WireGuard: Difference between revisions

(7 intermediate revisions by 4 users not shown)

Line 18:

systemd.network is recommended due to its powerful configuration interface.

wg-quick is suitable for common usage patterns. networking.wireguard seems to

have issues with routing. NetworkManager does not ~~supoort~~ Proxy server setup, and

have issues with routing. NetworkManager does not support Proxy server setup, and

is cubersome to use.

Line 32:

Internet via another peer.

== DNS for the proxy client ==

== Secure DNS for the proxy client ==

You can use a secure DNS client such as knot dns resolver,

Line 52:

}

</syntaxhighlight>

Secure DNS hinders usage of captive portals. See [[systemd-resolved]] for solutions.

= AllowedIPs =

Line 165:

Line 167:

ListenPort = 51820;

# ensure file is readable by `systemd-network` user

PrivateKeyFile = config.age.secrets.wg-key-vps.path;

Line 198:

Line 201:

== Proxy server setup ==

~~Same~~ as peer setup, ~~skip~~ the ~~endpoint~~ option, ~~with~~ the following

To route your internet traffic through the server, first check the name of your active network interface. This can be done through running this command:

~~addition~~:

<pre>

ip route get 9.9.9.9

</pre>

and the result should be something similar to:

<pre>

9.9.9.9 via 192.168.1.1 dev enp2s0 src 192.168.1.35 uid 0

</pre>

The item after <code>dev</code> is your active interface, in this case <code>enp2s0</code>.

After that, set up WireGuard the same way as the [[#Peer_setup|peer setup]], except do not include the <code>Endpoint</code> option. Then, add the following options to your configuration, using the active network interface you previously found for <code>externalInterface</code>:

Line 206:

Line 218:

enable = true;

enableIPv6 = true;

externalInterface = "~~ens6~~";

externalInterface = "enp2s0";

internalInterfaces = [ "wg0" ];

};

Line 292:

Line 304:

FirewallMark = 42;

# we specify that the routing table 1000 must be used

# (... continued) we specify that the routing table 1000 must be used

# (which is the wireguard routing table). This rule routes all traffic through wireguard.

# inside routingPolicyRules section is called Table, not RouteTable

Line 385:

Line 397:

Family = "both";

}

]

];

# Configure port forwarding for Transmission under NAT

networking.nat.forwardPorts =

[

{

destination = "10.0.0.1:80";

proto = "tcp";

sourcePort = 8080;

}

{

destination = "[fc00::2]:80";

proto = "tcp";

sourcePort = 8080;

}

];

</syntaxhighlight>

Line 544:

Line 570:

== Reuse existing wg-quick config file ==

If you have WireGuard configuration files that you want to use as-is

If you have WireGuard configuration files that you want to use as-is (similarly how you would configure WireGuard e.g. in [https://wiki.debian.org/WireGuard#Step_2_-_Configuration Debian]), without converting them to a declarative NixOS configuration, you can also configure <code>wg-quick</code> to use them. For example, if you have a configuration file <code>/etc/nixos/wireguard/wg0.conf</code>, add the following line to your <code>configuration.nix</code>:

(similarly how you would

[https://wiki.debian.org/WireGuard#Step_2_-_Configuration ~~configure~~

~~WireGuard e.g. in~~ Debian], without converting them to a declarative

NixOS configuration, you can also configure <code>wg-quick</code> to

use them. For example, if you have a configuration file

<code>/etc/nixos/wireguard/wg0.conf</code>, add the following line to

your <code>configuration.nix</code>:

Line 785:

Line 804:

* Site to Site Configuration,

see [https://docs.procustodibus.com/guide/wireguard/ Pro Custodibus Documentation].

see [https://docs.procustodibus.com/guide/wireguard/ Pro Custodibus Documentation], [https://web.archive.org/web/20250920231827/https://docs.procustodibus.com/guide/wireguard/ Mirror on Internet Archive].

[[Category:Networking]]

[[Category:VPN]]

@@ Line 18: / Line 18: @@
 systemd.network is recommended due to its powerful configuration interface.
 wg-quick is suitable for common usage patterns.  networking.wireguard seems to
-have issues with routing.  NetworkManager does not supoort Proxy server setup, and
+have issues with routing.  NetworkManager does not support Proxy server setup, and
 is cubersome to use.
@@ Line 32: / Line 32: @@
 Internet via another peer.
-== DNS for the proxy client ==
+== Secure DNS for the proxy client ==
 You can use a secure DNS client such as knot dns resolver,
@@ Line 52: / Line 52: @@
 }
 </syntaxhighlight>
+Secure DNS hinders usage of captive portals.  See [[systemd-resolved]] for solutions.
 = AllowedIPs =
@@ Line 165: / Line 167: @@
          ListenPort = 51820;
+        # ensure file is readable by `systemd-network` user
          PrivateKeyFile = config.age.secrets.wg-key-vps.path;
@@ Line 198: / Line 201: @@
 == Proxy server setup ==
-Same as peer setup, skip the endpoint option, with the following
+To route your internet traffic through the server, first check the name of your active network interface. This can be done through running this command:
-addition:
+<pre>
+ip route get 9.9.9.9
+</pre>
+and the result should be something similar to:
+<pre>
+.9.9.9 via 192.168.1.1 dev enp2s0 src 192.168.1.35 uid 0
+</pre>
+The item after <code>dev</code> is your active interface, in this case <code>enp2s0</code>.
+After that, set up WireGuard the same way as the [[#Peer_setup|peer setup]], except do not include the <code>Endpoint</code> option. Then, add the following options to your configuration, using the active network interface you previously found for <code>externalInterface</code>:
 <syntaxhighlight lang="nix">
@@ Line 206: / Line 218: @@
      enable = true;
      enableIPv6 = true;
-     externalInterface = "ens6";
+     externalInterface = "enp2s0";
      internalInterfaces = [ "wg0" ];
    };
@@ Line 292: / Line 304: @@
            FirewallMark = 42;
-           # we specify that the routing table 1000 must be used
+           # (... continued) we specify that the routing table 1000 must be used
            # (which is the wireguard routing table). This rule routes all traffic through wireguard.
            # inside routingPolicyRules section is called Table, not RouteTable
@@ Line 385: / Line 397: @@
        Family = "both";
      }
-   ]
+   ];
+  # Configure port forwarding for Transmission under NAT
+  networking.nat.forwardPorts =
+       [
+         {
+           destination = "10.0.0.1:80";
+           proto = "tcp";
+           sourcePort = 8080;
+         }
+         {
+           destination = "[fc00::2]:80";
+           proto = "tcp";
+           sourcePort = 8080;
+         }
+       ];
 </syntaxhighlight>
@@ Line 544: / Line 570: @@
 == Reuse existing wg-quick config file ==
-If you have WireGuard configuration files that you want to use as-is
+If you have WireGuard configuration files that you want to use as-is (similarly how you would configure WireGuard e.g. in [https://wiki.debian.org/WireGuard#Step_2_-_Configuration Debian]), without converting them to a declarative NixOS configuration, you can also configure <code>wg-quick</code> to use them. For example, if you have a configuration file <code>/etc/nixos/wireguard/wg0.conf</code>, add the following line to your <code>configuration.nix</code>:
-(similarly how you would
-[https://wiki.debian.org/WireGuard#Step_2_-_Configuration configure
-WireGuard e.g. in Debian], without converting them to a declarative
-NixOS configuration, you can also configure <code>wg-quick</code> to
-use them. For example, if you have a configuration file
-<code>/etc/nixos/wireguard/wg0.conf</code>, add the following line to
-your <code>configuration.nix</code>:
 <syntaxHighlight lang="nix">
@@ Line 785: / Line 804: @@
 * Site to Site Configuration,
-see [https://docs.procustodibus.com/guide/wireguard/ Pro Custodibus Documentation].
+see [https://docs.procustodibus.com/guide/wireguard/ Pro Custodibus Documentation], [https://web.archive.org/web/20250920231827/https://docs.procustodibus.com/guide/wireguard/ Mirror on Internet Archive].
 [[Category:Networking]]
 [[Category:VPN]]