Background#

As easier or ad-hoc VPN solution to openvpn, wireguard provides user space tools for point-to-point networking with roaming clients.

One static public host is needed.

Network topology#

Server#

Any publicly reachable host with optional DNS name.

It also has private address 172.16.0.1 for WG interface.

Roaming peer 1#

Using any network anywhere. WG address is 172.16.0.2

Package setup for all hosts#

sudo apt install wireguard-tools

Key generation#

Server#

wg genkey >/root/wg/srv.key
wg pubkey </root/wg/srv.key >/root/wg/srv.pub

Peer 1#

wg genkey >/root/wg/stinky.key
wg pubkey </root/wg/stinky.key >/root/wg/stinky.pub

Server setup#

Allow traffic at udp/12345#

ufw allow udp/12345 comment 'wireguard'

Public server config#

The peer key below is stinky.pub contents

ip link add dev wg0 type wireguard
ip addr add 172.16.0.1/24 dev wg0
wg set wg0 listen-port 12345 private-key /root/wg/srv.key
wg set wg0 peer vLhJaD5WdSrWwJ8q1pbvxoI5fnechuZIXPsZcjXwvXQ= allowed-ips 172.16.0.2/32
ip link set wg0 up

Roaming peer 1 config#

The peer key below is srv.pub contents

ip link add dev wg0 type wireguard
ip addr add 172.16.0.2/24 dev wg0
wg set wg0 private-key /root/wg/stinky.key
wg set wg0 peer I/MRiNBeHqzbofTavUjRaAO7EOsN2cGw3YVCYOOjI3E= allowed-ips 172.16.0.1/32 endpoint <srv-ip-address>:12345 persistent-keepalive 30
ip link set wg0 up

All done#

The hosts are reachable to eath others.

In case of problems, set ipv4 forwarding active on both sides:

sysctl -w net.ipv4.ip_forward=1

Connection teardown - all hosts#

ip link del wg0

Debug logging#

Enable#

echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control
journalctl -kf

Disable#

echo module wireguard -p > /sys/kernel/debug/dynamic_debug/control

Systemd-networkd integration#

Server setup#

/etc/systemd/network/99-wg0.netdev

[NetDev]
Name=wg0
Kind=wireguard
Description=WireGuard tunnel wg0

[WireGuard]
ListenPort=12345
PrivateKeyFile=/root/wg/srv.key

[WireGuardPeer]
PublicKey=vLhJaD5WdSrWwJ8q1pbvxoI5fnechuZIXPsZcjXwvXQ=
AllowedIPs=172.16.0.2/32

/etc/systemd/network/99-wg0.network

[Match]
Name=wg0

[Network]
Address=172.16.0.1/24

Peer setup#

/etc/systemd/network/99-wg0.netdev

[NetDev]
Name=wg0
Kind=wireguard
Description=WireGuard tunnel wg0

[WireGuard]
PrivateKeyFile=/root/wg/stinky.key

[WireGuardPeer]
PublicKey=I/MRiNBeHqzbofTavUjRaAO7EOsN2cGw3YVCYOOjI3E=
AllowedIPs=172.16.0.1/32
Endpoint=<srv-ip-address>:12345
PersistentKeepalive=30

/etc/systemd/network/99-wg0.network

[Match]
Name=wg0

[Network]
Address=172.16.0.2/24