Configure a Wireguard interface (wg)
Wireguard is a very promising VPN technology and available since Alpine 3.10 in the community repository.
apk add wireguard-lts (or wireguard-virt)
The official documents from wireguard will show examples of how to setup an interface with the use of wg-quick. In this howto we are not going to use this utility but are going to use plain wg command and busybox ifupdown.
apk add wireguard-tools-wg
Now that you have all the tools installed we can setup the interface. The setup of your interface config is out of the scope of this document, you should consult the manual page of wg.
After you have finished setting up your wgX interface config you can add it to your /etc/network/interfaces:
auto wg0 iface wg0 inet static address x.x.x.x netmask 255.255.255.0 pre-up ip link add dev wg0 type wireguard pre-up wg setconf wg0 /etc/wireguard/wg0.conf post-up ip route add x.x.x.x/24 dev wg0 post-down ip link delete dev wg0
This config will do:
- bring the wireguard interface up
- assign a config to this interface (which you have previously created)
- setup the interface address and netmask
- add the route ones the interface is up
- remove the interface when it goes down
To start the interface and stop it you can execute:
ifup wg0 ifdown wg0
ifup wg0 fails silently, verify that the
bash package is installed.
Bringing up an interface using wg-tools
First we need to create a private and public key
wg genkey | tee privatekey | wg pubkey > publickey
Then we create a new config file
[Interface] Address = 10.123.0.1/24 ListenPort = 45340 PrivateKey = SG1nXk2+kAAKnMkL5aX3NSFPaGjf9SQI/wWwFj9l9U4= # the key from the previously generated privatekey file PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT
The PostUp and PostDown steps are there to ensure the interface wg0 will accept and forward traffic to eth0. The postrouting and forward to %i is not required but it will enable "VPN mode" where users can access the internet through this server if desired.
To bring up the new interface we can just use
wg-quick up wg0 and to bring it down we can use
wg-quick down wg0 which will clean up the interface and remove the ip table rules
Running with modloop
If you are running from a RAM disk you can't modify the modloop.
You can get around it by unpacking the modloop, mount the unpacked modules folder and then installing wireguard.
#!/bin/sh apk add squashfs-tools # install squashfs tools to unpack modloop unsquashfs -d /root/squash /lib/modloop-lts # unpack modloop to root dir umount /.modloop # unmount existing modloop mount /root/squash/ /.modloop/ # mount unpacked modloop apk del wireguard-lts # uninstall previous wireguard install apk add wireguard-lts apk add wireguard-tools
Now you could repack the squash filesystem or put this script in the /etc/local.d/ path so it runs on boot.