diff options
| -rw-r--r-- | content/weblog/2020-06-04_wireguard-vpn/index.md | 123 |
1 files changed, 123 insertions, 0 deletions
diff --git a/content/weblog/2020-06-04_wireguard-vpn/index.md b/content/weblog/2020-06-04_wireguard-vpn/index.md new file mode 100644 index 0000000..5d68389 --- /dev/null +++ b/content/weblog/2020-06-04_wireguard-vpn/index.md @@ -0,0 +1,123 @@ ++++ +title = "Goodbye OpenVPN, hello Wireguard" +date = 2020-06-05T13:00:00Z ++++ + +I have been using OpenVPN for quite some time for my internet privacy purposes. +However, recently I decided to switch to Wireguard. I am going to layout the +reason why I chose to do it, and how I setup the Wireguard VPN for my purposes. +I had been meaning to write about this for some time, unfortunately, I have been +quite busy with finishing my last year of university. + +<!-- more --> + +I had heard about this new VPN thing-y called Wireguard last year and how it is +supposed to be so much better than other VPN technologies such as IPsec and +OpenVPN. It sounded nice to me and all, but it still wasn't considered stable +back then, and I really didn't feel like switching when I had a setup that "just +works™". + +But then, something happened. My then hosting provider decided to cancel their +VPS hosting plans, so I had to migrate everything that I had on my VPS to a new +hosting provider, which included this site and my VPN. Also by this time, the +stable release of Wireguard had been release, and the kernel module added to +upstream. When I was in the process of migrating to my new VPS, I actually +started to setup OpenVPN first, but some things had changed since the last time +I had setup OpenVPN, and I didn't really want to deal with OpenVPN at this +point. That's when I remembered about Wireguard. Good timing, if I do say so +myself. + +I have been using Wireguard for over a month now, and I have to say, I am really +happy with it. It really is better than OpenVPN. The main advantages that +Wireguard has over OpenVPN for me are the following: + +* It is so much easier to setup. No need to mess around with certificates. +* Adding new clients or peers is also much easier are straightforward. +* Latency and speed are slightly better than OpenVPN, especially latency. It + might not be such a big difference, but I no longer feel the need to turn off + my VPN when videoconferencing. +* It brings up the network interface(s) much faster than OpenVPN. +* It consumes less resources. +* I had to disconnect and manually reconnect OpenVPN every time I resumed my + computer from sleep or when I changed networks. With Wireguard, not anymore. + It has a built-in roaming feature, so it doesn't matter if I suspend my + computer, after waking up it "keeps" the connection for me, the same when I, + for example, disconnect from WiFi and connect to ethernet, etc. + +If these advantages haven't convinced you yet, I don't know what will. + +## Set up instructions + +There are something that are worth keeping in mind while setting up Wireguard. +One of them is that unlike other VPN protocols, like OpenVPN, there is no server +and client per se. There are just peers. Of course, that doesn't mean that you +cannot use Wireguard like you would use OpenVPN, quite the contrary. It just +means there is more flexibility and that you need to configure the peer that +you're going to use as a server, such that it tunnels all the internet traffic +it receives from the other peers and reroutes it. + +Before setting up Wireguard, you'll need to install it on each peer. Check out +this link on how to install Wireguard on your system: +[https://www.wireguard.com/install/](https://www.wireguard.com/install/) + +### Server configuration + +Before setting up Wireguard, you might want to setup a firewall such as `ufw`. +After installing Wireguard and setting up your firewall, it's time to create a +new profile for your connection. + +First, as root, change to the `/etc/wireguard/` directory. + +You'll need to create a private key, and from that private key you should get +the public key for your clients. + +Generating a private key is as simple as this: + +```sh +wg genkey +``` + +Then you'll need to create the profile, for that create file wg0.conf with the +following contents: + +``` +[Interface] +Address = 10.0.0.1/24 +Address = fd86:ea04:1115::1/64 +PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE +PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE +ListenPort = 51820 +PrivateKey = <your private key here> +``` + +You should put the private key that you generated before in the wg0.conf file in +the "PrivateKey" field. + +Now is a good time to get the public key. It would be convenient to have it +saved in a file so that you can easily retrieve in the future when you need to +add new peers: + +```sh +echo "<your private key here>" | wg pubkey > wg0.pubkey +``` + +If you already have setup a firewall on your server, don't forget to allow +connections on the port being used by Wireguard. For example, for ufw you would +run the following: + +```sh +ufw allow 5182/udp +``` + +### Client configuration + +The configuration for the client side of things is pretty similar to the server +side of things, since after all, to Wireguard there is no server or client. + +Back on the server, append an entry for your client device to the end of the +wg.conf file: + +``` +[Peer] +PublicKey = <your public key here> +AllowedIPs = 10.0.0.2/32 |