4 ms·

Any good tutorials on setting up Wireguard? This (and Pihole) have been on my todo list for a while.

kd913 5y ago
I should probably write a blog on how to do this. I have a setup guide for myself, but unfortunately it contains a lot of obviously private details that I can't post (ie access to my cloudflare/VPN stuff). A lot of my stuff is ad-hoc from my personal exploration and experience on Linux. In regards to the wireguard specific stuff, this isn't a bad guide. https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguard/ https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar... The harder part with the VPN stuff is the following. 1) Setting up a clear route of forwarding traffic to the pihole. To do so, you would need to setup netplan/systemd-networkd so your pi gets a static private IP. (Not that easy if you are doing a full ipv6 route too.) 2) Setup a DDNS mechanism (as you most likely are getting a dynamic IP). My suggestion for this was to get a domain name (8 quid a year) and use cloudflare as a DDNS host. You also need to punch a UDP port through your router to forward to your pi. 3) Then setup the rest of the wireguard stuff. 4) Setup the pihole and ensure all interfaces are covered so your VPN has a DNS server. Part 2 is the hardest bit as I kind of needed some custom scripting to ensure cloudflare had working routes to my networks. e.g. https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab010a1847 https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab01... The above script obviously running as a systemd service that restarts automatically. Obviously you can use something else like noip or some other DDNS solution.
gen220 5y ago
I did this a few months ago. I’d previously tried a few years ago, and found no good online resources. Now they’re a dime a dozen. The community around WG has gotten much easier for noobs to get into, and the porcelain around the tool itself has made it quite easy to use, IMO.
awoimbee 5y ago
The easiest way is to use some kind of manager on top of wireguard. Tailscale is very good and free for a single user (or with headscale) Otherwise there is innernet, wiretrustee, ...
mongol 5y ago
I like wg-netns. It allows setup of a wireguard tunnel, similar to wg-quick does, in a Linux network namespace. So I can run some processes using the VPN, and others without. By specifying the namespace in a systemd service file, I can let a service use a specific VPN. https://github.com/dadevel/wg-netns https://github.com/dadevel/wg-netns
josteink 5y ago
> Any good tutorials on setting up Wireguard? This (and Pihole) have been on my todo list for a while. Pihole pretty much installs itself (it even has a pre-made image). WireGuard will take reading, testing and failing. I recommend doing these things one thing at a time, and doing the Pihole first.
unethical_ban 5y ago
You can set up a Pi-Hole (DNS sinkhole) and Pi-VPN (Wireguard installer and CLI-frontend for small deployments) very quickly. And you can do it on any debian VM or computer, not just Pi. Once you have the base OS ready to go, it will take you less than 30 minutes if you know how to muck with your DHCP/firewall settings in your router. https://github.com/pi-hole/pi-hole/#one-step-automated-install https://github.com/pi-hole/pi-hole/#one-step-automated-insta... Install Pi-Hole, then edit your DHCP server to hand out the Pi-Hole as the DNS server. https://pivpn.io/ https://pivpn.io/ After installing Pi-hole, install this. Choose Wireguard, not OpenVPN. port-forward the Wireguard UDP port to your VPN server. use the "pivpn" command to create client configs and the "qr" subcommand to scan the config into your phone.
petre 5y ago
The easiest way on the Pi is to install the HomeAssistant plugin, but it's quite easy to set up on a Linux too. Generate two keys, copy paste them in a five line config, same thing on the client. On a phone install the app and scan a QR code that you rsync over to your PC. There's a tutorial on the Wg website.
thedougd 5y ago
If you're a Linux person, just skip all the other non-sense and create a systemd-networkd file. It's by far the simplest solution I've used, and doesn't require goofy unit files to start/stop/restart via wg tool. https://www.freedesktop.org/software/systemd/man/systemd.netdev.html#%5BWireGuard%5D%20Section%20Options https://www.freedesktop.org/software/systemd/man/systemd.net... Then choose your firewall of choice to setup NAT and forwarding. I used firewalld, but not sure I'd recommend it. It's just the first solution I got working.
phamilton 5y ago
I'd recommend just using Tailscale. It's wonderful.
- rasfincher 5y ago
  Tailscale is great. It's really changed my world and it's so dang simple.
newman314 5y ago
I used trailofbits/algo a long time ago for initial setup. Worked well at the time.
andylynch 5y ago
I use pivpn - it’s a pretty straightforward helper for both openvpn and wireguard

I should probably write a blog on how to do this. I have a setup guide for myself, but unfortunately it contains a lot of obviously private details that I can't post (ie access to my cloudflare/VPN stuff). A lot of my stuff is ad-hoc from my personal exploration and experience on Linux. In regards to the wireguard specific stuff, this isn't a bad guide. https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguard/ https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar... The harder part with the VPN stuff is the following. 1) Setting up a clear route of forwarding traffic to the pihole. To do so, you would need to setup netplan/systemd-networkd so your pi gets a static private IP. (Not that easy if you are doing a full ipv6 route too.) 2) Setup a DDNS mechanism (as you most likely are getting a dynamic IP). My suggestion for this was to get a domain name (8 quid a year) and use cloudflare as a DDNS host. You also need to punch a UDP port through your router to forward to your pi. 3) Then setup the rest of the wireguard stuff. 4) Setup the pihole and ensure all interfaces are covered so your VPN has a DNS server. Part 2 is the hardest bit as I kind of needed some custom scripting to ensure cloudflare had working routes to my networks. e.g. https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab010a1847 https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab01... The above script obviously running as a systemd service that restarts automatically. Obviously you can use something else like noip or some other DDNS solution.

gen220 5y ago

I did this a few months ago. I’d previously tried a few years ago, and found no good online resources. Now they’re a dime a dozen. The community around WG has gotten much easier for noobs to get into, and the porcelain around the tool itself has made it quite easy to use, IMO.

awoimbee 5y ago

The easiest way is to use some kind of manager on top of wireguard. Tailscale is very good and free for a single user (or with headscale) Otherwise there is innernet, wiretrustee, ...

mongol 5y ago

I like wg-netns. It allows setup of a wireguard tunnel, similar to wg-quick does, in a Linux network namespace. So I can run some processes using the VPN, and others without. By specifying the namespace in a systemd service file, I can let a service use a specific VPN. https://github.com/dadevel/wg-netns https://github.com/dadevel/wg-netns

josteink 5y ago

> Any good tutorials on setting up Wireguard? This (and Pihole) have been on my todo list for a while. Pihole pretty much installs itself (it even has a pre-made image). WireGuard will take reading, testing and failing. I recommend doing these things one thing at a time, and doing the Pihole first.

unethical_ban 5y ago

You can set up a Pi-Hole (DNS sinkhole) and Pi-VPN (Wireguard installer and CLI-frontend for small deployments) very quickly. And you can do it on any debian VM or computer, not just Pi. Once you have the base OS ready to go, it will take you less than 30 minutes if you know how to muck with your DHCP/firewall settings in your router. https://github.com/pi-hole/pi-hole/#one-step-automated-install https://github.com/pi-hole/pi-hole/#one-step-automated-insta... Install Pi-Hole, then edit your DHCP server to hand out the Pi-Hole as the DNS server. https://pivpn.io/ https://pivpn.io/ After installing Pi-hole, install this. Choose Wireguard, not OpenVPN. port-forward the Wireguard UDP port to your VPN server. use the "pivpn" command to create client configs and the "qr" subcommand to scan the config into your phone.

petre 5y ago

The easiest way on the Pi is to install the HomeAssistant plugin, but it's quite easy to set up on a Linux too. Generate two keys, copy paste them in a five line config, same thing on the client. On a phone install the app and scan a QR code that you rsync over to your PC. There's a tutorial on the Wg website.

thedougd 5y ago

If you're a Linux person, just skip all the other non-sense and create a systemd-networkd file. It's by far the simplest solution I've used, and doesn't require goofy unit files to start/stop/restart via wg tool. https://www.freedesktop.org/software/systemd/man/systemd.netdev.html#%5BWireGuard%5D%20Section%20Options https://www.freedesktop.org/software/systemd/man/systemd.net... Then choose your firewall of choice to setup NAT and forwarding. I used firewalld, but not sure I'd recommend it. It's just the first solution I got working.

phamilton 5y ago

I'd recommend just using Tailscale. It's wonderful.

rasfincher 5y ago
Tailscale is great. It's really changed my world and it's so dang simple.

newman314 5y ago

I used trailofbits/algo a long time ago for initial setup. Worked well at the time.

andylynch 5y ago

I use pivpn - it’s a pretty straightforward helper for both openvpn and wireguard