onwards. This is quite easy to do by running this command:
sysctl -w net.ipv4.ip_forward=1
This concludes the set-up of WireGuard server, a lot easier than OpenVPN for sure!