DEV Community

What They Don’t Tell You About Setting Up A WireGuard VPN

Greg Schafer on January 12, 2021

WireGuard is a relatively new VPN implementation that was added to the Linux 5.6 kernel in 2020 and is faster and simpler than other popular VPN op...
Read full post
Collapse
 
tomyo profile image
Tomas Hayes • • Edited

Thanks! Clearly written, I just gave it a go and it works!
Question:

  • So, every time I want to add a client, I have to add an new [Peer] entry in the server's /etc/wireguard/wg0.conf file?
  • I tried sshing into the server with vpn ip address (when connected), and I get a me@10.0.0.1: Permission denied (publickey)., what's the problem here?

I mostly want the VPN to allow me to access devices with ssh.

Collapse
 
grschafer profile image
Greg Schafer •
  1. That is my understanding, yes. Regardless of the flavor of public-key cryptography being used, one side of the communication needs a private key and the other side needs a public key. So, for any peer you want to send a message to, you need possession of their public key in advance. (Keep in mind that the VPN "server" is really just another peer and it can initiate connections to its peers.)
  2. Hard to say without more info! A few ideas and things to check:
    • You might try SSHing with extra verbosity (e.g. ssh -vvv me@10.0.0.1) to see what SSH keys your computer is offering.
    • Make sure the corresponding public key exists in ~/.ssh/authorized_keys on the server, for the user account you're SSHing into.
    • Look in /var/log/auth.log on the server and see what messages sshd is emitting when you try to log in.
    • Make sure permissions on that ~/.ssh folder on the server are correct (sudo chmod 0700 ~/.ssh && sudo chmod 0600 ~/.ssh/*). Same for the ~/.ssh folder on your local machine.
Collapse
 
rafaone profile image
rafaone •

thanks for the tutorial, I'm around into the blogs and web site to try to get help.
I have a Wireguard VPN on my VPS, using a generic tutorial config, i added some peers like my phone, and laptop and working good. When I enable the vpn on cellphone its show that my IP is same of my VPS server.
But I have raspberry pi that use pi hole, and when I enable the vpn on this device my DNS queries goes trough the VPS
and really I would like to access my raspberry but this device dont need to access the internet of wg0 only visible to another devices
I dont know how to configure my raspberry pi peers to connect on VPN but do not outgoing to internet
In other words I would like to access my raspberry but do not allow this peer to navigate to internet trough VPN.

Collapse
 
jdrch profile image
jdrch •

What they don't tell you about WireGuard you can't resolve private hostnames over it. So, for example, if your workflow relies on a remote client having access to local hostnameA, you're SOL. OpenVPN supports that right out of the box, and that's why I've stuck with it instead.

Collapse
 
davidmintz profile image
David Mintz •

Would it be possible to work around that by creating an entry in /etc/hosts?

Collapse
 
catermelon profile image
Rachelle •

You are the absolute best. Thank you so much for this tutorial and writeup. I've been working off and on for like a week to get the VPC thing working and, more importantly, understand what all the wierd arcane iptables magic was doing. Thanks again <3

Collapse
 
sohahm profile image
Sohail Ahmed •

This is the best guide on Wireguard.

Collapse
 
lunatic11 profile image
lunatic •

They tell you all of this. Everyone tells you the same thing.

What they actually don't tell you is how to transfer keys securely between different devices.

Every tutorial on the internet either avoids this entirely or says just copy and paste which sure, does work for two VMs on the same device, but is not practical.

So outside of manually typing out a public key from my server into my client config file, how do I get it there? I don't understand why no one addresses this and most guides say "just copy and paste"

Super weird. If I'm on the same device and just copying and pasting why tf do I need wireguard?

If I have a secure channel for this, why do I need wireguard at all?
If I don't have a secure channel for this, how is my wireguard secure?

Thanks

Collapse
 
christopher_27ffc78ee909f profile image
Christopher •

Something that is worth setting up is running wireguard in a container. Then write a cloud-init script that installs docker and in my case it builds the containers from a docker file, copies over a script to a container than configures wireguard. I then log into the the DO machine and just look at that logs to get the generated configs to paste into my local wireguard configuration. There's probably better ways of doing it as I was mostly just experimenting, but got bored once I got the bare minimum going. I use it all the time, though.

Collapse
 
thirupathicys profile image
Thirupathi K •

@greg

You have mentioned "UDP load balancer in front of multiple VPN servers, but... you might need some network trickery to allow multiple active VPN servers with the same IP address and you might also need sticky sessions"

Please help me out as, how to configure multiple wireguard vpn servers in active-active mode with the same configuration. I tried to establish the vpn connection between peers through multiple wireguard vpn servers in acitve-acitve mode by using UDP load balancer like keepalived.
Kindly let me know the network trickery to allow multiple active VPN servers with the same IP address

Collapse
 
iplayroblox87 profile image
Trisha Dua • • Edited

we got such way. Thanks a lot thedigitalbin.com