Getting started with WireGuard
2019-09-15 5 minutes #security
WireGuard is taking the VPN world by storm, coming very close to the current champion OpenVPN in simple, small-scale deployments. It’s just unfortunate few people know about it, and quite how incredible it is!
# What is WireGuard?
WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.
WireGuard is not only lighter weight than OpenVPN, it’s simpler, smaller, and most importantly does less. The final point may to some seem like a bad thing, but is actually great! The Unix Philosophy defines that tools should do one thing, and do it well. WireGuard simply creates networks and tunnels, no funky networking, no custom authentication, no complexity.
# Getting started with WireGuard
There is an official quick start guide, however as someone just getting started with WireGuard, and with little experience in the Linux network stack, it was a lot to understand at once. There is however a much simpler way of getting started:
wg-quick creates standard WireGuard tunnels, but generates the underlying commands for you, even printing them as it goes, so you can see how it’s working.
With WireGuard, the server and client are the same, and so installing either side is just as simple. WireGuard maintain a list of how to install on various platforms, read that! No point duplicating good documentation!
As this creates a new type of network interface, it’s highly likely you’ll need to reboot.
# Creating a tunnel
Unlike OpenVPN, which (by default) uses a username/password based authentication system, WireGuard works using a public/private key. Keys are used to both verify the client is connecting to the correct server, and that the client is authorized to connect to the server.
WireGuard comes with commands to generate the key-pairs securely:
wg genkey | tee privatekey | wg pubkey > publickey
This creates two files,
privatekey which contain, well, the public and private keys. For security reasons, you should generate the keys on the device which requires the private key, rather than generating them all on the server, and distributing the private key.
WireGuard’s configuration lives in
ini files in
* is the name of the WireGuard interface (that’ll be useful later).
Be sure to take care when specifying keys. Be sure to specify the correct keys for the correct device, else you’ll receive configuration error.
# Server configuration
[Interface] Address = 10.1.10.1 # IP of this device on this WireGuard network PrivateKey = <server privatekey> # The servers private key ListenPort = 51820 # The port for WireGuard to listen on (51820 is the standard) # Specify one "Peer" block for each connecting device [Peer] PublicKey = <client publickey> # The clients public key AllowedIPs = 10.1.10.2/32 # The IP and mask the client should be assigned
Yes, that’s really it! This isn’t just a simple config, WireGuard just has a super simple configuration!
# Client configuration
[Interface] Address = 10.1.10.2 # The IP the client should take on connection PrivateKey = <client privatekey> # The clients private key [Peer] PublicKey = <servers publickey> # The servers public key Endpoint = <servers ip>:51820 # The IP (or hostname) of the server, along with the port WireGuard is listening on AllowedIPs = 10.1.10.2/24 # The IPs and masks the client should route through the tunnel PersistentKeepalive = 25 # Ensure connections remain active, especially useful over NAT
Notice this configuration is very similar to that of the server, but with a few subtle changes.
Now the configuration is installed, it’s time to start things up and see if it works!
# Starting the server
To start the server, simply run
wg-quick up <interface> (where the interface is the name of the config).
Assuming this didn’t output any errors, you should see a new interface in
ifconfig, with the specified IP allocated to it.
# Connecting the client
To connect a client, you can also run
wg-quick up <interface>, and again, you’ll see a WireGuard interface with the specified IP allocated.
ip route will also contain some entries for routing the required IP ranges through this new interface.
There’s now an encrypted tunnel set up between your two machines, which can be used to send any kind of traffic over, whether it be web traffic, media streaming, or email (if you’re reading this guide and thinking about using the tunnel for email, please don’t!).
If your needs are simply to forward traffic via another computer / network, or connect devices to the network of another, look past OpenVPN and give WireGuard a shot!