Configure a Wireguard interface (wg): Difference between revisions
(The example for the ifupdown section caused a RTNETLINK answers: File exists an could be simplified since the introduction of ifupdown-ng in alpine 3.13.0 which has a wireguard executor) |
No edit summary |
||
Line 1: | Line 1: | ||
WireGuard is a very promising VPN technology | WireGuard is a very promising VPN technology available in the community repository since Alpine 3.10 | ||
There are several ways to install and configure an interface. | There are several ways to install and configure an interface. | ||
Line 35: | Line 35: | ||
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT | PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT | ||
The PostUp and PostDown steps are there to ensure the interface wg0 will accept and forward traffic to eth0. The postrouting and forward to %i is not required but it will enable "VPN mode" where users can access the internet | The PostUp and PostDown steps are there to ensure the interface wg0 will accept and forward traffic to eth0. The postrouting and forward to %i is not required, but it will enable "VPN mode" where users can access the internet via this server if desired. Reference this WireGuard documentation for information on adding peers to the config file. | ||
To bring up the new interface we | To bring up the new interface we use | ||
wg-quick up wg0 | wg-quick up wg0 | ||
To | To take it down, we can use <code>wg-quick down wg0</code> which will clean up the interface and remove the ip table rules. | ||
Note | Note: If running in a Docker container, you will need to run with <code>--cap-add=NET_ADMIN</code> to modify your interfaces. | ||
== Bringing up an interface using ifupdown-ng == | == Bringing up an interface using ifupdown-ng == | ||
The official documents from wireguard | The official documents from wireguard show examples of how to set up an interface with the use of wg-quick. | ||
In this | In this how-to, we are not going to use that utility. We'll use the plain wg command and [https://github.com/ifupdown-ng/ifupdown-ng/blob/master/doc/interfaces-wireguard.scd ifupdown-ng]. | ||
apk add wireguard-tools-wg | apk add wireguard-tools-wg | ||
Now that | Now that all the tools are installed, you can setup the interface. | ||
The setup of your interface config is out of the scope of this document | The setup of your interface config is out of the scope of this document. You should consult the [https://git.zx2c4.com/WireGuard/about/src/tools/man/wg.8 manual page of wg]. | ||
After you have finished setting up your wgX interface config you can add it to your /etc/network/interfaces: | After you have finished setting up your wgX interface config, you can add it to your /etc/network/interfaces: | ||
auto wg0 | auto wg0 | ||
Line 62: | Line 62: | ||
address 192.168.42.1 | address 192.168.42.1 | ||
This config automatically | This config will automatically: | ||
* bring the wireguard interface up after the eth0 interface | * bring the wireguard interface up after the eth0 interface | ||
* assign a config to this interface (which you have previously created) | * assign a config to this interface (which you have previously created) | ||
* setup the interface address and netmask | * setup the interface address and netmask | ||
* add the route | * add the route once the interface is up | ||
* remove the interface when it goes down | * remove the interface when it goes down | ||
To start the interface | To start and stop the interface, you execute: | ||
ifup wg0 | ifup wg0 | ||
Line 78: | Line 78: | ||
== Running with modloop == | == Running with modloop == | ||
If you are running from a RAM disk you can't modify the modloop. | If you are running from a RAM disk, you can't modify the modloop. | ||
You can get around it by unpacking the modloop, | You can get around it by unpacking the modloop, mounting the unpacked modules folder, then installing wireguard. | ||
#!/bin/sh | #!/bin/sh | ||
Line 91: | Line 91: | ||
apk add wireguard-tools | apk add wireguard-tools | ||
You can repack the squash filesystem or put this script in the /etc/local.d/ path so it runs at boot-up. | |||
[[Category:Networking]] | [[Category:Networking]] |
Revision as of 17:18, 23 July 2021
WireGuard is a very promising VPN technology available in the community repository since Alpine 3.10
There are several ways to install and configure an interface.
In order to load the wireguard kernel module, you need a compatible kernel:
- linux-lts
- linux-virt
Bringing up an interface using wg-tools
The most straightforward method, and the one recommended in WireGuard documentation, is to use wg-quick
.
Install wireguard-tools
apk add wireguard-tools
Then load the module
modprobe wireguard
Add it to /etc/modules
to automatically load it on boot.
Then we need to create a private and public key
wg genkey | tee privatekey | wg pubkey > publickey
Then we create a new config file /etc/wireguard/wg0.conf
using those keys
[Interface] Address = 10.123.0.1/24 ListenPort = 45340 PrivateKey = SG1nXk2+kAAKnMkL5aX3NSFPaGjf9SQI/wWwFj9l9U4= # the key from the previously generated privatekey file PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT
The PostUp and PostDown steps are there to ensure the interface wg0 will accept and forward traffic to eth0. The postrouting and forward to %i is not required, but it will enable "VPN mode" where users can access the internet via this server if desired. Reference this WireGuard documentation for information on adding peers to the config file.
To bring up the new interface we use
wg-quick up wg0
To take it down, we can use wg-quick down wg0
which will clean up the interface and remove the ip table rules.
Note: If running in a Docker container, you will need to run with --cap-add=NET_ADMIN
to modify your interfaces.
Bringing up an interface using ifupdown-ng
The official documents from wireguard show examples of how to set up an interface with the use of wg-quick. In this how-to, we are not going to use that utility. We'll use the plain wg command and ifupdown-ng.
apk add wireguard-tools-wg
Now that all the tools are installed, you can setup the interface. The setup of your interface config is out of the scope of this document. You should consult the manual page of wg.
After you have finished setting up your wgX interface config, you can add it to your /etc/network/interfaces:
auto wg0 iface wg0 inet static requires eth0 use wireguard address 192.168.42.1
This config will automatically:
- bring the wireguard interface up after the eth0 interface
- assign a config to this interface (which you have previously created)
- setup the interface address and netmask
- add the route once the interface is up
- remove the interface when it goes down
To start and stop the interface, you execute:
ifup wg0 ifdown wg0
If your interface config is not stored under /etc/wireguard
you need to specify a wireguard-config-path
as well.
Running with modloop
If you are running from a RAM disk, you can't modify the modloop.
You can get around it by unpacking the modloop, mounting the unpacked modules folder, then installing wireguard.
#!/bin/sh apk add squashfs-tools # install squashfs tools to unpack modloop unsquashfs -d /root/squash /lib/modloop-lts # unpack modloop to root dir umount /.modloop # unmount existing modloop mount /root/squash/ /.modloop/ # mount unpacked modloop apk del wireguard-lts # uninstall previous wireguard install apk add wireguard-lts apk add wireguard-tools
You can repack the squash filesystem or put this script in the /etc/local.d/ path so it runs at boot-up.