I just finished setting up my Wireguard VPN “server”. In this post I want to spread some information, I could’ve found useful but which didn’t come up in most of the Wireguard tutorials.
If you aren’t interested in VPN or self hosting, this post is not for you. If you haven’t gotten around yet to try it out, I can only recommend doing it. Feels great being able to “phone home” from all over the world.
Alright, tricks and tips:
tcpdump
Wireguard will definitely not work first try. As Wireguard is a silent protocol, you won’t see too many error messages. Dropped packets are how you know that something’s off. tcpdump is a great command line tool, that, despite it’s name, can also dump the precious UDP Wireguard packets. The tool will make you see how far your wireguard connection gets before the packets are dropped. Great for running on “server” and on clients.
ping
A classic tool. Helped me debugging some issues with DNS and Maximum Transfer Unit (MTU) size.
AllowedIPs
In a classic server-client situation, your clients should have AllowedIPs set to 0.0.0.0/0, ::/0 in their repecive configuration file. I found this pretty counterintuitive, but that seemingly is how it works.
IP Forwarding in sysctl
This one was by far the nastiest one to find out. Mainly because I’m not a linux or Debian expert. You need to tell sysctl to forward IP traffic, which ususally tutorials around the web will tell you to do like this: sysctl -w net.ipv4.ip_forward=1; sysctl -w net.ipv6.conf.all.forwarding=1. What I foolishly assumed, that this write operation was permanent. It’s not. You need to edit /etc/sysctl.conf for making it permanent. Else, after a reboot you won’t be able to connect to the internet. This took me a good amount of reconfigurations from scratch before I eventually found out these vars will reset on boot.
–
Maybe this helps some of you fellow Lemmings. If I stumble across further tips and tricks, I might update this post in the future. For now though, I think I’m done with my setup (philosophical question: are you ever done with setting up things?).
And… why not? OpenVPN is 10 times worse because of the mess they’ve made with
push routeand other options.Why would you? Those are the IPs that the client is able to access through the VPN tunnel and
0.0.0.0/0, ::/0means all IP addresses, totally NOT counterintuitive.Yes, maybe… but not permanently at least. You can setup it on the server
conffile viaPostUpandPostDown:[Interface] PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADEIf required prepend
sysctl -w net.ipv4.ip_forward=1; sysctl -w net.ipv6.conf.all.forwarding=1;toPostUpand remove with=0onPostDown.The downside of you described is that you’re enabling IP Forwarding permanently and even if the WG tunnel is down. This may pose a few security concern in some situations.
Classic tech holy wars rhetoric: “someone dared speak ill of the One True Software, time to talk smack about the competition”
Sometime people have problems when they’re learning new software, sometimes people prefer software solutions that aren’t what you picked. Live and let live.
Not the case at all. I use both and I can objectively tell your that Wireguard is what the majority of people should be using because it is way easier to understand and setup securely. OVPN is good for other specific cases.
Interesting ! Didn’t knew you could add
sysctlcommands as Postup/Postdown. !!Thank you :) !!