WireGuard is taking the VPN world by storm, coming very close to the current champion OpenVPN in simple, small-scale deployments. It’s just unfortunate few people know about it, and quite how incredible it is!
WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.
WireGuard is not only lighter weight than OpenVPN, it’s simpler, smaller, and most importantly does less. The final point may to some seem like a bad thing, but is actually great! The Unix Philosophy defines that tools should do one thing, and do it well. WireGuard simply creates networks and tunnels, no funky networking, no custom authentication, no complexity.
There is an official quick start guide, however as someone just getting started with WireGuard, and with little experience in the Linux network stack, it was a lot to understand at once. There is however a much simpler way of getting started: wg-quick.
wg-quick creates standard WireGuard tunnels, but generates the underlying commands for you, even printing them as it goes, so you can see how it’s working.
With WireGuard, the server and client are the same, and so installing either side is just as simple. WireGuard maintain a list of how to install on various platforms, read that! No point duplicating good documentation!
As this creates a new type of network interface, it’s highly likely you’ll need to reboot.
Unlike OpenVPN, which (by default) uses a username/password based authentication system, WireGuard works using a public/private key. Keys are used to both verify the client is connecting to the correct server, and that the client is authorized to connect to the server.
WireGuard comes with commands to generate the key-pairs securely:
wg genkey | tee privatekey | wg pubkey > publickey
This creates two files, publickey and privatekey which contain, well, the public and private keys. For security reasons, you should generate the keys on the device which requires the private key, rather than generating them all on the server, and distributing the private key.
WireGuard’s configuration lives in ini files in /etc/wireguard/*.conf, where * is the name of the WireGuard interface (that’ll be useful later).
Be sure to take care when specifying keys. Be sure to specify the correct keys for the correct device, else you’ll receive configuration error.
[Interface]
Address = 10.1.10.1 # IP of this device on this WireGuard network
PrivateKey = <server privatekey> # The servers private key
ListenPort = 51820 # The port for WireGuard to listen on (51820 is the standard)
# Specify one "Peer" block for each connecting device
[Peer]
PublicKey = <client publickey> # The clients public key
AllowedIPs = 10.1.10.2/32 # The IP and mask the client should be assigned
Yes, that’s really it! This isn’t just a simple config, WireGuard just has a super simple configuration!
[Interface]
Address = 10.1.10.2 # The IP the client should take on connection
PrivateKey = <client privatekey> # The clients private key
[Peer]
PublicKey = <servers publickey> # The servers public key
Endpoint = <servers ip>:51820 # The IP (or hostname) of the server, along with the port WireGuard is listening on
AllowedIPs = 10.1.10.2/24 # The IPs and masks the client should route through the tunnel
PersistentKeepalive = 25 # Ensure connections remain active, especially useful over NAT
Notice this configuration is very similar to that of the server, but with a few subtle changes.
Now the configuration is installed, it’s time to start things up and see if it works!
To start the server, simply run wg-quick up <interface> (where the interface is the name of the config).
Assuming this didn’t output any errors, you should see a new interface in ifconfig, with the specified IP allocated to it.
To connect a client, you can also run wg-quick up <interface>, and again, you’ll see a WireGuard interface with the specified IP allocated. ip route will also contain some entries for routing the required IP ranges through this new interface.
That’s it!
There’s now an encrypted tunnel set up between your two machines, which can be used to send any kind of traffic over, whether it be web traffic, media streaming, or email (if you’re reading this guide and thinking about using the tunnel for email, please don’t!).
If your needs are simply to forward traffic via another computer / network, or connect devices to the network of another, look past OpenVPN and give WireGuard a shot!
What is WireGuard? The website defines it as “… extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography.”. Which basically means it’s a VPN, but sane. The point of a VPN is to allow two machines to talk to eachother, no matter how the network inbetween is set…
Last year, I wrote a post on setting up a gateway to a private network, powered by OpenVPN-AS. I ran this network setup for quite a while with a lot of success, exposing services on my home network to the public internet, securely. Unfortunately, there were a couple issues with…
People say there’s no 100% reliable way to wipe a storage drive, and they’re right. By the nature of how mechanical drives work, there’s no real way to say for sure whether the data is ever really gone. With drives, the only way to be sure the content is gone…