Configure a Wireguard interface (wg): Difference between revisions

From Alpine Linux
No edit summary
(added command to install wireguard-tools, which is needed when using wg-quick)
(8 intermediate revisions by 6 users not shown)
Line 1: Line 1:
Wireguard is a very promising VPN technology but is currently (Alpine 3.9.0) not stable and thus only available via the edge/testing repository.
WireGuard is a very promising VPN technology and available since Alpine 3.10 in the community repository.
To be able to use it you will need to install a kernel from the edge/testing repository including all the out of tree modules you like to use.
This mean when you are running a stable system you will have to [[Alpine_Linux_package_management#Repository_pinning|pin the edge/testing repository in your repositories file]] and install it by:


apk add linux-vanilla (or linux-virt)
There are several ways to install and configure an interface.
apk add wireguard-vanilla (or wireguard-virt)


The official documents from wireguard will show examples of how to setup an inteface with the use of wg-quick.
== Bringing up an interface using wg-tools ==
In this howto we are not going to use this utility but are going to use the plain wg command and busybox ifupdown.
 
The most straightforward method, and the one recommended in WireGuard documentation, is to use <code>wg-quick</code>.
 
Install wireguard-tools
 
apk add wireguard-tools
 
Then we need to create a private and public key
 
wg genkey | tee privatekey | wg pubkey > publickey
 
Then we create a new config file <code>/etc/wireguard/wg0.conf</code> using those keys
 
[Interface]
Address = 10.123.0.1/24
ListenPort = 45340
PrivateKey = SG1nXk2+kAAKnMkL5aX3NSFPaGjf9SQI/wWwFj9l9U4= # the key from the previously generated privatekey file
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT
 
The PostUp and PostDown steps are there to ensure the interface wg0 will accept and forward traffic to eth0. The postrouting and forward to %i is not required but it will enable "VPN mode" where users can access the internet through this server if desired. Reference this WireGuard documentation for information on adding Peers to the config file.
 
To bring up the new interface we can just use
 
wg-quick up wg0
 
To bring it down we can use <code>wg-quick down wg0</code> which will clean up the interface and remove the ip table rules.
Note that if running in a Docker container, you will need to run with <code>--cap-add=NET_ADMIN</code> to modify interfaces.
 
== Bringing up an interface using busybox ifupdown ==
 
The official documents from wireguard will show examples of how to setup an interface with the use of wg-quick.
In this howto we are not going to use this utility but are going to use plain wg command and busybox ifupdown.
apk add wireguard-lts (or wireguard-virt)


  apk add wireguard-tools-wg
  apk add wireguard-tools-wg


Now that you have all the tools installed we can setup the interface.
Now that you have all the tools installed we can setup the interface.
The setup of your interface config is out of the scope of this document, you should consult the [https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick.8 manual page of wg].
The setup of your interface config is out of the scope of this document, you should consult the [https://git.zx2c4.com/WireGuard/about/src/tools/man/wg.8 manual page of wg].


After you have finished setting up your wgX interface config you can add it to your /etc/networking/interfaces:
After you have finished setting up your wgX interface config you can add it to your /etc/network/interfaces:


  auto wg0
  auto wg0
Line 37: Line 67:
  ifup wg0
  ifup wg0
  ifdown wg0
  ifdown wg0
If <code>ifup wg0</code> fails silently, verify that the <code>bash</code> package is installed.
== Running with modloop ==
If you are running from a RAM disk you can't modify the modloop.
You can get around it by unpacking the modloop, mount the unpacked modules folder and then installing wireguard.
#!/bin/sh
apk add squashfs-tools # install squashfs tools to unpack modloop
unsquashfs -d /root/squash /lib/modloop-lts # unpack modloop to root dir
umount /.modloop # unmount existing modloop
mount /root/squash/ /.modloop/ # mount unpacked modloop
apk del wireguard-lts # uninstall previous wireguard install
apk add wireguard-lts
apk add wireguard-tools
Now you could repack the squash filesystem or put this script in the /etc/local.d/ path so it runs on boot.
[[Category:Networking]]

Revision as of 14:51, 30 March 2020

WireGuard is a very promising VPN technology and available since Alpine 3.10 in the community repository.

There are several ways to install and configure an interface.

Bringing up an interface using wg-tools

The most straightforward method, and the one recommended in WireGuard documentation, is to use wg-quick.

Install wireguard-tools

apk add wireguard-tools

Then we need to create a private and public key

wg genkey | tee privatekey | wg pubkey > publickey

Then we create a new config file /etc/wireguard/wg0.conf using those keys

[Interface]
Address = 10.123.0.1/24
ListenPort = 45340
PrivateKey = SG1nXk2+kAAKnMkL5aX3NSFPaGjf9SQI/wWwFj9l9U4= # the key from the previously generated privatekey file
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT

The PostUp and PostDown steps are there to ensure the interface wg0 will accept and forward traffic to eth0. The postrouting and forward to %i is not required but it will enable "VPN mode" where users can access the internet through this server if desired. Reference this WireGuard documentation for information on adding Peers to the config file.

To bring up the new interface we can just use

wg-quick up wg0

To bring it down we can use wg-quick down wg0 which will clean up the interface and remove the ip table rules. Note that if running in a Docker container, you will need to run with --cap-add=NET_ADMIN to modify interfaces.

Bringing up an interface using busybox ifupdown

The official documents from wireguard will show examples of how to setup an interface with the use of wg-quick. In this howto we are not going to use this utility but are going to use plain wg command and busybox ifupdown.

apk add wireguard-lts (or wireguard-virt)
apk add wireguard-tools-wg

Now that you have all the tools installed we can setup the interface. The setup of your interface config is out of the scope of this document, you should consult the manual page of wg.

After you have finished setting up your wgX interface config you can add it to your /etc/network/interfaces:

auto wg0
iface wg0 inet static
    address x.x.x.x
    netmask 255.255.255.0
    pre-up ip link add dev wg0 type wireguard
    pre-up wg setconf wg0 /etc/wireguard/wg0.conf
    post-up ip route add x.x.x.x/24 dev wg0
    post-down ip link delete dev wg0

This config will do:

  • bring the wireguard interface up
  • assign a config to this interface (which you have previously created)
  • setup the interface address and netmask
  • add the route ones the interface is up
  • remove the interface when it goes down

To start the interface and stop it you can execute:

ifup wg0
ifdown wg0

If ifup wg0 fails silently, verify that the bash package is installed.

Running with modloop

If you are running from a RAM disk you can't modify the modloop.

You can get around it by unpacking the modloop, mount the unpacked modules folder and then installing wireguard.

#!/bin/sh
apk add squashfs-tools # install squashfs tools to unpack modloop
unsquashfs -d /root/squash /lib/modloop-lts # unpack modloop to root dir
umount /.modloop # unmount existing modloop
mount /root/squash/ /.modloop/ # mount unpacked modloop
apk del wireguard-lts # uninstall previous wireguard install
apk add wireguard-lts
apk add wireguard-tools

Now you could repack the squash filesystem or put this script in the /etc/local.d/ path so it runs on boot.