WireGuard

From Leo's Notes
Revision as of 23:00, 2 November 2019 by Leo (talk | contribs)
This page was last edited on 2 November 2019, at 23:00.

WireGuard is an easy to use VPN that provides a secure connection between two parties using public key authentication.

Installation

On CentOS 8: 

# curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
# yum -y install epel-release
# yum -y update
# yum install wireguard-dkms wireguard-tools

Ensure that you have the latest kernel and kernel development packages so that DKMS is able to build the wireguard kernel module.

Create a wg0.conf file in /etc/wireguard, then generate a new WireGuard key with wg genkey. 

# mkdir /etc/wireguard && cd /etc/wireguard
# (umask 077 && printf "[Interface]\nPrivateKey = "

Connecting to a Remote Site

Run the installation steps above on both local and remote sites. Define that local IP address for each site under the Interface section:

Eg. Site-A: 

[Interface]
PrivateKey = (private-key)
ListenPort = 5555
SaveConfig = true
Address = 192.168.1.1/24

Site-B: 

[Interface]
PrivateKey = (private-key)
ListenPort = 5555
SaveConfig = true
Address = 192.168.1.2/24


To have Site-A peer with Site-B, define a [Peer] section on the Site-A configuration with the following fields: 

PublicKey = (site-B-public-key)
AllowedIPs = 192.168.1.2/32
Endpoint = (site-B-endpoint-IP):5555

Similarly with Site-B: 

PublicKey = (site-A-public-key)
AllowedIPs = 192.168.1.1/32
Endpoint = (site-A-endpoint-IP):5555

Start WireGuard on both sites: 

# systemctl start wg-quick@wg0
# systemctl enable wg-quick@wg0
# ip a show wg0
6: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none
    inet 192.168.1.2/24 scope global wg0
       valid_lft forever preferred_lft forever

Once WireGuard establishes a connection, you should be able to ping the remote site's internal IP address.

Troubleshooting

If the kernel module isn't loading, ensure that you have the proper kernel development package installed for the running kernel. Reinstall the wireguard-dkms package to trigger a kernel module rebuild. Alternatively, trigger DKMS to rebuild the module with: 

dkms build -m wireguard/0.0.20191012

See Also