WireGuard: Difference between revisions
imported>Asymmetric m add wireguard troubleshooting link |
imported>Pancho m Fix capitalization of WireGuard. |
||
| Line 1: | Line 1: | ||
=Setting up | =Setting up WireGuard= | ||
==Generate keypair== | ==Generate keypair== | ||
Each peer needs to have a public-private keypair. The keys can be generated on any machine that already has | Each peer needs to have a public-private keypair. The keys can be generated on any machine that already has WireGuard installed using the <code>wg</code> utility. If WireGuard isn't installed yet, it can be made available by adding <code>wireguard</code> to <code>environment.systemPackages</code> or by running <code>nix-env -iA wireguard</code>. | ||
Creating a keypair is simple: | Creating a keypair is simple: | ||
| Line 15: | Line 15: | ||
===Server setup=== | ===Server setup=== | ||
Enable | Enable WireGuard on the server via <tt>/etc/nixos/configuration.nix</tt>: | ||
<syntaxHighlight lang="nix"> | <syntaxHighlight lang="nix"> | ||
{ | { | ||
| Line 34: | Line 34: | ||
ips = [ "10.100.0.1/24" ]; | ips = [ "10.100.0.1/24" ]; | ||
# The port that | # The port that WireGuard listens to. Must be accessible by the client. | ||
listenPort = 51820; | listenPort = 51820; | ||
| Line 81: | Line 81: | ||
allowedUDPPorts = [ 51820 ]; # Clients and peers can use the same port, see listenport | allowedUDPPorts = [ 51820 ]; # Clients and peers can use the same port, see listenport | ||
}; | }; | ||
# Enable | # Enable WireGuard | ||
networking.wireguard.interfaces = { | networking.wireguard.interfaces = { | ||
# "wg0" is the network interface name. You can name the interface arbitrarily. | # "wg0" is the network interface name. You can name the interface arbitrarily. | ||
| Line 123: | Line 123: | ||
Multiple connections can be configured by configuring multiple interfaces under {{nixos:option|networking.wireguard.interfaces}}. | Multiple connections can be configured by configuring multiple interfaces under {{nixos:option|networking.wireguard.interfaces}}. | ||
==Setting up | ==Setting up WireGuard server/client with wg-quick and dnsmasq== | ||
===Server setup=== | ===Server setup=== | ||
DNS requires opening TCP/UDP port 53. | DNS requires opening TCP/UDP port 53. | ||
| Line 153: | Line 153: | ||
# Determines the IP/IPv6 address and subnet of the client's end of the tunnel interface | # Determines the IP/IPv6 address and subnet of the client's end of the tunnel interface | ||
address = [ "10.0.0.1/24" "fdc9:281f:04d7:9ee9::1/64" ]; | address = [ "10.0.0.1/24" "fdc9:281f:04d7:9ee9::1/64" ]; | ||
# The port that | # The port that WireGuard listens to - recommended that this be changed from default | ||
listenPort = 51820; | listenPort = 51820; | ||
# Path to the server's private key | # Path to the server's private key | ||
| Line 188: | Line 188: | ||
</syntaxHighlight> | </syntaxHighlight> | ||
To enable dnsmasq and only serve DNS requests to the | To enable dnsmasq and only serve DNS requests to the WireGuard interface add the following: | ||
<syntaxHighlight lang="nix"> | <syntaxHighlight lang="nix"> | ||
{ | { | ||
| Line 232: | Line 232: | ||
</syntaxHighlight> | </syntaxHighlight> | ||
==Setting up | ==Setting up WireGuard with systemd-networkd== | ||
Please note, that networkd support in NixOS is still [https://search.nixos.org/options/?query=usenetworkd experimental]. | Please note, that networkd support in NixOS is still [https://search.nixos.org/options/?query=usenetworkd experimental]. | ||
| Line 293: | Line 293: | ||
=See also= | =See also= | ||
* [https://www.wireguard.com/ | * [https://www.wireguard.com/ WireGuard homepage] | ||
* [https://wiki.archlinux.org/index.php/WireGuard Arch Wiki] has an exhaustive guide, including troubleshooting tips | * [https://wiki.archlinux.org/index.php/WireGuard Arch Wiki] has an exhaustive guide, including troubleshooting tips | ||
* [https://search.nixos.org/options/?query=wireguard List of | * [https://search.nixos.org/options/?query=wireguard List of WireGuard options supported by NixOS] | ||
* [https://www.youtube.com/watch?v=us7V2NvsQRA Talk by @fpletz at NixCon 2018 about networkd and his | * [https://www.youtube.com/watch?v=us7V2NvsQRA Talk by @fpletz at NixCon 2018 about networkd and his WireGuard setup] | ||
* [https://www.the-digital-life.com/wiki/wireguard-troubleshooting/ | * [https://www.the-digital-life.com/wiki/wireguard-troubleshooting/ WireGuard Troubleshooting] shows how to enable debug logs | ||
[[Category:Configuration]] | [[Category:Configuration]] | ||