Stupid simple setting up WireGuard - Server and multiple peers

WireGuard_Setup.txt

Install WireGuard via whatever package manager you use.  For me, I use apt.

$ sudo add-apt-repository ppa:wireguard/wireguard
$ sudo apt-get update
$ sudo apt-get install wireguard

MacOS
$ brew install wireguard-tools

Generate key your key pairs.  The key pairs are just that, key pairs.  They can be
generated on any device, as long as you keep the private key on the source and 
place the public on the destination.  

$ wg genkey | tee privatekey | wg pubkey > publickey
example privatekey - mNb7OIIXTdgW4khM7OFlzJ+UPs7lmcWHV7xjPgakMkQ=
example publickey - 0qRWfQ2ihXSgzUbmHXQ70xOxDd7sZlgjqGSPA9PFuHg=

One can also generate a preshared key to add an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance.

# wg genpsk > preshared

Take the above private key, and place it in the server.  And conversely, put the 
public key on the peer.  Generate a second key pair, and do the opposite, put the
public on the server and the private on the peer.  Put the preshared key in the client config if you choose to use it.

On the server, create a conf file - /etc/wireguard/wg0.conf (These are examples,
so use whatever IP ranges and CIDR blocks that will work for your network.
################################
[Interface]
Address = 10.0.0.1/24
DNS = 1.1.1.1
PrivateKey = [ServerPrivateKey]
ListenPort = 51820
PostUp   = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp9s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp9s0 -j MASQUERADE

[Peer]
#Peer #1
PublicKey = [Peer#1PublicKey]
AllowedIPs = 10.0.0.3/32

[Peer]
#Peer #2
PublicKey = [Peer#2PublicKey]
AllowedIPs = 10.0.0.10/32

[Peer]
#Peer #3
PublicKey = [Peer#3PublicKey]
AllowedIPs = 10.0.0.2/32

[Peer]
#Peer #4
PublicKey = [Peer#4PublicKey] 
AllowedIPs = 10.0.0.11/32
##################################

On each client, define a /etc/wireguard/mobile_user.conf - 

###################################
[Interface]
Address = 10.0.0.3/24
PrivateKey = [PrivateKeyPeer#1]

[Peer]
PublicKey = [ServerPublicKey]
PresharedKey = [PresharedKey]
Endpoint = some.domain.com:51820
AllowedIPs = 0.0.0.0/0, ::/0 
# if you want to do split tunnel, add your allowed IPs
# for example if your home network is 192.168.1.0/24
# AllowedIPs = 192.168.1.0/24

# This is for if you're behind a NAT and
# want the connection to be kept alive.
PersistentKeepalive = 25
########################################

sudo wg show
#########################################
peer: Peer #1
  endpoint: 192.168.2.1:50074
  allowed ips: 10.0.0.2/32
  latest handshake: 4 minutes, 16 seconds ago
  transfer: 57.58 KiB received, 113.32 KiB sent

peer: Peer #2
  endpoint: 99.203.28.43:36770
  allowed ips: 10.0.0.10/32
  latest handshake: 5 minutes, 30 seconds ago
  transfer: 92.98 KiB received, 495.89 KiB sent
##################################################
  
Start/stop interface  
wg-quick up wg0
wg-quick down wg0

Start/stop service  
$ sudo systemctl stop wg-quick@wg0.service
$ sudo systemctl start wg-quick@wg0.service

Instead of having to modify the file for every client you want to add to the 
server you could also use the wg tool instead:

# add peer
wg set wg0 peer <client_pubkey> allowed-ips 10.0.0.x/32

# verify connection
wg

# save to config
wg-quick save wg0

######### EDIT ##############

I was setting up a relative with a Wireguard config, and figured I might as well use qrencode to do it since I have it installed on my local machine.

qrencode -t ansiutf8 < /etc/wireguard/mobile_user.conf


█████████████████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████████████████████
████ ▄▄▄▄▄ █▄▀████▀▀█ ▄▀▀▀▄▄ ▄▄▄▄▄▀ █ ██▀█ ▄▀▀██▄ ▄ ▀█▀▄█ ▄▄ ▀▄▄▄█ ▄▄▄▄▄ ████
████ █   █ █ ▀▀█▀█▄▄▄   █▀██▄ ▄▀ ▀  ▄▀▄█▄▄ ▄█▀▀█▄▄ ▄█   ▄ █ ▄█▄█▀█ █   █ ████
████ █▄▄▄█ █▄▄█▄ ▀█ ▀▄█████ ▀ ▄▄▀▄ █ ▄▄▄ █▄▄▀▀▀▀▀▀██▄  █▄ ▀ ▀  █▄█ █▄▄▄█ ████
████▄▄▄▄▄▄▄█▄█ █▄▀▄▀ █▄█▄█ ▀ ▀▄▀ ▀ ▀ █▄█ █▄█ █▄█▄█▄▀ █▄▀ █▄▀ █▄▀▄█▄▄▄▄▄▄▄████
████▄▄  ▀▀▄▀  ▄  ██▄ █▀▄▄▀█▄▀ ▄▀▄▀██ ▄ ▄ ▀ █  ██▀ █▀▄▀▄▄  ▀ ▄ █   █▀▄▄ ▀ ████
████▀▄ ▀█▀▄▀█   █ ▀██▄█ █▀▄█▀ ▄▄█▄▀ ▀▄█ ▀▀ ▀▄▀▄▀██▄  ▀██▀▄▀█▀█  █ ▄█ ▄██▀████
█████ ▄▄▀ ▄ ██▀█▀▄ ▄▄█ ▀  ▄ █ ▀██ ▀▄█ █ ▄▄█▄█ ▀▀ ███ █▀▄▀▄ █ ▄█ ▄█▀ █ ▀█ ████
████▀█  ▄ ▄▀▄▀  ▄████▄▄█▄█ █▀█▀ ▀▀█▄█ ▄▀ ▄█▀█▄▀ █▀▄ █▀▄▀ ▄█▄█ ██ █▄▀▀ ▀  ████
████ ▀█ ▄▀▄█▄▄▀ ▀█  ▄█▄█  █▄ █ ▄ ▄ ▀▀█▄▀ ▀▄█ █  ▀  ▀▀ █▀██▄█▄▀ ▄█▄█ ▀▄▄▀▄████
████▄ ▄█ ▀▄▀▄▄▄ █▀ ▄▀█▀▀▄▀█ █▀▄▄▀ ▄█▀ ██ █▀ ▄ ▄▀███▀██▀▀  █▀▄▄  ▄█  █▄█ █████
████▀ ▄ ▄▀▄▄▀▀ ▄ ███▀▀▀█ ▀▄▄█▄▀█▀█▀█  ▄█ ▄█▄█▄█▄█▀▀█▄▀▄█ █ ▀▀▄██ █ ▀▀▄▄ ▄████
████▀▄ ▄█▀▄▀██   █▀ ▄ ▀█▄ ▀▄ █▀  ▄▀▀█ ▄ ▄ ▀▀▀▄▀▀ ▄▄▄▄▀▀▄▀▄████▄█▄ ▄▀▀█▄█ ████
█████ ▀▄▄▀▄ ▄█▄▀█▀  ▀ ██ ▄█ ▄█ ▀▄█▀▄▄ ▀███▄█▀ ██  ▄█ ▄ ▀▀▄▄█▀▀ ██▄▀  █▀▀█████
████  ▀▄█ ▄▀▄ ▀▄ ▀ █▀▄▀█ █ █▀   ██ █ ▄ █▄▄██▀▄▀▀  ▄▀█▄ █▄▄▀ ▀▀▄▀▀██▀ ██▀▀████
█████▄▄█▄█▄▀█▀▀▄▄ ▀▄▀   ▄▀▄▄██▀▀▀▀██▄█▄▄▀ ▄█▄▄█▄▄ █  ▀█▄▀█▀▀▄███▄ ▄  ▀ ▀ ████
█████ ▄  ▀▄▄ ▄▀█▄▄▄█▀█▄▄▄ ▀▀█▄▀█▄█▄█ ▄█▀▄█▀▄█ ██▀▄ ▄ ▄▄▄▀▀███▀█▄█  ▄▀██▀█████
████▄███ ▄▄▄ ▀▄▄▄▄▀▀▄▀▀██▀ █▄   ▀█▀█ ▄▄▄ ▀▀▄▀   █ ▄▀▄ █▀▄▄▀ ▀▄▄▄ ▄▄▄ ▄▄ █████
████▄ █▀ █▄█  █▀▄ ▀▄ ▄  ▄ ▀█▄█▀█ ▀▀█ █▄█ ▀█▀ ▄████▀▄█ ▄▀▄ ██▄▄▄  █▄█ ▀▄▄▄████
████  ▄▄ ▄▄▄▄█ █  ▀▀█▄▄▄  █▄ ▄ █▀▀▀      ██▀▄▄▄▀██▀    ▄▄ ▄▀██▄▄▄   ▄▀  █████
████▀█▀▀▄ ▄▀▀▄ ▄▀ ▀▀ ▀▄ █▀▄█  ▀   █▀▄▀▄▀▀█▄▀ ▄▄▀▀ ▀▀██ ▀▄▄▀▄▀▀▄ ▄▀███▄ ▄▄████
█████▀  ▀ ▄ █▀▀ ██ ▄▀▀▀▀▄█▀█▀  █  ▀█▄ ▀█▄ █▀███ █▄    ▄▀▀▄██▄▄ ▄▄█▀▄  ▄  ████
███████▄ ▄▄▄ ▀▄▄ ▀ ████▄  ▀█▀▀▀█▄▀ ▀    ▄█  ▀ ▄█▀▄ █▀▀▀▄▄▀▀  ▄█▄  ██▀ ▀ █████
██████    ▄▄▄▀  █▀  ▀▀ ▄ ▀ █ ▀ ███  ▄▄ ▄▀ ███▄▀ ▄ ▄▀ ▄███▄█▄▀▀▄█  ▄▀    ▀████
████ ▄█▀▀▀▄▀▀ ▀█ ▀▄  █  █▀▄▄▄█▀▄  ▀ █▄▄█▄ ▄▄▀█ ▀ █▀▄▀ ██▀▄█▀▀█  ▄▀▄█▄ █▄ ████
████▀███▀▀▄▀ ▀ █ ▄▀▄█ █▀██▀▀▄▀██ ▀▀▄▀█  ▀ ▀ ▄ ▀  ▀▄█▀█▄█ ▄▀ █▀▄  ██▄█▀▀▀ ████
████▄ ▄▄▄▀▄▀▄ █▄ █▀ ▄▀▄  █▄▄▀ ▄▀█▄▀█▀▀ █▀ █ █▄▄ ▀▀ █▄▄▀█ █▀ ▀ ▀▀▄   ▄  ▄█████
████ ▄▀█ █▄▀▄▀▄ ▄▄▄▀▄▄▀ █▀ ▄█▀▄█▄▄█ ▄▀▄ █▀█▀▀█▀█▀█  ▀ ▀▀▄█▀▄▄   ▄▄█▀ █▄█ ████
████▀ █ ▀█▄▄█▄▀▄ █▄▄ █▀█▄█   ▀█▄▄▀▀█ ▄▀▀▄▄▄▄▀█▄▄▀█ ▀█▄ ▄   ▀█▄▀█▄█▀▄▄ ▄█▀████
████ ▄  ▄ ▄█▀▀▀▄ ███ █▄▄█ █▄▀██▀▄████▄█▄██▄█▀▀▄ █▄▀ █▀▄█▀█ ▄█▄█▀    ▀██▄▀████
████ █▄█▄▄▄▄  ▄▄███▀▄▄█ ▄▀▄▄█  ▄█ ▀▄▄▀▄█▀▀█▀▄▄▄█▀█▀ ▀ █▀ ▄▀▀ ▀ █▀  ▄ ▄ ▄ ████
████▄██▄▄█▄▄ ▄▄ █▀▄█▄█ ██ ▄▀█████▀▀  ▄▄▄ ▄▀▄█▀▀ ▀█▀▀▄█▄ ▄▄ █ █▄▀ ▄▄▄ ▄▄█▄████
████ ▄▄▄▄▄ ██ █▄▄▀▄ █▀▀▄▄█▄ ▄▄▀ ▀▀██ █▄█ ▀██ ▄▀▄█▀ ████▀▄██▄█▀█▄ █▄█  ▀▄▀████
████ █   █ █▀▀▄█  ▄▄█ █ ▄▄█▄ ██▄▄▀▀█▄▄▄  █▄▄▀█▄█▄▄▄ ▀ ▀ ▀▀▄█▀▄ ▀  ▄▄ █▄▀▄████
████ █▄▄▄█ █ ▄█ ▄▀ █ █▀▄▀▄█ ▀▀▀▀██ █▄  █▀▀ █ ▀▄▀▄▀█▀ ▄█▀▀ █▀▄▄ ▀▄▄ █▀ ▀█▀████
████▄▄▄▄▄▄▄█▄███▄▄██▄▄▄▄▄█▄█▄█▄▄█▄▄▄▄█▄█▄▄█▄▄▄█▄▄█▄███▄█▄████▄█▄██▄█▄█▄██████
█████████████████████████████████████████████████████████████████████████████
████████████████████████████████████████████████████████████████████████████

To make possible communicate two peers connected to a peer acting as vpn server, the server must enable packet forward changing the file:

/etc/sysctl.conf

Uncomment the line with

net.ipv4.ip_forward=1

save and run to update configuration

$ sysctl -p

What do your peers' config files look like? The QR code does me no good.

Otherwise, thanks! This has helped me a lot already.

@charlescurley you're looking for the block between lines 60 and 77 for an example peer config.

@OvertCoffee is correct.

@charlescurley on your remote device, you would define a conf file and it would look like:

[Interface]
Address = 10.0.0.3/24
PrivateKey = [PrivateKeyPeer#1]

[Peer]
PublicKey = [ServerPublicKey]
PresharedKey = [PresharedKey]
Endpoint = some.domain.com:51820
AllowedIPs = 0.0.0.0/0, ::/0 

PersistentKeepalive = 25

I'm just amazed people find this gist useful. :)

is there a way I can allow multiple people to connect to just one config?

Are you saying, allow multiple people using their own individual configs to connect to one server? Absolutely.

These are examples:

On the server:

Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = wBfQNbT+SbkCl1Hsgv+sPV0kwpKdqC4Q3I94isUtQHQ=


[Peer]
PublicKey = NSPdMgTuLHnlg2PRio3x6GnVWicrUE+iaClEcPTfInc=
AllowedIPs = 10.0.0.2/32

[Peer]
PublicKey = qW7suzm8Jw+0/Qu9g/lS5403PYzMk/HGgtG9Av3U0TI=
AllowedIPs = 10.0.0.3/32

[Peer]
PublicKey = 8AgfQ408s9dmyAfVDccytqHBn5zEoIn6HWQ/OTH1Tyg=
AllowedIPs = 10.0.0.4/32

Client 1

Address = 10.0.0.2/24
ListenPort = 51820
PrivateKey = 6PEGUwl7UMRj2veHOAkTryAu+Nm0tqjZlHBtVQH10GY=

[Peer]
PublicKey = 4UfqmvsT2uFz17wUScJxBGmmZ0LWRealFecgO2UheW4=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = myserver.dyndns.org:51820

Client 2

Address = 10.0.0.3/24
ListenPort = 51820
PrivateKey = sG6LRsykciC46TGprzQvQZpjDOo9ekqijRCATQe4Zk8=

[Peer]
PublicKey = 4UfqmvsT2uFz17wUScJxBGmmZ0LWRealFecgO2UheW4=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = myserver.dyndns.org:51820

Client 3

Address = 10.0.0.4/24
ListenPort = 51820
PrivateKey = qPD27SKbSp3dTdFIQ3KakwRgpXJdHBcrEUralEMATEs=

[Peer]
PublicKey = 4UfqmvsT2uFz17wUScJxBGmmZ0LWRealFecgO2UheW4=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = myserver.dyndns.org:51820

no i meant allow multiple people to use a shared config. basically 1 config for like 5 people or something.

Why would you do that? If one person goes rogue and you need to prohibit them from connecting, you have to delete the config and reissue a new config to share with the remaining 4.

You could probably do it, it is just bad practice.

In case I would ever want to use it for a vpn app so it would allow people to use wireguard and it just makes things easier. Also if one of them goes rouge I could just use iptables and ban their ip address from the server to stop them from connecting.

If I go rogue and you ban my IP, I'll just come in from somewhere else with a different IP. Plus IP address may be dynamic, so that isn't a good strategy.

Seriously, if that is your route, issue credentials for each user. If you think that is too complex, just use something like https://www.wireguardconfig.com

That's a good point. Anyways thanks for your help. :)

Hi Chris, great post, thank you. If I want to connect a peer to another peer, what would the configuration file look like?
I have my server sitting on Ubuntu but the server my users need to access is a windows server that I've setup as a peer to Ubuntu.
I added the public key for each peer to the others config file but that didn't work.

Hi Chris! Posting that wireguardconfig site is so helpful! Great write up.

@kaylamc2 Heh, it makes it a little easier. While I still use Wireguard for things, tailscale.com awesome, especially for an enterprise.

I'm new to WireGuard and this is just a fantastic help. Thanks.

@chrisswanda Can a single configuration file be used by multiple users, say, five users sharing the same configuration file? The use case is as follows: I am using the GitHub Action matrix, where the GitHub Action machine may have any IP address, making it difficult to whitelist those IPs in my database. Therefore, I am using a VPN, but providing a separate configuration file for each machine is challenging. Instead, can I create a single configuration file for all GitHub machines to use?

I would never reuse credentials; it is not a good operational practice. How is providing a separate configuration file challenging, versus if one of your credentials get compromised, and now you have to rotate out your single config on multiple machines versus changing a compromised credential on one machine? Merely curious. If you have to chop down a tree in 6 hours, spend 5 hours sharpening your axe.

But yes, you could use the same config on multiple machines. You are only using public/private key pairs.

@chrisswanda It's challenging and very complicated. Here is how
I have used the sharding technique in my BE and UI Tests and run my test parallelly. So GitHub action on the fly create job(machine).

On the contrary, it would be easy for me to rotate the GitHub config file if I am using one config. Instead of 20 config files for GitHub action

If you are running that many machines, you might want to look into something else, but that is another conversation.

But, if merely changing out a config file works and you are comfortable with using one credential, then it should work. It is merely a public/private keypair.

Hi Chriss,
How to configure the wireguard VPN server in the load balancing scenario with multiple vpn servers in active-active mode ?. Wireguard peers should communicate between each other through multiple vpn server placed behind the udp load balancer?

In 10.0.0.x/32 is the x literally x? Or should I substitute it with a number?

Google ip address range nomenclature

…

On Wed, Oct 18, 2023, 10:07 AM tabatinga0x00 ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ In 10.0.0.x/32 is the x literally x? Or should I substitute it with a number? — Reply to this email directly, view it on GitHub <https://gist.github.com/chrisswanda/88ade75fc463dcf964c6411d1e9b20f4#gistcomment-4729891> or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKDGCNMHSKSJ36LYBJEHE2TX77PAJBFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFQKSXMYLMOVS2I5DSOVS2I3TBNVS3W5DIOJSWCZC7OBQXE5DJMNUXAYLOORPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVA4TGNRQG42TINNHORZGSZ3HMVZKMY3SMVQXIZI> . You are receiving this email because you commented on the thread. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .

In 10.0.0.x/32 is the x literally x? Or should I substitute it with a number?

@tabatinga0x00 x would be whatever number you wish between 2 and 254.

Chris, you get the same thing... 😁

…

On Wed, Oct 18, 2023, 1:26 PM Chris Swanda ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ @Dave9111 <https://github.com/Dave9111> I think you should google IP CIDR notation. :) — Reply to this email directly, view it on GitHub <https://gist.github.com/chrisswanda/88ade75fc463dcf964c6411d1e9b20f4#gistcomment-4730252> or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKDGCNJDTQPELHV7CXE3DBDYAAGLZBFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFQKSXMYLMOVS2I5DSOVS2I3TBNVS3W5DIOJSWCZC7OBQXE5DJMNUXAYLOORPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVA4TGNRQG42TINNHORZGSZ3HMVZKMY3SMVQXIZI> . You are receiving this email because you were mentioned. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .

From the Arch Wiki, use

wg genkey | (umask 077 && tee privatekey) | wg pubkey > publickey

So the private key is created not readable to others.