Navratan Lal Gupta · Follow
Published in · 6 min read · Jun 26, 2021
--
This Article is also available here.
WireGuard is communication protocol which uses state-of-art cryptography to implement Virtual Private Network (VPN). This is free and Open-Source.
We will see how we can setup our private VPN server.
Server provisioned with AWS Free Tier or Oracle Cloud’s Always free options may even help you setup a secure VPN with no cost.
In current time of pandemics, When we are working from home, data security is utmost important to organisations. Accessing organisation resources like servers, database, confidential files and other sensistive information with open internet can be riskier and can be an oppurtunities for security offenders to perform man-in-middle attack to leak the informations.
With shared Wi-Fi network, sites, information and data can be monitored.
ISPs like to monitor you when you are playing your favorite songs, or reading articles or browsing internet.
You may need to open apps or visit websites which are geologically restricted.
All of the above scenario can be achieved by a secure VPN. This gives you privacy, protects you from third-party interruptions and allows you to access geologically restricted apps and websites.
Though VPN is not banned in India. Illegal activities using VPN is still a punishable offence and can land you in trouble. You must use VPN wisely.
WireGuard is modern VPN which is faster, simpler to configure and easiest to use. WireGuard is new and lots are developments are still in way. But has already achieved the most secure tag and simplest VPN.
WireGuard is built with very few lines of code. hence, security audit of code-base is easier and provides minimum surface of attacks.
WireGuard is faster, more secure and less prone to attacks as compared to widely used OpenVPN.
- Ubuntu 20.04 server on AWS or any other cloud with root access. Preferably in region where you want VPN to tunnel through.
- Firewall or Security Group of server allowing UDP port 50409 inbound/ingress rule.
- A client e.g. Mobile Device or A Laptop
All the credentials, tokens, keys and public ips used in this article are temporary and will be destroyed before publishing.
- Switch to root user
sudo su- Install WireGuard packages and dependencies.apt update && apt install -y wireguard iptables resolvconf qrencode
- Generate server’s private key and public keys. Never share PRIVATE KEY with anyone.
wg genkey | tee /etc/wireguard/privatekey | wg pubkey | tee /etc/wireguard/publickey- Create WireGuard configuration file.
vi /etc/wireguard/wg0.confAdd below content in the file.
[Interface]
Address = 10.66.66.1/24,fd42:42:42::1/64
ListenPort = 50409
PrivateKey = <SERVER_PRIVATE_KEY>
PostUp = iptables -A FORWARD -i <SERVER_PUB_NIC> -o wg0 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o <SERVER_PUB_NIC> -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o <SERVER_PUB_NIC> -j MASQUERADE
PostDown = iptables -D FORWARD -i <SERVER_PUB_NIC> -o wg0 -j ACCEPT; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o <SERVER_PUB_NIC> -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o <SERVER_PUB_NIC> -j MASQUERADEReplace few values in the file as per below:
<SERVER_PRIVATE_KEY> must be replaced by PRIVATE KEY generated. It can be retrieved with below command.
cat /etc/wireguard/privatekey
<SERVER_PUB_NIC> must be replaced with network interface name of your server. This can be retrieved with below command. e.g.
ip -o -4 route show to default | awk '{print $5}'
Keep Address and ListenPort as it is. Address is CIDR of WireGuard network interface. ListenPort is the UDP port on which WireGuard will listen to traffics.
- Enable routing on server
echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/wg.confecho "net.ipv6.conf.all.forwarding = 1" >> /etc/sysctl.d/wg.confsysctl --system
- Start WireGuard service
systemctl start "wg-quick@wg0"systemctl enable "wg-quick@wg0"
Run the below steps on server:
- Generate client’s private and public key. Never share PRIVATE KEY with anyone.
wg genkey | tee /etc/wireguard/clientprivatekey1 | wg pubkey | tee /etc/wireguard/clientpublickey1wg genpsk | tee /etc/wireguard/presharedkey1
- Create Client Configuration File
vi wg0-client-1.conf
Add below content in file:
[Interface]
PrivateKey = <CLIENT_PRIV_KEY>
Address = 10.66.66.2/32,fd42:42:42::2/128
DNS = 1.1.1.1,1.0.0.1[Peer]
PublicKey = <SERVER_PUB_KEY>
PresharedKey = <CLIENT_PRE_SHARED_KEY>
Endpoint = <ENDPOINT>
AllowedIPs = 0.0.0.0/0,::/0
Replace few values in file as per below:
<CLIENT_PRIV_KEY> must be replaced with generated private key of client. This can be retrieved with below command.
cat /etc/wireguard/clientprivatekey1
<SERVER_PUB_KEY> must be replaced with generated public key of server. This can be retrieved with below command.
cat /etc/wireguard/publickey
<CLIENT_PRE_SHARED_KEY> must be replaced with generated preshared key. This can be retrieved with below command.
cat /etc/wireguard/presharedkey1
<ENDPOINT> must be replaced with PUBLIC_IP:50409. e.g. 13.232.143.190:50409 . If your server’s public IP is dynamic and you are using DDNS, Its better to use domain which points to Public IP of your server. e.g. wireguard.example.com:50409
Leave other configurations as it is. Address is WireGuard ‘s client IP. This should be unique for each client. DNS is DNS resolver IP, 1.1.1.1 and 1.0.0.1 is IP for CloudFlare DNS resolver.
- Update the server configuration
vi /etc/wireguard/wg0.conf
Append below lines in the file. This will add new client as a peer.
[Peer]
PublicKey = <CLIENT_PUB_KEY>
PresharedKey = <CLIENT_PRE_SHARED_KEY>
AllowedIPs = 10.66.66.2/32,fd42:42:42::2/128Replace few lines from file as below:
<CLIENT_PUB_KEY> must be replaced with public key of client. This can be retrieved using below command.
cat /etc/wireguard/clientpublickey1
<CLIENT_PRE_SHARED_KEY> must be replaced with preshared key. This can be retrieved with below command.
cat /etc/wireguard/presharedkey1
Keep other values as it is.
- Update the server with updated configuration
wg syncconf wg0 <(wg-quick strip wg0)
- Generate QR code of client configuration.
qrencode -t ansiutf8 -l L < wg0-client-1.conf
You can also create image file of QR code and download it for later use.
qrencode -t ansiutf8 -l L -o wg0-client-1.png < wg0-client-1.conf
Android/iOS:
- Install WireGuard app from respective app stores.
- Click on add(plus) icon in the app and scan the QR code which is generated in server.
- Toggle to Connect and disconnect.
Linux/Mac PC:
- Download
wg0-client-1.conffile to your PC using SFTP or SCP utility. (Always use secured way of file transfer) - Install wireguard on your PC as instructed here → https://wireguard.com/install/
- Copy the client file to /etc/wireguard directory. Use below command on PC.
sudo cp wg0-client-1.conf /etc/wireguard/wg0.conf
- Connect to VPN with below command
sudo wg-quick up wg0
Check if you are connected with below command.
sudo wg
- To disconnect use below command.
sudo wg-quick down wg0
Windows PC:
- Download
wg0-client-1.conffile to your PC using SFTP or WinSCP utility. (Always use secured way of file transfer) - Download and install WireGuard client for Windows as instructed here → https://wireguard.com/install/
- Add Tunnel → Import Tunnel from file → Choose Downloaded file → Connect
After connecting to VPN. You can verify your IP address by visiting https://whatismyipaddress.com . This should show Public IP address and location/region of your VPN server instead of your ISP.
You can add multiple clients using WireGuard VPN Client Configuration with different client configuration.
Linux Shots
