This looks like a very comprehensive guide with lots of practical examples. Good job! What I cannot see explicitly mentioned anywhere, is a full example of how to set up a central wireguard server which routes client traffic from the VPN subnet out to the Internet. Is this done automatically/implicitly? If so how? I don’t see enough commands to make this happen. Am I just stupid? What am I missing?
Just add `,0.0.0.0/0` to AllowedIPs on the central server, and `,0.0.0.0/0` on the peer definition for the central server on all the clients. I'll add an example to the docs as well.
Wireguard-docs: Setup, usage, configuration, and a full example
81–90 of 96 posts
Re: Wireguard-docs: Setup, usage, configuration, and a full example
#82For anyone wanting to get WireGuard up and running in a few minutes with zero hassle, I usually use this excellent bash script [0] as my goto. Can be edited for DNS/subnet config, generates .conf files as needed and also handles QR code generation for adding mobile devices. Pair this with a $5 DO droplet and you're all set. [0] https://github.com/its0x08/wg-install
You can also integrate it into other deployment/key managements solutions by reading in config values from files/commands. I added sections to detail that here:
- https://github.com/pirate/wireguard-docs#config-shortcuts
- https://github.com/pirate/wireguard-docs#How-WireGuard-Manag...
- https://github.com/pirate/wireguard-docs#Dynamic-IP-Allocati...
Re: Wireguard-docs: Setup, usage, configuration, and a full example
#83My first thought is usually to check the Arch Wiki[0]. As usual, it does not disappoint. [0]: https://wiki.archlinux.org/index.php/WireGuard
I love the Arch wiki, used it as a reference for a lot of my setup while I was writing these docs. Also linked to it at the bottom under Further Reading.
Re: Wireguard-docs: Setup, usage, configuration, and a full example
#84Looks like a great write up, very thorough. I wrote up a quick guide how to make the mobile setup a little easier with QR codes within the WireGuard mobile apps - when I get the time I’ll submit a pull request to get something included. https://grh.am/2018/wireguard-setup-guide-for-ios/
Thanks! Just added this link under the Further Reading section.
Re: Wireguard-docs: Setup, usage, configuration, and a full example
#85Re: Wireguard-docs: Setup, usage, configuration, and a full example
#86It's seriously weird that `Address=10.0.1.2/32` works at all. An Address should have a correct subnet mask (like your IP at home might be 192.168.1.25/24, not 192.168.1.25/32). The documentation is complete, but I think the most important topic is `AllowedIPs`. The rest is pretty standard and unsurprising (if you have any networking knowledge at all). I had written a bit about AllowedIPs when I switched to WG myself:…
I just added a section to clarify this common confusion under the CIDR entry in the glossary:
Re: Wireguard-docs: Setup, usage, configuration, and a full example
#87Could Wireguard have been written in Rust or does it require C for some reason? We've seen CVEs in major libraries (e.g. openssl) and some of the guarantees Rust provides would prevent certain classes of vulnerabilities. Has the author not learnt from the past or does it actually need to be written in C for some reason?
You don't seem to have spent a single minute researching before posting :/ The original implementation is a kernel module. You can find a bunch of (excellent) talks online by wireguard's author which all have a focus on security aspects and avoiding vulnerabilities. Besides, Go and Rust (3rd pty) implementations exist.
Don't hate on people who ask easy questions ;)
I have a short post about it here:
Re: Wireguard-docs: Setup, usage, configuration, and a full example
#88I looked a bit into Wireguard. But it seems it's only really useful with static IPs. Say my "Server" is behind a DDns Hostname and i want to connect to it from my Phone. So my problem is. I allow incoming from 0.0.0.0 but on my mobile the DDns Hostname gets compiled to a specific IP. OpenVpn has no problem with this setup. Is it solvable with Wireguard? wg-dynamic seems to tackle this but wasn't really ready last tim…
I added a section on Dynamic IPs to the docs here:
https://github.com/pirate/wireguard-docs#Dynamic-IP-Allocati...
Re: Wireguard-docs: Setup, usage, configuration, and a full example
#89Could Wireguard have been written in Rust or does it require C for some reason? We've seen CVEs in major libraries (e.g. openssl) and some of the guarantees Rust provides would prevent certain classes of vulnerabilities. Has the author not learnt from the past or does it actually need to be written in C for some reason?
WireGuard has already been re-written in rust by CloudFlare, see https://blog.cloudflare.com/boringtun-userspace-wireguard-ru... The C version is still faster because it's a kernel module.
I've added more details about competing implementations here:
https://github.com/pirate/wireguard-docs#Other-WireGuard-Imp...
Re: Wireguard-docs: Setup, usage, configuration, and a full example
#90Earlier quoted context omitted.
I'm not the person you're replying to, but I think this is what they were referring to from their github: https://github.com/sowbug/mkwgconf
Aaaaand I'm awake after a good night's sleep and far past the edit window for my original comment. Thank you for that link; yes, it's the one I meant to post. Sigh.
Thanks for this tool, I just added it to the docs:
https://github.com/pirate/wireguard-docs/commit/faaf447868a5...