5 ms·

I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not

I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked. Installed OpenVPN instead, took me 2 minutes and worked immediately with far fewer config files changes. I've had this experience before with Wireguard as well. People keep saying how easy it is and in my experience... it simply isn't. OpenVPN has a lot of BS overhead and I'd be more than pleased to move off of it. But WG hasn't been simple for a common use case - install on Ubuntu VPS, client on Windows.

j3th9n 5y ago
This was possibly all you needed to do: echo 1 > /proc/sys/net/ipv4/ip_forward
- icelancer 5y ago
  cat /proc/sys/net/ipv4/ip_forward shows '1', I set it via sysctl -w net.ipv4.ip_forward=1 in the past I think based on instructions.
  - j3th9n 5y ago
    Then maybe you need to add the following to the [Interface] section of your wg0.conf on your server or else I don't know ;-) : PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
    - icelancer 5y ago
      Already reads as such, though I've tried that code snippet too: PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; iptables -A FORWARD -o %i -j ACCEPT PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; iptables -D FORWARD -o %i -j ACCEPT Like I said, everyone keeps saying Wireguard is dead simple to set up, but the comments are full of editing configuration files, priv/pub key pairs, etc. I've helped administer OpenVPN servers for a decade now (and take no pride in it), and yet all these errors that keep coming up in Wireguard configuration for me on a main Linux distro + Windows 10 client seem pretty odd for something that's supposedly so easy to use. Someone just come out with a wizard/package installer that actually works reasonably well (like OpenVPN has already) and then it might be "easy" to install. For OpenVPN I run an apt install command, run a wizard, SFTP into the box, transfer out the .ovpn file, import it into whatever client devices I need, and it works. Wireguard is at least 10 times tougher than that, even if it worked, which it currently does not.
      - j3th9n 5y ago
        Well, hit me up if you want a VPS installed with WireGuard with maybe some nice web interface like https://github.com/EmbarkStudios/wg-ui https://github.com/EmbarkStudios/wg-ui
  - ciupicri 5y ago
    There is also a per interface setting, e.g. net.ipv4.conf.virbr0.forwarding
    - icelancer 5y ago
      apt purge'd it, reinstalled and updated my Windows client, now getting this entry in the Wireguard log: 2021-10-11 15:18:30.313: [MGR] Failed to connect to adapter interface \\?\SWD#WireGuard[REDACTED]: The system cannot find the file specified. (Code 0x00000002) So, again, I'd like to use it but... dead simple it ain't. Googling that error shows 5 month old reddit posts and not much else. https://www.reddit.com/r/WireGuard/comments/n6yocf/unable_to_create_wintun_on_windows_7_laptop_with/ https://www.reddit.com/r/WireGuard/comments/n6yocf/unable_to...
      - therein 5y ago
        Silly I know but do you have the wireguard module loaded?
rndgermandude 5y ago
To give a counterpoint. I have both OpenVPN and wireguard set up, running my own server/"server" peer... First OpenVPN because that's what I used before wireguard was around (and now keep as a fallback that I never use). OpenVPN required a lot more fiddling e.g. to get a ca+client certs for auth set up, find a config that works for each OS where I have clients, etc. And then again some more work because client certs expired, and again more work because the distro changed some things and required a different config suddenly (not really OpenVPN's fault) wireguard just worked for me, except I first forgot to enable port forwarding / the NAT stuff on the interface on the "server" peer so that I could route all traffic through it (other people already remarked about that), not just have a point-to-point to it. The point-to-point stuff worked immediately tho without having to sprinkle any magic pixie dust on top first. Setting up a "server" is always more intricate be it OpenVPN be it wireguard, tho. But once I had two peers in my wireguard setup up and running (the "server" and the first client) adding more clients was a breeze compared to doing the same in OpenVPN. All in all, it was like 10 mins of fiddling in some testing VMs and a bit of googling, and then a couple of more minutes to apply what iIlearned and set up the real "prod".
na85 5y ago
>I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked. I ran into this also. The docs are quite bad, in the sense that they assume a lot on the part of the reader and only cover a fairly simple use case.
- wg-throw-away 5y ago
  I have a script to automate the pain away with creating throw away VM instances based on Ubuntu/Debian. Almost every fail is not allowing the correct ingress port into the VM (51820 in my case) https://pastebin.com/09iE1sME https://pastebin.com/09iE1sME

j3th9n 5y ago

This was possibly all you needed to do: echo 1 > /proc/sys/net/ipv4/ip_forward

icelancer 5y ago
cat /proc/sys/net/ipv4/ip_forward shows '1', I set it via sysctl -w net.ipv4.ip_forward=1 in the past I think based on instructions.
- j3th9n 5y ago
  Then maybe you need to add the following to the [Interface] section of your wg0.conf on your server or else I don't know ;-) : PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
  - icelancer 5y ago
    Already reads as such, though I've tried that code snippet too: PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; iptables -A FORWARD -o %i -j ACCEPT PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; iptables -D FORWARD -o %i -j ACCEPT Like I said, everyone keeps saying Wireguard is dead simple to set up, but the comments are full of editing configuration files, priv/pub key pairs, etc. I've helped administer OpenVPN servers for a decade now (and take no pride in it), and yet all these errors that keep coming up in Wireguard configuration for me on a main Linux distro + Windows 10 client seem pretty odd for something that's supposedly so easy to use. Someone just come out with a wizard/package installer that actually works reasonably well (like OpenVPN has already) and then it might be "easy" to install. For OpenVPN I run an apt install command, run a wizard, SFTP into the box, transfer out the .ovpn file, import it into whatever client devices I need, and it works. Wireguard is at least 10 times tougher than that, even if it worked, which it currently does not.
    - j3th9n 5y ago
      Well, hit me up if you want a VPS installed with WireGuard with maybe some nice web interface like https://github.com/EmbarkStudios/wg-ui https://github.com/EmbarkStudios/wg-ui
- ciupicri 5y ago
  There is also a per interface setting, e.g. net.ipv4.conf.virbr0.forwarding
  - icelancer 5y ago
    apt purge'd it, reinstalled and updated my Windows client, now getting this entry in the Wireguard log: 2021-10-11 15:18:30.313: [MGR] Failed to connect to adapter interface \\?\SWD#WireGuard[REDACTED]: The system cannot find the file specified. (Code 0x00000002) So, again, I'd like to use it but... dead simple it ain't. Googling that error shows 5 month old reddit posts and not much else. https://www.reddit.com/r/WireGuard/comments/n6yocf/unable_to_create_wintun_on_windows_7_laptop_with/ https://www.reddit.com/r/WireGuard/comments/n6yocf/unable_to...
    - therein 5y ago
      Silly I know but do you have the wireguard module loaded?

rndgermandude 5y ago

To give a counterpoint. I have both OpenVPN and wireguard set up, running my own server/"server" peer... First OpenVPN because that's what I used before wireguard was around (and now keep as a fallback that I never use). OpenVPN required a lot more fiddling e.g. to get a ca+client certs for auth set up, find a config that works for each OS where I have clients, etc. And then again some more work because client certs expired, and again more work because the distro changed some things and required a different config suddenly (not really OpenVPN's fault) wireguard just worked for me, except I first forgot to enable port forwarding / the NAT stuff on the interface on the "server" peer so that I could route all traffic through it (other people already remarked about that), not just have a point-to-point to it. The point-to-point stuff worked immediately tho without having to sprinkle any magic pixie dust on top first. Setting up a "server" is always more intricate be it OpenVPN be it wireguard, tho. But once I had two peers in my wireguard setup up and running (the "server" and the first client) adding more clients was a breeze compared to doing the same in OpenVPN. All in all, it was like 10 mins of fiddling in some testing VMs and a bit of googling, and then a couple of more minutes to apply what iIlearned and set up the real "prod".

na85 5y ago

>I tried setting it up on a VPS on Ubuntu the other day, got it installed after doing some config files, connected to the tunnel, could access the server but not the wider Internet. Made about 4-5 config changes per a bunch of Stackoverflow posts then gave up since nothing worked. I ran into this also. The docs are quite bad, in the sense that they assume a lot on the part of the reader and only cover a fairly simple use case.

wg-throw-away 5y ago
I have a script to automate the pain away with creating throw away VM instances based on Ubuntu/Debian. Almost every fail is not allowing the correct ingress port into the VM (51820 in my case) https://pastebin.com/09iE1sME https://pastebin.com/09iE1sME