Jump to content

Wireguard: Difference between revisions

From postmarketOS Wiki
Iourine (talk | contribs)
Iourine (talk | contribs)
Outdated info removed
 
(6 intermediate revisions by 3 users not shown)
Line 1: Line 1:
=Overview=
== Overview ==
Wireguard is modern, low-latency VPN, available in upstream Alpine repo. Not only it is fast and secure, but also very simple and straightforward in configuration. Among all VPN techlologies, it is the easiest (from user's viewpoint) and the least wayward one.
Wireguard is modern, low-latency VPN, available in upstream Alpine repo. Not only it is fast and secure, but also very simple and straightforward in configuration. Among all VPN techlologies, it is the simplest (from user's viewpoint) and the least wayward one.


==Wireguard tunnel==
=== Setup and usage ===
To enable wireguard tunneling, your kernel must be compiled with its support - which results in <code>wireguard.ko</code> driver module somewhere (depending on kernel version) in <code>/lib/modules/''kernel-version''/kernel</code>. Strange enough,  wireguard support is disabled in default Alpine kernel - and thus in pmOS, too. You need to rebuild the kernel with the following settings:
As of pmOS 23.06, the default kernel is already built with Wireguard support. To use Wireguard tunnels, you only need to install the <code>wireguard-tools-wg-quick</code> package. There is no separate <code>wireguard</code> package in Alpine and pmOS. There are other Wireguard tools to be considered as well.
<pre>
CONFIG_WIREGUARD=m
CONFIG_CRYPTO_ECDSA=m
</pre>
or, in terms of <code>menuconfig</code> tree,
<pre>
Device Drivers  --->
    [*] Network device support  --->
        [*] Network core driver support
        <M>  WireGuard secure network tunnel


_*_ Cryptographic API  --->
Standard location for configuration of Wireguard tunnels is <code>/etc/wireguard/''interface''.conf</code>. The directory should be readable for root only (<code>chmod 700</code>, and <code>chmod 600</code> for files in it) as it contains private keys of the host. Once <code>wg-quick</code> is installed, tunnels may be started/stopped as follows:
    <M> ECDSA (NIST P192, P256 etc.) algorithm
</pre>
While running pmOS, you can check the details by running below command in terminal
<pre>
modinfo wireguard
</pre>
It prints module details like filename, author, etc.
If it prints something like:
<pre>
modinfo: module '/lib/modules/${uname -r}/wireguard' not found
</pre>
the kernel must be rebuilt, see below.
 
==wg-quick and nftables==
<code>wg-quick</code> is a popular script that does a lot of routine work to set up the IP stack on top of the newly created Wireguard intreface: IP address, routing, DNS, and firewall settings. For the latter task, it relies heavily onto <code>nftables</code>, which, it turn, also requires kernel support as follows:
<pre>
CONFIG_NFT_FIB_IPV4=m
CONFIG_NFT_FIB_IPV6=m
CONFIG_NFT_FIB_INET=m
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NFT_FIB_NETDEV=m
</pre>
or, in <code>menuconfig</code>:
<pre>
<pre>
Networking support  --->
$ sudo wg-quick up INTERFACE
    Networking options  --->
$ sudo wg-quick down INTERFACE
    [*] Network packet filtering framework (Netfilter)  --->
            IP: Netfilter Configuration  --->
                _*_ IPv4 nf_tables support
                <M> nf_tables fib / ip route lookup support
            IPv6: Netfilter Configuration  --->
                _*_ IPv6 nf_tables support
                <M> nf_tables fib / ip route lookup support
            Core Netfilter Configuration  --->
                <M> Netfilter nf_tables support
                [*]  Netfilter nf_tables netdev tables support
                <M>  Netfilter nf_tables fib inet support
                <M>  Netfilter nf_tables netdev fib lookups support
</pre>
</pre>
Note that some of these settings depend upon the previous ones. These settings are present in default Alpine kernel configurations but not in pmOS ones.
{{Note| To consider including the the above settings, as well as other <code>nftables</code> modules, into default kernels, address your merge requests to Alpine and pmOS maintainers, respectively.}}
=Installation=
==Recompiling kernel==
To add the above settings to the kernel yourself:
1. Remove the existing chroot and packages
<blockquote><pre>pmbootstrap -y zap -p</pre></blockquote>
2. Configure the kernel
<blockquote><pre>pmbootstrap kconfig edit YOUR-KERNEL-PACKAGE</pre></blockquote>
This invokes menu tool for kernel configuration and packs the new configuration file back into the package. Set the abovementioned options. See [https://wiki.postmarketos.org/wiki/Kernel_configuration Kernel configuration] for package naming and other details.
3. Rebuild the kernel for your particular installation
<blockquote><pre>pmbootstrap build --force YOUR-KERNEL-PACKAGE</pre></blockquote>
4. Build and install pmOS in your usual way
<blockquote><pre>pmbootstrap install ...</pre></blockquote>
==Setup and usage==
To use Wireguard tunnels, you need  <code>wireguard-tools-wg-quick</code> package. It may be added manually after installation, or included in your basic software suite at <code>pmbootstrap&nbsp;init</code> step. There is no separate <code>wireguard</code> package in Alpine and pmOS. There are other Wireguard tools to be considered as well.
Standard location for configuration of Wireguard tunnels is <code>/etc/wireguard/''interface''.conf</code>. The directory should be readable for root only (<code>chmod 700</code>, and <code>chmod 600</code> for files in it) as it contains private keys of the host. Once <code>wg-quick</code> is installed, tunnels may be started/stopped as follows:
<blockquote><pre>sudo wg-quick up INTERFACE
sudo wg-quick down INTERFACE</pre></blockquote>
with INTERFACE being a name of one of the <code>.conf</code> files.
with INTERFACE being a name of one of the <code>.conf</code> files.


=Graphical User Interfaces=
== Integration with other applications ==
=== GUI applications ===
As of now, there is no dedicated GUI application for Wireguard management in Linux. (Unlike the other OSes.) Use terminal instead. Probably someone will write it one day, or adopt the existing Android/IOS app for pmOS phones (apart from desktops/notebooks). In some desktop environments, there are (or may appear in the future) Wireguard plugins for their regular network management tools.
As of now, there is no dedicated GUI application for Wireguard management in Linux. (Unlike the other OSes.) Use terminal instead. Probably someone will write it one day, or adopt the existing Android/IOS app for pmOS phones (apart from desktops/notebooks). In some desktop environments, there are (or may appear in the future) Wireguard plugins for their regular network management tools.


==NetworkManger integration==
=== NetworkManger integration ===
In mobian [https://blogs.gnome.org/thaller/2019/03/15/wireguard-in-networkmanager/ there is easy way] to manage Wireguard with automatically filled pre and post hooks.
In mobian [https://blogs.gnome.org/thaller/2019/03/15/wireguard-in-networkmanager/ there is easy way] to manage Wireguard with automatically filled pre and post hooks.
<pre>
<pre>
nmcli connection import type Wireguard file /path/to/wg.conf
$ nmcli connection import type Wireguard file /path/to/wg.conf
</pre>
</pre>
However, because of (probably) some lack in packaging, pre and post hooks interfaces are not set properly. So you are connected to your rely but DNS doesn't work.
However, because of (probably) some lack in packaging, pre and post hooks interfaces are not set properly. So you are connected to your rely but DNS doesn't work.
In other cases, Wireguard support may vary depending upon distribution, its particular NM version and plugin availabilty for it.


==DNS dependency==
=== DNS dependence ===
In certain use cases, you may need to use a particular DNS server at the other side of the tunnel instead the default one. To that purpose, there is the <code>DNS=</code> setting in config file for <code>wg-quick</code>. (But not for <code>wireguard</code> itself !)
In certain use cases, you may need to use a particular DNS server at the other side of the tunnel instead the default one. To that purpose, there is the <code>DNS=</code> setting in config file for <code>wg-quick</code>. (But not for <code>wireguard</code> itself !)


Line 102: Line 32:


In other distributions and setups (including Network Manager as described above?) you may need to install this dependence manually.
In other distributions and setups (including Network Manager as described above?) you may need to install this dependence manually.
[[Category:Guide]]

Latest revision as of 14:20, 9 June 2023

Overview

Wireguard is modern, low-latency VPN, available in upstream Alpine repo. Not only it is fast and secure, but also very simple and straightforward in configuration. Among all VPN techlologies, it is the simplest (from user's viewpoint) and the least wayward one.

Setup and usage

As of pmOS 23.06, the default kernel is already built with Wireguard support. To use Wireguard tunnels, you only need to install the wireguard-tools-wg-quick package. There is no separate wireguard package in Alpine and pmOS. There are other Wireguard tools to be considered as well.

Standard location for configuration of Wireguard tunnels is /etc/wireguard/interface.conf. The directory should be readable for root only (chmod 700, and chmod 600 for files in it) as it contains private keys of the host. Once wg-quick is installed, tunnels may be started/stopped as follows:

$ sudo wg-quick up INTERFACE
$ sudo wg-quick down INTERFACE

with INTERFACE being a name of one of the .conf files.

Integration with other applications

GUI applications

As of now, there is no dedicated GUI application for Wireguard management in Linux. (Unlike the other OSes.) Use terminal instead. Probably someone will write it one day, or adopt the existing Android/IOS app for pmOS phones (apart from desktops/notebooks). In some desktop environments, there are (or may appear in the future) Wireguard plugins for their regular network management tools.

NetworkManger integration

In mobian there is easy way to manage Wireguard with automatically filled pre and post hooks.

$ nmcli connection import type Wireguard file /path/to/wg.conf

However, because of (probably) some lack in packaging, pre and post hooks interfaces are not set properly. So you are connected to your rely but DNS doesn't work. In other cases, Wireguard support may vary depending upon distribution, its particular NM version and plugin availabilty for it.

DNS dependence

In certain use cases, you may need to use a particular DNS server at the other side of the tunnel instead the default one. To that purpose, there is the DNS= setting in config file for wg-quick. (But not for wireguard itself !)

To perform the task, wg-quick and probably other tools running on top of Wireguard itself need addtitional tools to set up DNS for wireguard interface. In most distributions and packages, openresolv|resolvconf are listed as recommended - but not mandatory - dependencies.

In Alpine and pmOS, wireguard-tools-wg-quick does install openresolv unconditionally, thus DNS setting works out of the box.

In other distributions and setups (including Network Manager as described above?) you may need to install this dependence manually.