Wireguard config guide?


#1

Hello there,

I use a ubuntu server to create a wireguard VPN on my system. Now i thinking that would be great, that i able to do the same With my vyos system. (network do network :slight_smile: )

Here is my wireguard (ubuntu) config:

[Interface]
Address = 192.168.32.1/16
SaveConfig = false
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens18 -j MASQUERADE
ListenPort = 123
PrivateKey = ***

[Peer]
PublicKey = ***
AllowedIPs = 192.168.32.0/24
Endpoint = ***

[Peer]
PublicKey = ***
AllowedIPs = 192.168.33.0/24
Endpoint = ***

[Peer]
PublicKey = ***
AllowedIPs = 192.168.34.0/24

my Ubuntu server IP address is 192.168.31.105 the Vyos IP address is 192.168.31.1

I able to create a Wireguard connection with vyos and i able to connect it, but i can not ping to the wg0 interface ip (like 192.168.33.1) with client and i can not ping client with wireguard.

What is the problem?

I use this config:

   set interfaces wireguard wg0 address '192.168.33.1/32'
   set interfaces wireguard wg0 port '123'
   set interfaces wireguard wg0 peer CLIENT1 allowed-ips '192.168.33.0/24'
   set interfaces wireguard wg0 peer CLIENT1 persistent-keepalive 15
   set interfaces wireguard wg0 peer CLIENT1 pubkey '<pubkey client1>'
   set protocols static interface-route '192.168.31.0/24' next-hop-interface wg0

#2

your port udp/123 is already in use by ntp?


#3

No, it working on this settings with Ubuntu.


#4

Hi Vamp!

As @hagbard say, 123 is a reserved port for ntp, and I would have avoided using ports under 1024 as they are almost all treated specially by the kernel in terms of permissions to use and are almost all reserved by protocols already.

I also see that the interface address on your ubuntu device is set to 192.168.32.1/16, that means you have created an ip subnet reaching from 192.168.0.0 to 192.168.255.255 as directly connected to the wireguard interface… on the vyos side you’ve set 192.168.33.1/32 as address, this means that the vyos device only thinks there are ONE host inside the subnet… and that is himself… that means that if you are standing on the vyos device it is not able to reach the ip of the ubuntu device because he don’t know that there are other devices on the link.

as for the configuration… my sugestions are:

  • change to a port over 1024
  • on the ubuntu device change "Address = " to a free 192.168.x.y/24
  • change all your other devices to an address within 192.168.x with /24 netmask
  • i you on your clients need to reach other clients, add their ipnetts as a static route pointing to the wg0 interface

#5

https://vyos.readthedocs.io/en/latest/network-interfaces.html#wireguard-vpn-interface


#6

If i able to set Vyos correctly i dont want to use wireguard on ubuntu. So i vould like to set the same config that now exist in Ubuntu server.

The 123 port is working on Ubuntu server. (the reason that i use it, that is not blocked the firewalls)

What is this situation this lines? (it needed on ubuntu, that i able to reach my other subnet, like 192.168.31.0/24)

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens18 -j MASQUERADE

I try to use 12345 port, but same think happened, it able to connect to vyos, but can not ping the cilent and vice versa…


#7

udp/123 is being used on vyos per default.

udp 0 0 10.1.1.85:123 0.0.0.0:* 1525/ntpd
udp 0 0 10.0.2.15:123 0.0.0.0:* 1525/ntpd
udp 0 0 127.0.0.1:123 0.0.0.0:* 1525/ntpd
udp 0 0 0.0.0.0:123 0.0.0.0:* 1525/ntpd
udp6 0 0 ::1:123 :::* 1525/ntpd
udp6 0 0 fe80::a00:27ff:fe5f:123 :::* 1525/ntpd
udp6 0 0 fe80::a00:27ff:fe37:123 :::* 1525/ntpd
udp6 0 0 :::123 :::* 1525/ntpd

Your ubuntu config is wrong as runar pointed out in terms of subnets.


#8

So the ubuntu box would then hang behind the vyos box?

Join vyos.slack.com and we sort it out from there.


#9

OK, please invite me.

I create a little draw (it is a fast work :slight_smile: )


closed #10

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.