Configure a Wireguard interface (wg)
WireGuard multiple platform vpn solution. WireGuard itself is now integrated into the linux kernel since v5.6. Only the userland configuration tools are required.
Installation
The most straightforward method to configure WireGuard is to use the tool wg-quick available in the package wireguard-tools-wg-quick.
Install the meta package wireguard-tools to install the necessary WireGuard packages and iptables as follows:
# apk add wireguard-tools iptables
Configuration
Create Server Keys and Interface Config
Create a server private and public key:
# wg genkey | tee server.privatekey | wg pubkey > server.publickey
Then, we create a new config file /etc/wireguard/wg0.conf using these new keys as follows:
Contents of /etc/wireguard/wg0.conf
The PostUp and PostDown iptable rules forward traffic from the wg0 subnet (192.168.2.1/24) to the lan subnet on interface eth0. Refer to this WireGuard documentation for information on adding peers to the config file.
Bring up the new wg0 interface:
# wg-quick up wg0
To take it down, we can use wg-quick down wg0 which will clean up the interface and remove the iptables rules.
--cap-add=NET_ADMIN to modify your interfaces.Use with network interfaces
To enable connecting with Wireguard on boot, open your /etc/network/interfaces and add this information after your auto other network interfaces as follows:
Contents of /etc/network/interfaces
Service configuration
Since Alpine 3.20, wireguard-tools-openrc package provides an OpenRC initd service file.
To use this, install the package:
# apk add wireguard-tools-openrc
To use the WireGuard OpenRC script with wg-quick.wg0, create a symbolic link to it with the configuration name as follows:
# ln -s /etc/init.d/wg-quick /etc/init.d/wg-quick.wg0
Add the wg-quick.wg0 service to the default runlevel:
# rc-update add wg-quick.wg0
To start|stop|restart the OpenRC service:
# rc-service wg-quick.wg0 start
Enable IP Forwarding
With a NAT destination rule in place on your router, you should be able connect to the wireguard instance and access the host. However, if you intend for peers to be able to access external resources (including the internet), you will need to enable ip forwarding.
Edit the file /etc/sysctl.conf or a .conf file under /etc/sysctl.d/ folder add the following line as follows:
Contents of /etc/sysctl.conf
Add the sysctl service to run at boot:
# rc-update add sysctl
Then either reboot or run # sysctl -p /etc/sysctl.conf to reload the settings. To ensure forwarding is turned on, run # sysctl -a and ensure net.ipv4.ip_forward is set to 1.
In the file /etc/conf.d/iptables, Change the setting as follows:
Contents of /etc/conf.d/iptables
Running with modloop
If you are running Diskless Mode i.e from a RAM disk, you can't modify the modloop.
You can get around it by unpacking the modloop, mounting the unpacked modules folder, then installing WireGuard.
#!/bin/sh apk add squashfs-tools # install squashfs tools to unpack modloop unsquashfs -d /root/squash /lib/modloop-lts # unpack modloop to root dir umount /.modloop # unmount existing modloop mount /root/squash/ /.modloop/ # mount unpacked modloop apk del wireguard-lts # uninstall previous WireGuard install apk add wireguard-lts apk add wireguard-tools
You can repack the squash filesystem or put this script in the /etc/local.d/ path so it runs at boot-up.