Wireguard client set up

This is part of the Repeater linking project I am working on.

Scenario. You have a Raspberry Pi set up with the latest version of the Pi OS installed. You can log in via console. You want to set up remote access via tarra.link.

I ended up writing a script that generated key pairs, and put them in /etc/wireguard/KEYS/. Then I wrote another that takes those files and generates a set of wg0.conf files, one for each client site.

The rest of this page is pretty much notes from before I wrote those but most of it is still useful I think.

Preliminary set up

You should have the ssh server installed and enabled. You can do that in raspi-config under "Interfaces", "SSH". You can change the name of the client in there too, under "System", "Hostname".

The client has to be able to connect to the Internet but it can be on either a static or DHCP dynamic link, it won't matter. Once everything is set up, you will be able to use the Wireguard tunnel connection to get from the Internet to the client even if the DHCP address changes.

CHANGE THE PASSWORD ON THE CLIENT BEFORE EXPOSING IT TO THE INTERNET. Use raspi-config or from the command line, use the 'passwd' command.

Install Wireguard

Working on the client,

sudo apt-get install wireguard -y

Some comments. You don't have to enable packet forwarding, because this is a client node and won't be doing any packet forwarding. You don't have to set up a firewall, that will be handled on tarra. We might decide to set up a firewall later but for now it's just extra complexity. It would not hurt to install iptables and fail2ban just so its there for later.

sudo apt-get install fail2ban

Generate a pair of keys

The keys will be called "privatekey" and "publickey", in the folder /etc/wireguard. First make sure the folder is secured (the chmod command).

Still on the client,

sudo -s
chmod 700 /etc/wireguard
cd /etc/wireguard/
wg genkey | tee privatekey | wg pubkey > publickey

Copy the public key to the server. An easy way is to dump it to the screen and then cut and paste.

cat publickey

On the server now you could paste it, using the name of the subnet, in this example that would be "rendezvous". This will create a file containing the key called rendezvous.pub in /etc/wireguard/

sudo -s
echo PASTE_THE_PUBLICKEY_STRING_RIGHT_HERE > /etc/wireguard/rendezvous.pub

(Or use nano or whatever editor you want on Linux.)

Set up the client's config file.

The port number does not matter on this end, there is no firewall between us and tarra. The client has to know tarra's port and the first time it connects to tarra it will tell tarra its port number.

sudo -s
cd /etc/wireguard
nano wg0.conf

You can 'cat' the private key and copy it so that you can paste it into the wg0.conf file.

cat privatekey

Next use nano to make the file look like this, changing it as needed for your client. I read somewhere that 25 seconds is a good value to use for the keepalive. Over a cellular link (data rates apply) a longer interval might be better?? Some research advised before changing it.

[Interface]
# Desired address at this end, the Raspberry Pi
Address = 44.127.9.10/29
# Paste the private key generated in the previous step here.
PrivateKey = ed4S0jLwfBizpnly40wqFaoAjsk/D7oYwblUZNBd8WE= CHANGE THIS TO YOUR PRIVATE KEY

[Peer]
Endpoint = 45.76.244.170:51820
# All TARRA AMPR addresses (44.127.9.x)should be sent to tarra at vultr.
# All Internet traffic should be routed over the tunnel (0.0.0.0/0)
# If you leave off the 0.0.0.0/0 you have a "split tunnel"
AllowedIPs = 44.127.9.0/24, 0.0.0.0/0
PublicKey = KnD5dfwSMAoUGXySxZtxuvfKMIBf+YKc+hiJifGQWwc=
PersistentKeepalive = 25

Leaving out the 0.0.0.0/0 part of AllowedIPs is a split tunnel configuration. The "split tunnel" config sends traffic for the AMPR net over the tunnel and lets everything else go out to the Internet without using the tunnel. Faster but less secure.

Bring up the connection

For each subnet currently defined, there is a script on Tarra, run it. For rendezvous,

cd /etc/wireguard
./wg-rendezvous.sh up

You can make a new script if you need to. Copy TEMPLATE.sh and be sure to add the script to wg-all.sh to bring it online after a reboot. But there should already be one there...

From tarra, ping the new node

ping ren-1.tarra.link

On the node, you should be able to hit the main address at the router, tarra.link

From your laptop or anywhere on the Internet you should be able to ping the node now,

ping ren-1.tarra.link

You should be able to log into the node over the Internet. You did change the password? Great. Otherwise someone will figure out this is a Raspberry Pi and log in and take control of it in about 5 minutes. I am not exaggerating.

ssh [email protected]

Make wireguard run after reboot (on the client)

(Here are docs)

sudo -s
systemctl enable [email protected]
systemctl daemon-reload
systemctl start wg-quick@wg0

Reboot now to make sure it took. Once you reboot, do this again.

wg show

You should see the link still exists and that there is a connection. Run the tests from the previous section again to satisfy yourself that it rebooted correctly.

This is how the Mango link looks

root@TARRA:/etc/wireguard# wg show
interface: wg0
 public key: KnD5dfwSMAoUGXySxZtxuvfKMIBf+YKc+hiJifGQWwc=
 private key: (hidden)
 listening port: 51820

peer: nzbpyIxFtj/MuJp3LBsQTvGVvWqOvDOIAbw1SfK3NU4=
 endpoint: 166.176.59.192:29748
 allowed ips: 10.0.0.0/24
 latest handshake: 39 seconds ago
 transfer: 9.51 MiB received, 9.06 MiB sent

root@TARRA:/etc/wireguard# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  anywhere             45.76.244.170.vultrusercontent.com  tcp dpt:22222 to:10.0.0.10
DNAT       udp  --  anywhere             45.76.244.170.vultrusercontent.com  udp dpts:2074:2093 to:10.0.0.10
DNAT       tcp  --  anywhere             45.76.244.170.vultrusercontent.com  tcp dpts:15425:15427 to:10.0.0.10
DNAT       tcp  --  anywhere             45.76.244.170.vultrusercontent.com  tcp dpt:12300 to:10.0.0.10
DNAT       udp  --  anywhere             45.76.244.170.vultrusercontent.com  udp dpts:2074:2093 to:10.0.0.10
DNAT       tcp  --  anywhere             45.76.244.170.vultrusercontent.com  tcp dpts:15425:15427 to:10.0.0.10
DNAT       udp  --  anywhere             45.76.244.170.vultrusercontent.com  udp dpts:2074:2093 to:10.0.0.10
DNAT       udp  --  anywhere             45.76.244.170.vultrusercontent.com  udp dpts:5198:5199 to:10.0.0.10

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere