Wireguard setup notes

wireguard-setup-notes.md

Wireguard setup notes

Steps

Reference: https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-ubuntu-20-04

1. Choose an IPv4 and/or IPv6 network address

IPv6 network choice algorithm:

cat <(date +%s%N) /var/lib/dbus/machine-id | tr -d '\n' | sha1sum | sed -E 's/^.+([0-9a-f]{10}) .*$/fd\1/;s/..../&:/g;s|$|:/64|'

2. Set up a Wireguard connection profile on both the server and client

3. Exchange public keys

4. Add each other as a peer

5. Activate the connection using nmtui or nmcli on both machines

6. Use wg to check connection status

Adding a Wireguard connection profile

1. Generate Private/public key pair

wg genkey > /etc/wireguard/private.key
wg pubkey < /etc/wireguard/private.key > /etc/wireguard/public.key

2. Use nmtui to add a Wireguard connection profile

3. Set firewalld zone using nmcli

nmcli connection modify <CONNECTION_NAME> connection.zone <ZONE>

Checklist

1. Are all the keys correct?

2. Have you opened Wireguard's port (default 51820/tcp) on the server's firewall?

firewalld:

sudo firewall-cmd [--zone=ZONE] --add-service=wireguard
sudo firewall-cmd --runtime-to-permanent

3. If the server is behind a NAT, is port forwarding enabled on the gateway?

4. Are the chosen Wireguard network addresses themselves included in AllowedIPs?

5. Have you enabled intra zone forwarding? Or have you added appropriate inter zone forwarding rules?

6. Have you added the appropriate return routes on connected hosts? Or have you set up your routing daemons correctly?

7. If you are using OSPF as your routing protocol, have you added its multicast addresses (224.0.0.5, 224.0.0.6, ff02::5, ff02::6) to AllowedIPs?

Tips

• It may be useful to set Interface.Table = off (equilvant to unchecking "Add peer routes" in NetworkManager) and let your routing daemon add routes (reference)