HarvsG/WireGuardNordUpstream.md

## WireGuardNordUpstream.md

      
    Raw
  

              WireGuardNordUpstream.md
            
          
    Edit: Likely outdated/broken. See discussion below

Wireguard with Nord Upstream


On a seperate, local machine install NordVPN sh <(wget -qO - https://downloads.nordcdn.com/apps/linux/install.sh)
Enable nord permissions sudo usermod -aG nordvpn $USER && sudo reboot
set Nord to use wireguard nordvpn set technology NordLynx then nordvpn login
nordvpn whitelist add subnet 192.168.0.0/24
On the local machine connect to the nordvpn country of choice nordvpn connect ch, ch is Switzerland
On the local machine sudo wg showconf nordlynx to see the client private key and server pubkey

also run ifconfig to see the nordlynx ip, probably 10.5.0.2
also run curl -s "https://api.nordvpn.com/v1/servers/recommendations?&filters\[servers_technologies\]\[identifier\]=wireguard_udp&limit=1"|jq -r '.[]|.hostname, .station, (.locations|.[]|.country|.city.name), (.locations|.[]|.country|.name), (.technologies|.[].metadata|.[].value), .load' to see server pubkey and server hostname server.nordvpn.com
sudo wg show will show the interface pubkey


on the local device nordvpn d to disconnect, freeing the credentials to be used by our server

Configure the server


Boot up and log in to your favourite VPS provider and create a new instance. I used Oracle's free tier
Log in to the instance sudo apt update && sudo apt upgrade -y
Whilst waiting, if you want to, point a new domain name at the IP of the server.
Install pivpn curl -L https://install.pivpn.io | bash
Edit ,/etc/pivpn/wireguard/setupVars.conf to have piVPNnet 10.5.0.0 and DNS 1.1.1.1 unless doing pihole in which case 10.5.0.2
Edit sudo nano /etc/wireguard/keys/server_priv and sudo nano /etc/wireguard/keys/server_pub to be the NordVPN client private and public keys you found from the local machine.
Edit sudo nano /etc/wireguard/wg0.conf to have the correct private key and address 10.5.0.2/24
run pivpn -d and agree to the suggested changes
Stop the wireguard server sudo wg-quick down wg0
Run these commands - make sure the tunnel is down

sudo ip route get 1 | grep -Po '(?<=src )(\S+)'
sudo ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)'
sudo ip -4 route ls | grep default | grep -Po '(?<=via )(\S+)'


Append the following, but completed to the end of /etc/wireguard/wg0.conf

PreUp = ip rule add from <output from command 1> table 128
PreUp = ip route add table 128 to <output from command 1>/32 dev <output from command 2> 
PreUp = ip route add table 128 default via <output from command 3>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o %i -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o %i -j MASQUERADE
PostDown = ip rule del from <output from command 1> table 128
PostDown = ip route del table 128 to <output from command 1>/32 dev <output from command 2> 
PostDown = ip route del table 128 default via <output from command 3>

### begin nord upstream ###
[Peer]
PublicKey = <public key of the nordvpn wg server>
AllowedIPs = 0.0.0.0/0
Endpoint = <nord address e.g ch215.nordvpn.com>:51820
PersistentKeepalive = 25

pivnp -a --name ignoreme Create a profile that wont be used because it has a conflicting IP (10.5.0.2)

Comment out the ignoreme peer


Example of what wg0.conf should look like when done

[Interface]
PrivateKey = <hidden>
Address = 10.5.0.2/24
ListenPort = 51820

PostUp = ip rule add from 10.0.0.108 table 128 pref 1
PostUp = ip route add table 128 to 10.0.0.108/32 dev ens3
PostUp = ip route add table 128 default via 10.0.0.1
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o %i -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o %i -j MASQUERADE
PostDown = ip rule del from 10.0.0.108 table 128
PostDown = ip route del table 128 to 10.0.0.108/32 dev ens3
PostDown = ip route del table 128 default via 10.0.0.1


### begin nord upstream ###
[Peer]
PublicKey = SqvsfSVdnUJgsdfgsdfgwPgvwQagdsgrrF8=
AllowedIPs = 0.0.0.0/0
Endpoint = ch215.nordvpn.com:51820
PersistentKeepalive = 25

### begin ignoreme ###
#[Peer]
#PublicKey = +B9olwKGeULQMFEmyfgdhdfghgdfhFVj2Csfgdfsg4FM=
#PresharedKey = 5UasdfadfsVsdfgsdfg4Gm+12yFSwdrW3WGRzY=
#AllowedIPs = 10.5.0.2/32

sudo wg-quick up wg0 should go up without a hitch.
sudo iptables --line-numbers --list and then iptables -D FORWARD X where X is the number that rejects with ICMP
If setting up a pihole, follow these steps https://gist.github.com/HarvsG/008700c8d187b072cca335b9a85ad34d#pihole-unbound-and-cloudflared
Add clients with pivpn -a
A google search of 'what is my ip' should reveal the IP of the NordConnection

You can run dig +short myip.opendns.com @resolver1.opendns.com on any connected machine to see if it stays in the nord connection
Navigating to https://nordvpn.com/ and looking at the banner will tell you if nord recognises you from their servers