5 ms·

I think it's worth knowing how simple and easy it is to set up wireguard when you don't need a web UI or any of that other fluff on there. Every computer runnin

I think it's worth knowing how simple and easy it is to set up wireguard when you don't need a web UI or any of that other fluff on there. Every computer running linux on a recent enough kernel can do it on a completely clean base install -- I figure a lot of the appeal for me is that I'm not introducing any risks on my system by installing extraneous packages. Means less maintenance whenever those have to be updated for security problems, meaning we get to bird two stones with one kill. Can be set up with nothing more than the shell and vi. It's right in entrypoint.sh[1] and some dockerfiles - set up firewall; set up wireguard devices, keys and configs; set up dnsmasq. Three simple steps on linux or openbsd (Not sure if FreeBSD ever got past that integration issue yet) [1] https://github.com/subspacecommunity/subspace/blob/master/entrypoint.sh https://github.com/subspacecommunity/subspace/blob/master/en... I think it's also worth mentioning this works even better than openvpn as a client on windows and my phones!

xxpor 5y ago
Setting up the FW and routing is not trivial for anyone who hasn't had to deal with that aspect of Linux before. 99% of people are going to want a straightforward tunnel that simply forwards everything to the default route table of the server. Which is of course what the linked script does. But even experienced devs are doing to have no idea what the heck a prerouting chain or a masquerade rule does.
- 3np 5y ago
  I've done that journey. At least for me, a major issue turned out to the abstractions (like wg-quick, ufw, network-manager, openwrt) which on one hand obscure the inner workings but at the same time are limited enough that at some point you will be forced to dig deeper. They also don't always play nicely together wrt routes, routing polices and *tables rules. I wasted so much time (probably weeks, added together) in my younger days banging my head against the wall with Linux networking. Throwing out other high-level tools/frameworks and starting "from scratch" on CentOS/Rocky/Debian with only systemd-networkd and nftables has now made me mostly comfortable and I finally feel in control of the networking stack on my Linux boxes. I say "mostly" because, well, Docker and CNI... Oh, and see my sibling comment.
  - jamal-kumar 5y ago
    Just use OpenBSD, so much of that crap just gets out of the way because it was never glued on without anyone asking. For routing stuff like VPNs and routers especially this becomes my first choice, unless we're really needing to hit gigabit speeds... Try fresh air for once!
Proven 5y ago
> Can be set up with nothing more than the shell and vi. One can create a full featured OS with the shell and vi.
sandworm101 5y ago
I'm a linux user and I want plenty more than just a VPN connection. I want the icon that tells me the VPN is connected. I want the GUI that lets me manage which server I am connecting to and which servers are the most loaded at a particular moment. I want to control from which country my traffic appears on the public internet. I want the little graph showing me that my traffic is indeed flowing over the VPN service. I want a kill switch daemon ready to cut off my traffic should the VPN connection fail. And I want all of that without having to edit any scripts.
- 8K832d7tNmiQ 5y ago
  Then you should've known that KDE already have wireguard applet implemented in their network manager already in version 5.21 while Gnome is on a track and just waiting to be merged.
  - johnchristopher 5y ago
    Does KDE network manager still delete the VPN entry at the end of the setting up process if there is an error in the config ? Anyway, I was just looking how to add a WG VPN entry in kubuntu 18.04 but its version of KDE is a bit behind so CLI it is. I'd settle for an independent KDE widget though.
    - johnchristopher 5y ago
      FFS, they still do and what's worse is that bringing up the VPN manually on the command line trigger a notification and a temporary vpn entry in the network panel. But it disappears when bringing down the VPN.
3np 5y ago
Two things I learned that were game-changers in setting up and managing Wireguard on Linux: * The semantics and behavior of AllowedIPs. In itself, it means what IPs are allowed to be routed through the tunnel (that is, IPs "on the other end"). wg-quick will, additionally, add routes to these, but that's not part of Wireguard itself. * systemd-networkd has native support for Wireguard netdevs and networks. It's pretty easy to set up and makes it a lot more flexible; it won't add routes to AllowedIPs like wg-quick but you can define the routes (and routing policies and tables) you want in the same file. [0] As much flak as systemd gets, systemd-networkd has by far been the most sane way for me to manage networking on Linux, and I tried most. I'd also like to take the opportunity to recommend nftables instead of iptables. Unless you already have good reasons to prefer iptables, nftables is so much easier to learn and manage. Oh, and ufw gets ugly real fast. Managing it through ansible or similar is a real mess. firewalld is a lot more predictable IMO. Its routing story is not perfect but it's the best I found so far and can be complemented with ip and manual nftables rules[2]. [0]: https://manpages.debian.org/buster/systemd/systemd.netdev.5.en.html#%5BWIREGUARD%5D_SECTION_OPTIONShttps://man7.org/linux/man-pages/man5/systemd.netdev.5.html#[WIREGUARD]_SECTION_OPTIONS https://manpages.debian.org/buster/systemd/systemd.netdev.5.... [1]: https://wiki.archlinux.org/title/WireGuard#systemd-networkd https://wiki.archlinux.org/title/WireGuard#systemd-networkd [2]: https://serverfault.com/a/1046246 https://serverfault.com/a/1046246
erk__ 5y ago
Freebsd got past the issues by rewriting it, although it is not yet in a stable release will probably wait until 13.1

xxpor 5y ago

Setting up the FW and routing is not trivial for anyone who hasn't had to deal with that aspect of Linux before. 99% of people are going to want a straightforward tunnel that simply forwards everything to the default route table of the server. Which is of course what the linked script does. But even experienced devs are doing to have no idea what the heck a prerouting chain or a masquerade rule does.

3np 5y ago
I've done that journey. At least for me, a major issue turned out to the abstractions (like wg-quick, ufw, network-manager, openwrt) which on one hand obscure the inner workings but at the same time are limited enough that at some point you will be forced to dig deeper. They also don't always play nicely together wrt routes, routing polices and *tables rules. I wasted so much time (probably weeks, added together) in my younger days banging my head against the wall with Linux networking. Throwing out other high-level tools/frameworks and starting "from scratch" on CentOS/Rocky/Debian with only systemd-networkd and nftables has now made me mostly comfortable and I finally feel in control of the networking stack on my Linux boxes. I say "mostly" because, well, Docker and CNI... Oh, and see my sibling comment.
- jamal-kumar 5y ago
  Just use OpenBSD, so much of that crap just gets out of the way because it was never glued on without anyone asking. For routing stuff like VPNs and routers especially this becomes my first choice, unless we're really needing to hit gigabit speeds... Try fresh air for once!

Proven 5y ago

> Can be set up with nothing more than the shell and vi. One can create a full featured OS with the shell and vi.

sandworm101 5y ago

I'm a linux user and I want plenty more than just a VPN connection. I want the icon that tells me the VPN is connected. I want the GUI that lets me manage which server I am connecting to and which servers are the most loaded at a particular moment. I want to control from which country my traffic appears on the public internet. I want the little graph showing me that my traffic is indeed flowing over the VPN service. I want a kill switch daemon ready to cut off my traffic should the VPN connection fail. And I want all of that without having to edit any scripts.

8K832d7tNmiQ 5y ago
Then you should've known that KDE already have wireguard applet implemented in their network manager already in version 5.21 while Gnome is on a track and just waiting to be merged.
- johnchristopher 5y ago
  Does KDE network manager still delete the VPN entry at the end of the setting up process if there is an error in the config ? Anyway, I was just looking how to add a WG VPN entry in kubuntu 18.04 but its version of KDE is a bit behind so CLI it is. I'd settle for an independent KDE widget though.
  - johnchristopher 5y ago
    FFS, they still do and what's worse is that bringing up the VPN manually on the command line trigger a notification and a temporary vpn entry in the network panel. But it disappears when bringing down the VPN.

3np 5y ago

Two things I learned that were game-changers in setting up and managing Wireguard on Linux: * The semantics and behavior of AllowedIPs. In itself, it means what IPs are allowed to be routed through the tunnel (that is, IPs "on the other end"). wg-quick will, additionally, add routes to these, but that's not part of Wireguard itself. * systemd-networkd has native support for Wireguard netdevs and networks. It's pretty easy to set up and makes it a lot more flexible; it won't add routes to AllowedIPs like wg-quick but you can define the routes (and routing policies and tables) you want in the same file. [0] As much flak as systemd gets, systemd-networkd has by far been the most sane way for me to manage networking on Linux, and I tried most. I'd also like to take the opportunity to recommend nftables instead of iptables. Unless you already have good reasons to prefer iptables, nftables is so much easier to learn and manage. Oh, and ufw gets ugly real fast. Managing it through ansible or similar is a real mess. firewalld is a lot more predictable IMO. Its routing story is not perfect but it's the best I found so far and can be complemented with ip and manual nftables rules[2]. [0]: https://manpages.debian.org/buster/systemd/systemd.netdev.5.en.html#%5BWIREGUARD%5D_SECTION_OPTIONShttps://man7.org/linux/man-pages/man5/systemd.netdev.5.html#[WIREGUARD]_SECTION_OPTIONS https://manpages.debian.org/buster/systemd/systemd.netdev.5.... [1]: https://wiki.archlinux.org/title/WireGuard#systemd-networkd https://wiki.archlinux.org/title/WireGuard#systemd-networkd [2]: https://serverfault.com/a/1046246 https://serverfault.com/a/1046246

erk__ 5y ago

Freebsd got past the issues by rewriting it, although it is not yet in a stable release will probably wait until 13.1