Configure a Wireguard interface (wg): Difference between revisions

From Alpine Linux
No edit summary
(Add a reminder to reboot before modprobe)
(17 intermediate revisions by 14 users not shown)
Line 1: Line 1:
Wireguard is a very promising VPN technology but is currently (Alpine 3.9.0) not stable and thus only available via the edge/testing repository.
{{TOC left}}
To be able to use it you will need to install a kernel from the edge/testing repository including all the out of tree modules you like to use.
This mean when you are running a stable system you will have to [[Alpine_Linux_package_management#Repository_pinning|pin the edge/testing repository in your repositories file]] and install it by:


apk add linux-vanilla (or linux-virt)
WireGuard is a very promising VPN technology available in the community repository since Alpine 3.10.
apk add wireguard-vanilla (or wireguard-virt)


The official documents from wireguard will show examples of how to setup an inteface with the use of wg-quick.
There are several ways to install and configure an interface.
In this howto we are not going to use this utility but are going to use the plain wg command and busybox ifupdown.
 
In order to load the WireGuard kernel module, you need a compatible kernel:
 
* linux-lts
* linux-virt
 
== Bringing up an interface using wg-tools ==
 
The most straightforward method, and the one recommended in WireGuard documentation, is to use <code>wg-quick</code>.
 
Install wireguard-tools
 
apk add wireguard-tools
 
Reboot and then load the module
 
modprobe wireguard
 
Add it to <code>/etc/modules</code> to automatically load it on boot.
 
Then, we need to create a private and a public key:
 
wg genkey | tee privatekey | wg pubkey > publickey
 
Then, we create a new config file <code>/etc/wireguard/wg0.conf</code> using those keys:
 
[Interface]
Address = 10.123.0.1/24
ListenPort = 45340
PrivateKey = SG1nXk2+kAAKnMkL5aX3NSFPaGjf9SQI/wWwFj9l9U4= # the key from the previously generated privatekey file
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT
 
The PostUp and PostDown steps are there to ensure the interface wg0 will accept and forward traffic to eth0. The postrouting and forward to %i is not required, but it will enable "VPN mode" where users can access the internet via this server if desired.
Note that this requires <code>iptables</code> installed and enabled: <code>apk add iptables && rc-update add iptables</code>.
Reference [https://github.com/pirate/wireguard-docs#user-content-config-reference this WireGuard documentation] for information on adding peers to the config file.
 
To bring up the new interface we use:
 
wg-quick up wg0
 
To take it down, we can use <code>wg-quick down wg0</code> which will clean up the interface and remove the iptables rules.
Note: If running in a Docker container, you will need to run with <code>--cap-add=NET_ADMIN</code> to modify your interfaces.
 
== Bringing up an interface using ifupdown-ng ==
 
The official documents from WireGuard show examples of how to set up an interface with the use of wg-quick.
In this how-to, we are not going to use that utility. We'll use the plain wg command and [https://github.com/ifupdown-ng/ifupdown-ng/blob/master/doc/interfaces-wireguard.scd ifupdown-ng].


  apk add wireguard-tools-wg
  apk add wireguard-tools-wg


Now that you have all the tools installed we can setup the interface.
Now that all the tools are installed, you can setup the interface.
The setup of your interface config is out of the scope of this document, you should consult the [https://git.zx2c4.com/WireGuard/about/src/tools/man/wg-quick.8 manual page of wg].
The setup of your interface config is out of the scope of this document. You should consult the [https://git.zx2c4.com/WireGuard/about/src/tools/man/wg.8 manual page of wg].


After you have finished setting up your wgX interface config you can add it to your /etc/networking/interfaces:
After you have finished setting up your wgX interface config, you can add it to your <code>/etc/network/interfaces</code>:


  auto wg0
  auto wg0
  iface wg0 inet static
  iface wg0 inet static
    address x.x.x.x
        requires eth0
    netmask 255.255.255.0
        use wireguard
    pre-up ip link add dev wg0 type wireguard
        address 192.168.42.1
    pre-up wg setconf wg0 /etc/wireguard/wg0.conf
        post-up iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o wg0 -j ACCEPT
    post-up ip route add x.x.x.x/24 dev wg0
        post-down iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o wg0 -j ACCEPT
    post-down ip link delete dev wg0
 
This config will automatically:


This config will do:
* bring the WireGuard interface up after the eth0 interface
* bring the wireguard interface up
* assign a config to this interface (which you have previously created)
* assign a config to this interface (which you have previously created)
* setup the interface address and netmask
* setup the interface address and netmask
* add the route ones the interface is up
* add the route once the interface is up
* remove the interface when it goes down
* remove the interface when it goes down
* enable traffic forwarding (the <code>post-up</code> and <code>post-down</code> lines; requires <code>iptables</code>) (note that this is not required unless you want peers to be able to access external resources like the internet)
{{Note|If you are using the same config (/etc/wireguard/wg0.conf) from a <code>wg-quick</code> setup, you must comment out the <code>Address</code> line in the <code>[Interface]</code> section. Otherwise, the interface will not come up.}}


To start the interface and stop it you can execute:
To start and stop the interface, you execute:


  ifup wg0
  ifup wg0
  ifdown wg0
  ifdown wg0
If your interface config is not stored under <code>/etc/wireguard/</code> you need to specify a <code>wireguard-config-path</code> as well.
== Enable IP Forwarding ==
If you intend for peers to be able to access external resources (including the internet), you will need to enable forwarding.
Edit the file <code>/etc/sysctl.conf</code> (or a <code>.conf</code> file under <code>/etc/sysctl.d/</code>) and add the following line.
net.ipv4.ip_forward = 1
Then either reboot or run <code>sysctl -p /etc/sysctl.conf</code> to reload the settings.
To ensure forwarding is turned on, run <code>sysctl -a | grep ip_forward</code> and ensure <code>net.ipv4.ip_forward</code> is set to <code>1</code>.
To make the change permanent across reboots, you may need to enable the <code>sysctl</code> service: <code>rc-update add sysctl</code>.
== Running with modloop ==
If you are running from a RAM disk, you can't modify the modloop.
You can get around it by unpacking the modloop, mounting the unpacked modules folder, then installing WireGuard.
#!/bin/sh
apk add squashfs-tools # install squashfs tools to unpack modloop
unsquashfs -d /root/squash /lib/modloop-lts # unpack modloop to root dir
umount /.modloop # unmount existing modloop
mount /root/squash/ /.modloop/ # mount unpacked modloop
apk del wireguard-lts # uninstall previous WireGuard install
apk add wireguard-lts
apk add wireguard-tools
You can repack the squash filesystem or put this script in the /etc/local.d/ path so it runs at boot-up.
[[Category:Networking]]

Revision as of 20:58, 12 August 2022

WireGuard is a very promising VPN technology available in the community repository since Alpine 3.10.

There are several ways to install and configure an interface.

In order to load the WireGuard kernel module, you need a compatible kernel:

  • linux-lts
  • linux-virt

Bringing up an interface using wg-tools

The most straightforward method, and the one recommended in WireGuard documentation, is to use wg-quick.

Install wireguard-tools

apk add wireguard-tools

Reboot and then load the module

modprobe wireguard

Add it to /etc/modules to automatically load it on boot.

Then, we need to create a private and a public key:

wg genkey | tee privatekey | wg pubkey > publickey

Then, we create a new config file /etc/wireguard/wg0.conf using those keys:

[Interface]
Address = 10.123.0.1/24
ListenPort = 45340
PrivateKey = SG1nXk2+kAAKnMkL5aX3NSFPaGjf9SQI/wWwFj9l9U4= # the key from the previously generated privatekey file
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT

The PostUp and PostDown steps are there to ensure the interface wg0 will accept and forward traffic to eth0. The postrouting and forward to %i is not required, but it will enable "VPN mode" where users can access the internet via this server if desired. Note that this requires iptables installed and enabled: apk add iptables && rc-update add iptables. Reference this WireGuard documentation for information on adding peers to the config file.

To bring up the new interface we use:

wg-quick up wg0

To take it down, we can use wg-quick down wg0 which will clean up the interface and remove the iptables rules. Note: If running in a Docker container, you will need to run with --cap-add=NET_ADMIN to modify your interfaces.

Bringing up an interface using ifupdown-ng

The official documents from WireGuard show examples of how to set up an interface with the use of wg-quick. In this how-to, we are not going to use that utility. We'll use the plain wg command and ifupdown-ng.

apk add wireguard-tools-wg

Now that all the tools are installed, you can setup the interface. The setup of your interface config is out of the scope of this document. You should consult the manual page of wg.

After you have finished setting up your wgX interface config, you can add it to your /etc/network/interfaces:

auto wg0
iface wg0 inet static
       requires eth0
       use wireguard
       address 192.168.42.1
       post-up iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o wg0 -j ACCEPT
       post-down iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o wg0 -j ACCEPT

This config will automatically:

  • bring the WireGuard interface up after the eth0 interface
  • assign a config to this interface (which you have previously created)
  • setup the interface address and netmask
  • add the route once the interface is up
  • remove the interface when it goes down
  • enable traffic forwarding (the post-up and post-down lines; requires iptables) (note that this is not required unless you want peers to be able to access external resources like the internet)
Note: If you are using the same config (/etc/wireguard/wg0.conf) from a wg-quick setup, you must comment out the Address line in the [Interface] section. Otherwise, the interface will not come up.

To start and stop the interface, you execute:

ifup wg0
ifdown wg0

If your interface config is not stored under /etc/wireguard/ you need to specify a wireguard-config-path as well.

Enable IP Forwarding

If you intend for peers to be able to access external resources (including the internet), you will need to enable forwarding. Edit the file /etc/sysctl.conf (or a .conf file under /etc/sysctl.d/) and add the following line.

net.ipv4.ip_forward = 1

Then either reboot or run sysctl -p /etc/sysctl.conf to reload the settings. To ensure forwarding is turned on, run sysctl -a | grep ip_forward and ensure net.ipv4.ip_forward is set to 1. To make the change permanent across reboots, you may need to enable the sysctl service: rc-update add sysctl.


Running with modloop

If you are running from a RAM disk, you can't modify the modloop.

You can get around it by unpacking the modloop, mounting the unpacked modules folder, then installing WireGuard.

#!/bin/sh
apk add squashfs-tools # install squashfs tools to unpack modloop
unsquashfs -d /root/squash /lib/modloop-lts # unpack modloop to root dir
umount /.modloop # unmount existing modloop
mount /root/squash/ /.modloop/ # mount unpacked modloop
apk del wireguard-lts # uninstall previous WireGuard install
apk add wireguard-lts
apk add wireguard-tools

You can repack the squash filesystem or put this script in the /etc/local.d/ path so it runs at boot-up.