Wireguard

Server Konfigurationsdatei für OpenWRT

/etc/config/network

config interface 'wg0'
	option proto 'wireguard'
	option listen_port '51820'
	list addresses '${SERVER_IP}/24'
	option private_key '${SERVER_PRIVATE_KEY}'

config wireguard_wg0
	option public_key '${CLIENT_PUBLIC_KEY}'
	option route_allowed_ips '1'
	list allowed_ips '${CLIENT1_IP}/32'
	option description 'Client1'

config wireguard_wg0
	option public_key '${CLIENT_PUBLIC_KEY}'
	option route_allowed_ips '1'
	list allowed_ips '${CLIENT2_IP}/32'
	option description 'Client 2'

/etc/config/firewall

 ... other rules ...
config rule
	option name 'allow-wireguard-inbound'
	option src '*'
	option proto 'udp'
	option dest_port '51820'
	option target 'ACCEPT'

config zone
	option name 'wg'
	option input 'ACCEPT'
	option forward 'ACCEPT'
	option output 'ACCEPT'
	option masq '1'
	option network 'wg0'

config forwarding
	option src 'wg'
	option dest 'wan'

config forwarding
	option src 'wg'
	option dest 'lan'

config forwarding
	option src 'lan'
	option dest 'wg'

config forwarding
	option src 'wan'
	option dest 'wg'

Client Konfigurationsdatei

/etc/wireguard/wg0.conf

[Interface]
# private-key of client
PrivateKey = ${CLIENT_PRIVATE_KEY}
Address = ${CLIENT_IP}/32
# use e.g. wireguard server vpn ip as dns server
DNS = ${DNS_SERVER_IP}

[Peer]
PublicKey = ${SERVER_PUBLIC_KEY}
# preshared key is optional but recommended
PresharedKey =
Endpoint = mein-vpn.server.org:51820
AllowedIPs = 0.0.0.0/0
# This is for if you're behind a NAT and want the connection to be kept alive.
PersistentKeepalive = 25

VPN auf dem Client starten

root@client:~# wg-quick up wg0

Interface "von Hand" konfigurieren

Das Problem mit "wg setconf wg0 /etc/wiregiard/wg0.conf", dass wg die Optionen welche für wg-quick gedacht sind nicht versteht.

root@server:~# ip link add dev wg0 type wireguard root@server:~# ip address add dev wg0 10.101.101.1/24 root@server:~# wg setconf wg0 /etc/wireguard/wg0.conf