Jump to content

Wireguard: Difference between revisions

From postmarketOS Wiki
Iourine (talk | contribs)
Detailed how-to use wg in pmOS
Iourine (talk | contribs)
m Recompiling kernel: minor presentation change
Line 67: Line 67:


2. Configure the kernel
2. Configure the kernel
<blockquote><pre>pmbootstrap kconfig edit ''your-kernel-package''</pre></blockquote>
<blockquote><pre>pmbootstrap kconfig edit YOUR-KERNEL-PACKAGE</pre></blockquote>
This invokes menu tool for kernel konfiguration and packs the new configuration file back into the package. Set the abovementioned options. See [https://wiki.postmarketos.org/wiki/Kernel_configuration Kernel configuration] for package naming and other details.
This invokes menu tool for kernel konfiguration and packs the new configuration file back into the package. Set the abovementioned options. See [https://wiki.postmarketos.org/wiki/Kernel_configuration Kernel configuration] for package naming and other details.


3. Rebuild the kernel for your particular installation
3. Rebuild the kernel for your particular installation
<blockquote><pre>pmbootstrap build --force ''your-kernel-package''</pre></blockquote>
<blockquote><pre>pmbootstrap build --force YOUR-KERNEL-PACKAGE</pre></blockquote>


4. Build and install pmOS in your usual way
4. Build and install pmOS in your usual way

Revision as of 16:16, 10 April 2022

Overview

Wireguard is modern, low-latency VPN, available in upstream Alpine repo. Not only it is fast and secure, but also very simple and straightforward in configuration. Among all VPN techlologies, it is the easiest (from user's viewpoint) and the least wayward one.

Wireguard tunnel

To enable wireguard tunneling, your kernel must be compiled with its support - which results in wireguard.ko driver module somewhere (depending on kernel version) in /lib/modules/kernel-version/kernel. Strange enough, wireguard support is disabled in default Alpine kernel - and thus in pmOS, too. You need to rebuild the kernel with the following settings:

CONFIG_WIREGUARD=m
CONFIG_CRYPTO_ECDSA=m

or, in terms of menuconfig tree,

Device Drivers  --->
    [*] Network device support  --->
        [*] Network core driver support
        <M>   WireGuard secure network tunnel

_*_ Cryptographic API  --->
    <M> ECDSA (NIST P192, P256 etc.) algorithm

While running pmOS, you can check the details by running below command in terminal

modinfo wireguard

It prints module details like filename, author, etc. If it prints something like:

modinfo: module '/lib/modules/${uname -r}/wireguard' not found

the kernel must be rebuilt, see below.

wg-quick and nftables

wg-quick is a popular script that does a lot of routine work to set up the IP stack on top of the newly created Wireguard intreface: IP address, routing, DNS, and firewall settings. For the latter task, it relies heavily onto nftables, which, it turn, also requires kernel support as follows:

CONFIG_NFT_FIB_IPV4=m
CONFIG_NFT_FIB_IPV6=m
CONFIG_NFT_FIB_INET=m
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NFT_FIB_NETDEV=m

or, in menuconfig:

Networking support  --->
    Networking options  --->
    [*] Network packet filtering framework (Netfilter)  --->
            IP: Netfilter Configuration  --->
                _*_ IPv4 nf_tables support
                <M> nf_tables fib / ip route lookup support
            IPv6: Netfilter Configuration  --->
                _*_ IPv6 nf_tables support
                <M> nf_tables fib / ip route lookup support
            Core Netfilter Configuration  --->
                <M> Netfilter nf_tables support
                [*]   Netfilter nf_tables netdev tables support
                <M>   Netfilter nf_tables fib inet support
                <M>   Netfilter nf_tables netdev fib lookups support

Note that some of these settings depend upon the previous ones. These settings are present in default Alpine kernel configurations but not in pmOS ones.

Note To consider including the the above settings, as well as other nftables modules, into default kernels, address your merge requests to Alpine and pmOS maintainers, respectively.

Installation

Recompiling kernel

To add the above settings to the kernel yourself:

1. Remove the existing chroot and packages

pmbootstrap -y zap -p

2. Configure the kernel

pmbootstrap kconfig edit YOUR-KERNEL-PACKAGE

This invokes menu tool for kernel konfiguration and packs the new configuration file back into the package. Set the abovementioned options. See Kernel configuration for package naming and other details.

3. Rebuild the kernel for your particular installation

pmbootstrap build --force YOUR-KERNEL-PACKAGE

4. Build and install pmOS in your usual way

pmbootstrap install ...

Setup and usage

To use Wireguard tunnels, you need wireguard and, recommended, wireguard-tools-wg-quick packages. They may be added manually after installation, or included in your basic software suite at pmbootstrap init step. There are other Wireguard tools to be considered as well.

Standard location for configuration of Wireguard tunnels is /etc/wireguard/interface.conf. The directory should be readable for root only (chmod 600) as it contains private keys of the host. Once wg-quick is installed, tunnels may be started/stopped as follows

sudo wg-quick up INTERFACE
sudo wg-quick down INTERFACE

with INTERFACE being a name of one of the .conf files.

Graphical User Interfaces

As of now, there is no dedicated Linux GUI application for Wireguard management. (Unlike the other OSes.) Use terminal instead. Probably someone will write it one day, or adopt the existing Android/IOS app for pmOS phones. In some desktop environments, there are (or may appear in the future) Wireguard plugins for their regular network management tools.

NetworkManger integration

In mobian there is easy way to manage Wireguard with automatically filled pre and post hooks.

nmcli connection import type Wireguard file /path/to/wg.conf

However, because of (probably) some lack in packaging, pre and post hooks interfaces are not set properly. So you are connected to your rely but DNS doesn't work.