Wireguard Configuration

Personal Site-to-Site VPN for securely accessing your devices over the public internet.

WORK IN PROGRESS
WORK IN PROGRESS
don't be copy and pasting anything anywhere yet
WORK IN PROGRESS
WORK IN PROGRESS

Wireguard is a lightweight and modern VPN protocol.

Wireguard does not think in terms of Server/Client; all members of a wireguard network are called "Peers".
However, we will refer to the VPS as a "server" and your personal devices as "clients" for clarity.

VPS setup

SSH in using the credentials and address your hosting company provided.

  1. Update your package manager, then install wireguard
    sudo apt-get update -y && apt-get upgrade
    sudo apt-get install wireguard resolvconf
  2. Copy/Paste your ssh public key to the VPS user's authorized_keys file, then confirm you can sign in without entering a password.
    cat /path/to/public_key.file >> /home/username/.ssh/authorized_keys
  3. Edit your ssh service configuaration to exclusively allow private key sign on. Your sshd_config file will have many lines, but we care about the following:

    /etc/ssh/sshd_config

    PasswordAuthentication no
    PermitEmptyPasswords no
    KbdInteractiveAuthentication no
    PubkeyAuthentication yes

  4. Restart your sshd servce to use new configuration file:
    sudo systemd restart sshd
  5. At this point your server is secure enough to be public facing on the internet.
    While the Most Correct among us would enable fail2ban and/or ufw, that is another tutorial entirely.

Server config - Initial Setup

Your wireguard configuration files will be stored in the directory /etc/wireguard.
Navigate to /etc/wireguard before completing the following steps:

  1. Wireguard uses private and public keys, similar to ssh.:
    sudo wg genkey > wg_key.private
    sudo wg pubkey < wg_key.private > wg_key.public
  2. Create the wireguard configuration file. This should be named after the interface name, which generally looks like "wg0", "wg1" and so on.

    /etc/wireguard/wg0.conf

    [Interface]
    Privatekey = [ server private key ]
    Address = 10.1.1.1/24
    ListenPort = 51820
    SaveConfig = true
    PostUp = iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT
    PostDown = iptables -D FORWARD -i wg0 -o wg0 -j ACCEPT

Client config

  1. Generate the client's keys just as you did for the server:
    sudo wg genkey > wg_key.private
    sudo wg pubkey < wg_key.private > wg_key.public
  2. Create the client's configuration file:

    /etc/wireguard/wg0.conf

    [Interface]
    PrivateKey = [client's private key]
    Address = 10.1.1.100/32
    ListenPort = 51820
    PostUp = ping -c5 10.1.1.1
    [Peer]
    PublicKey = [server's public key]
    Endpoint = [server's public IP]:51820
    AllowedIPs = 10.1.1.1/24
    PersistentKeepAlive = 25

Server Config - Adding New clients

The server and client are now ready to communicate, but the VPS needs to be made aware of all new clients.

  1. SSH to your VPS via its public ip, and bring down the wireguard interface:
    sudo wg-quick down wg0
  2. Edit your server's wireguard configuration file, appending it with these lines:

    /etc/wireguard/wg0.conf

    [Peer]
    PublicKey = [ new client's pubkey ]
    AllowedIPs = [ client's address ]

  3. Bring the wireguard interface back up: sudo wg-quick up wg0

Things deserving explanation:
+AllowedIPs field
+Address field
+/32 vs /24 in the address field
+Endpoint field
+PersistentKeepAlive
+ListenPort
+PostUp rules
+Server relay info

Edit
Pub: 10 Feb 2023 07:12 UTC
Edit: 05 Apr 2023 00:26 UTC
Views: 116