Getting NordVPN WireGuard details

GetNordVPNWireGuardDetails.md

About

Instructions to obtain WireGuard details of your NordVPN account. These can be used to setup a WireGuard tunnel on your router to NordVPN.

Source: https://forum.gl-inet.com/t/configure-wireguard-client-to-connect-to-nordvpn-servers/10422/27

Prerequisites

If you have any linux machine, use that or install a vm if you don't have one.

Get their official linux app installed. Make sure you have wireguard installed too. And set the used technology to Nordlynx by running nordvpn set technology nordlynx

Fetching details

Connect to nordvpn with command: nordvpn connect (don't forget to login with nordvpn login --legacy).

Fetch (your) IP address

After successful connection run

ifconfig nordlynx

Fetch your private key

Run

sudo wg show nordlynx private-key

Output of this command should be something like this:

CKMAE9LARlt2eZHgGnNaSUYiKllKJN7f3hed/bWm5E8=

The key above is just a random key for demo purposes.

Fetch your public key

Run

sudo wg show nordlynx public-key

Output of this command should be something like this:

TO158iXbNXt2eZHgGnNaSUYiKZHgGN7f3hed/bWm5E8=

The key above is just a random key for demo purposes.

Fetch server details

Make sure you have curl and jq installed on your host/router. These are needed to be able to fetch the config of NordVPN Server. If not installed, go ahead and install

opkg install curl jq

After installation enter the command below to fetch the recommended server config:

curl -s "https://api.nordvpn.com/v1/servers/recommendations?&filters\[servers_technologies\]\[identifier\]=wireguard_udp&limit=1"|jq -r '.[]|.hostname, .station, (.locations|.[]|.country|.city.name), (.locations|.[]|.country|.name), (.technologies|.[].metadata|.[].value), .load'

Output:

uk1818.nordvpn.com #your endpoint host
178.239.166.185 #its ip address
London #city
United Kingdom #country
K53l2wOIHU3262sX5N/5kAvCvt4r55lNui30EbvaDlE= #Server public key
10 #Server load at the time.

Or just visit the following url https://api.nordvpn.com/v1/servers/recommendations?&filters\[servers_technologies\]\[identifier\]=wireguard_udp&limit=1 from your browser and look for the details manually.

Here is a script to automatically collect this info and write it into a config file, as well as display the config as a QR code. Requires jq and qrencode. The script expects you to be connected via Nordlynx and sudo asks you for your password to get your private key and IP.

#!/bin/bash
my_interface=$(sudo wg show | grep interface | cut -d" " -f2)
my_privkey=$(sudo wg show $my_interface private-key)
my_ip=$(ip -f inet addr show $my_interface  | awk '/inet/ {print $2}')

read host ip city country serv_pubkey < <( echo $(curl -s "https://api.nordvpn.com/v1/servers/recommendations?&filters\[servers_technologies\]\[identifier\]=wireguard_udp&limit=1" | jq -r '.[]|.hostname, .station, (.locations|.[]|.country|.city.name), (.locations|.[]|.country|.name), (.technologies|.[].metadata|.[].value)'))

sid=$(echo $host | cut -d. -f1)
fn="nvpn_"$sid".conf"
echo Server: $host \($ip\) has pubkey $serv_pubkey

echo writing config to $fn
echo "#config for nordvpn server $sid"  > $fn
echo "[Interface]"                      >> $fn
echo "Address = $my_ip"                  >> $fn
echo "PrivateKey = $my_privkey"            >> $fn
echo ""                                 >> $fn
echo "[Peer]"                           >> $fn
echo "PublicKey = $serv_pubkey"         >> $fn
echo "AllowedIPs = 0.0.0.0/0"           >> $fn
echo "Endpoint = $host:51820"           >> $fn

echo ""
echo "Content of $fn:"
cat $fn

qrencode -t ansiutf8 < $fn

# uncomment this line to automatically copy the .conf to the wg directory, then you can use it directly with "wg-quick up nvpn_xy1234"
#sudo mv $fn /etc/wireguard && sudo chmod 600 /etc/wireguard/$fn

(quick edit to shorten the .conf filename, since wg-quick on linux does not support it if the .conf filename is longer than 15 chars)

Thank you very much, @dsvf
I couldn't get my unraid wireguard tunnel working by entering the details manually - I didn't really know what went where. Happily, importing the conf generated by your script just worked. :)

The nordvpn login --legacy no longer appears to work; it could be because I enabled MFA on my account or it could just be fully deprecated now.

However, the Nord VPN account panel allows you to generate a token (I recommend doing a 30 day expiry since I don't believe you should need to repeat these instructions), and then you can do

nordvpn login --token <TOKEN>

I was also doing this on a remote headless Linux machine (because it was quicker than downloading an ISO to make a local VM) and found that as soon as it was connected to the VPN I lost all access - almost certainly because the default route changed so my mosh session was disrupted. I tried doing nordvpn set routing off to try and stop the Nord VPN client from doing dumb stuff with my routing table, but that didn't work. What did work was taking advantage of "shortest-route-wins" and adding a route for my source IP to use the existing gateway which took precedence over the new default route:

# find my default gateway
root@instance:~# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         172.20.0.1      0.0.0.0         UG        0 0          0 enp0s3
169.254.169.254 172.20.0.1      255.255.255.255 UGH       0 0          0 enp0s3
172.17.0.0      0.0.0.0         255.255.0.0     U         0 0          0 docker0
172.18.0.0      0.0.0.0         255.255.0.0     U         0 0          0 br-1d9cab47c790
172.20.0.0      0.0.0.0         255.255.255.192 U         0 0          0 enp0s3
172.20.0.1      0.0.0.0         255.255.255.255 UH        0 0          0 enp0s3

# add a new route via the existing gateway, substitute your source IP for 127.127.127.127
# if you don't know your IP then https://ipv4.icanhazip.com from your client machine
root@instance:~# route add -host 127.127.127.127 gw 172.20.0.1

# verify the route was added
root@instance:~# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         172.20.0.1      0.0.0.0         UG        0 0          0 enp0s3
127.127.127.127 172.20.0.1      255.255.255.255 UGH       0 0          0 enp0s3 <<<<<<<<<<<
169.254.169.254 172.20.0.1      255.255.255.255 UGH       0 0          0 enp0s3
172.17.0.0      0.0.0.0         255.255.0.0     U         0 0          0 docker0
172.18.0.0      0.0.0.0         255.255.0.0     U         0 0          0 br-1d9cab47c790
172.20.0.0      0.0.0.0         255.255.255.192 U         0 0          0 enp0s3
172.20.0.1      0.0.0.0         255.255.255.255 UH        0 0          0 enp0s3

Hope this helps someone stumbling across this gist...

It's been quite difficult to get set up with a Linux VM on macOS to be able to do this. I've tried using Lima and well as a Docker image and hit dead ends in both cases. Lima doesn't work because as soon as you turn on the VPN you can no longer access the VM. Docker doesn't work because systemctl isn't supported in Docker images. If anyone has a simple and free way to get a Linux VM working on macOS where you can actually get the Nord Wireguard config, please share!

It's been quite difficult to get set up with a Linux VM on macOS to be able to do this. I've tried using Lima and well as a Docker image and hit dead ends in both cases. Lima doesn't work because as soon as you turn on the VPN you can no longer access the VM. Docker doesn't work because systemctl isn't supported in Docker images. If anyone has a simple and free way to get a Linux VM working on macOS where you can actually get the Nord Wireguard config, please share!

I would expect Virtualbox would work fine, since even if you lose network connectivity you still have the virtual console?

Otherwise it may be that you can use the same behaviour I posted above (shortest route wins in a routing table) to allow local traffic to not be disrupted within your VM. If you were to check the routing table on your Lima VM before starting, then add routes for 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8 via whatever the pre-existing gateway is, you may find that network access is retained.

You can whitelist SSH ports to be able to access your box even when VPN is on (or use the console from your VPS hoster).

nordvpn whitelist add port 22 - Add a rule to whitelist a specified incoming port. You can also whitelist multiple ports — just separate their numbers with a space.
nordvpn whitelist remove port 22 - Remove the rule to whitelist a specified port.
nordvpn whitelist add subnet 192.168.0.0/16 - Add a rule to whitelist a specified subnet.
nordvpn whitelist remove subnet 192.168.0.0/16 - Remove the rule to whitelist a specified subnet.

as per https://support.nordvpn.com/Connectivity/Linux/1325531132/Installing-and-using-NordVPN-on-Debian-Ubuntu-Raspberry-Pi-Elementary-OS-and-Linux-Mint.htm

Or simpler; chain the commands ending with nordvpn disconnect

Beautiful! Running nordvpn whitelist add port 22 on my VM did the trick.

By the way, I think the public key should be the Wireguard server's public key as for example returned by the API rather than the output of sudo wg show nordlynx public-key which is a different value.

Here is an updated version of the script, which will also install any required packages in order to generate configuration file:

#!/usr/env/bin bash

required_packages=()

check_if_connected() {
    if [ -n "$(nordvpn status | grep "Status: Connected")" ]; then
        return 0
    else
        return 1
    fi
}

# Check whether jq package is installed
if ! command -v jq &> /dev/null; then
    required_packages+=("jq")
fi

# Check whether wireguard package is installed
if ! command -v wg &> /dev/null; then
    required_packages+=("wireguard")
fi

# Check if curl package is installed
if ! command -v curl &> /dev/null; then
    required_packages+=("curl")
fi

# Check if nordvpn package is installed
if ! command -v nordvpn &> /dev/null; then
    required_packages+=("nordvpn")
fi

# Install missing packages required to generate the configuration file
if [ ${#required_packages[@]} -gt 0 ]; then
    sudo apt install -y "${required_packages[@]}"
fi

if ! check_if_connected; then
    nordvpn connect
fi

interface_name=$(sudo wg show | grep interface | cut -d " " -f 2)
private_key=$(sudo wg show $interface_name private-key | cut -d " " -f 2)
my_address=$(ip -f inet addr show $interface_name | grep inet | awk '{print $2}' | cut -d "/" -f 1)

api_response=$(curl -s "https://api.nordvpn.com/v1/servers/recommendations?&filters\[servers_technologies\]\[identifier\]=wireguard_udp&limit=1")
host=$(jq -r '.[]|.hostname' <<< $api_response)
ip=$(jq -r '.[]|.station' <<< $api_response)
city=$(jq -r '.[]|(.locations|.[]|.country|.city.name)' <<< $api_response)
country=$(jq -r '.[]|(.locations|.[]|.country|.name)' <<< $api_response)
server_public_key=$(jq -r '.[]|(.technologies|.[].metadata|.[].value)' <<< $api_response)

server_identifier=$(echo $host | cut -d "." -f 1)
configuration_file="nordvpn-$server_identifier.conf"

{
    echo "# Configuration for $host ($ip) in $city, $country"
    echo "[Interface]"
    echo "Address = $my_address"
    echo "PrivateKey = $private_key"
    echo ""
    echo "[Peer]"
    echo "PublicKey = $server_public_key"
    echo "AllowedIPs = 0.0.0.0/0"
    echo "Endpoint = $host:51820"
} > "$configuration_file"

if check_if_connected; then
    nordvpn disconnect
fi

It will also automatically connect to NordVPN and then disconnect after configuration file is generated.

nordvpn login --legacy

This options looks like it has been removed at least in Nordvpn 3.16.2

To get around that.
From https://www.reddit.com/r/nordvpn/comments/rp59mn/log_in_to_nordvpn_in_the_terminal/

linux# nordvpn login
Follow the link on a web browser somwhere,
login and cancel the popup link
copy the link address for the "continue" link

linux#nordvpn login --callback "PASTE THAT CONTINUE LINK HERE"

You should now be logged on.

I could not get the web browser login to work method to work no matter what variations I tried. The only method I managed to get working was the one mentioned by @g-a-c

nordvpn login --token
Go to nordaccount.com and click on NordVPN.
Scroll down until you see the Access token tab. Click on Generate new token.