Wireguard: Difference between revisions

From Geitenpad
Jump to navigation Jump to search
No edit summary
 
 
(5 intermediate revisions by the same user not shown)
Line 5: Line 5:
  sudo wg-quick up wg0
  sudo wg-quick up wg0


== Server ==
== Client ==
[root@RijksLReich wireguard]# cat wggpl.conf
[Interface]
PrivateKey = ----
Address = 192.168.1.4/32 
[Peer]
PublicKey = ZANO5QvDzieVtizUTaoYqmKa8Jz0i27tQvf/4aBAsXQ=
AllowedIPs = 192.168.2.0/24,192.168.1.0/24
Endpoint = geitenpad.rijkenmiel.nl:51820


https://community.freedom.nl/t/wireguard-vpn-zonder-myfritz-of-dyndns/3625/16
[root@RijksLReich wireguard]# cat wgiemhof.conf
[Interface]
PrivateKey = -----
Address = 192.168.1.250/32
[Peer]
PublicKey = PFA3adlbjdXJ5DM1V/U11DA/iLLBYCYgKwSm8Ybw+F0=
AllowedIPs = 192.168.1.0/24
Endpoint = iemhof.rijkenmiel.nl:51820


https://www.reddit.com/r/fritzbox/comments/ymshoj/tutorialworkaround_how_to_use_fritzbox_wireguard/
== Server ==
 
[Tutorial/Workaround] How to use Fritz!Box Wireguard with unsupported DDNS mechanisms
Disclaimer:
 
This tutorial makes some assumptions w.r.t. your proficiency with several IT techniques, including docker, docker-compose, etc. I am simply sharing the way I worked around the (IMHO) archaic dyndns capabilities of my Fritz!Box 6951 and won't provide any assistance on how to run a docker container etc. Regardless, if you have any other questions, feel free to ask.
Prologue/Issue statement:
 
I'm sure some of you have had their gripes with the DDNS/Wireguard interactions on the latest Fritz!Labor. Wireguard can only be set up when DynDNS or a MyFritz! account is configured successfully on the Fritz!Box (i.e. if the Fritz!Box is in charge of and successfully handles the DynDNS process). If none of these options are set up and work properly, the Wireguard setup simply fails.
 
This becomes an issue if you achieve DynDNS by some other means the Fritz!Box is not aware of, but still want to use the Wireguard functionality.
Tutorial:
 
This assumes you have your DynDNS mechanism set up by any means other than the Fritz!Box internals (for example, I use this docker image, in combination with my cloudflare managed domain to achieve DDNS behavior). This means that the Fritz!Box needs to be reachable with the domain you intend to use for your VPN connection. For example, I use vpn.<mydomain>.<tld>.
 
In order for the DynDNS mechanism of the Fritz!Box to return "success" and allow the wireguard setup to complete, we require a http endpoint which returns status code 200 when given the login credentials the Fritz!Box tries to send along. One way to achieve this is is a website called http://httpstat.us which we can use to "fake" any return code we desire. Put the following configuration in your Fritz!Box DynDNS settings:
 
Use DynDNS: checked
url: http://httpstat.us/200?user=&password=&host=&ip=&ip6=
domain: vpn.<mydomain>.<tld>
username: abc (this can be anything, don't put a real username here)
password: 123 (this can be anything, don't put a real password here)
 
Apply these settings and verify that everything went well on the overview page of your Fritz!Box (mine shows
 
DynDNS enabled, vpn.<mydomain>.<tld>, IPv4 status: logged on successfully
 
)
 
And you're done! Now you can set up wireguard and use it with your domain.
Bonus
 
If you feel uncomfortable sending your VPN domain to an external website, there is, thankfully, a possibility to self-host httpstat.us. The Fritz!Box needs to be able to reach this deployment (internal network IP is also possible), but otherwise it functions pretty much the same way. Here is my docker-compose file to set up the local deployment:
 
version: "3.6"
services:
  httpstatus:
    image: ghcr.io/aaronpowell/httpstatus:058d5b93178cb9f11d9aeb9405e07ef5875331c8
    container_name: httpstatus
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/London
    ports:
      - 80:80
    restart: unless-stopped


Now simply change the url field in your Fritz!Box DynDNS settings to your own deployment instead of http://httpstat.us (for example, with my deployment above, I use http://<internal deployment ip>/200?user=&password=&host=&ip=&ip6=)
root@Geitenpad:/etc/wireguard# cat wg1.conf
[Interface]
Address = 192.168.1.2/32
ListenPort = 51820
PrivateKey = ------
PreUp = sysctl -w net.ipv4.ip_forward=1
PreUp = iptables -t mangle -A PREROUTING -i wg1 -j MARK --set-mark 0x30
PreUp = iptables -t nat -A POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
PreUp = iptables -A FORWARD -i wg1 -o eno1 -j ACCEPT
PreUp = iptables -A FORWARD -i eno1 -o wg1 -j ACCEPT
PostDown = iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-mark 0x30
PostDown = iptables -t nat -D POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg1 -o eth0 -j ACCEPT
PostDown = iptables -D FORWARD -i eth0 -o wg1 -j ACCEPT
[Peer]
PublicKey = UiijlLcPMu8hlce3XxHja/vFcuyt+XMH0ufVyDSDyys=
AllowedIPs = 192.168.1.3/32
[Peer]
PublicKey = GP6zja0ewQxaZc6t+Q50a40W14pSSoVKFSIFnnogaiA=
AllowedIPs = 192.168.1.4/32


Any other mechanism that returns status code 200 when hit with the query you put into your url field in the Fritz!Box might also work. Feel free to add anything you found to this thread.
root@Geitenpad:/etc/wireguard# cat /proc/sys/net/ipv4/ip_forward
1


Cheers,
root@iemhof:~# cat /etc/wireguard/wg1.conf
[Interface]
Address = 192.168.1.252/32
ListenPort = 51820
PrivateKey = ---
PreUp = sysctl -w net.ipv4.ip_forward=1
PreUp = iptables -t mangle -A PREROUTING -i wg1 -j MARK --set-mark 0x30
PreUp = iptables -t nat -A POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
PostDown = iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-mark 0x30
PostDown = iptables -t nat -D POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
[Peer]
PublicKey = UiijlLcPMu8hlce3XxHja/vFcuyt+XMH0ufVyDSDyys=
AllowedIPs = 192.168.1.251/32
[Peer]
PublicKey = GP6zja0ewQxaZc6t+Q50a40W14pSSoVKFSIFnnogaiA=
AllowedIPs = 192.168.1.250/32

Latest revision as of 20:35, 15 May 2025

Client

Er is iets vreemds met Networkmanager, gebruik 

sudo wg-quick up wg0

Client

[root@RijksLReich wireguard]# cat wggpl.conf 

[Interface]
PrivateKey = ----
Address = 192.168.1.4/32  

[Peer]
PublicKey = ZANO5QvDzieVtizUTaoYqmKa8Jz0i27tQvf/4aBAsXQ= 
AllowedIPs = 192.168.2.0/24,192.168.1.0/24 
Endpoint = geitenpad.rijkenmiel.nl:51820

[root@RijksLReich wireguard]# cat wgiemhof.conf 

[Interface]
PrivateKey = -----
Address = 192.168.1.250/32

[Peer]
PublicKey = PFA3adlbjdXJ5DM1V/U11DA/iLLBYCYgKwSm8Ybw+F0= 
AllowedIPs = 192.168.1.0/24 
Endpoint = iemhof.rijkenmiel.nl:51820

Server

root@Geitenpad:/etc/wireguard# cat wg1.conf 

[Interface]
Address = 192.168.1.2/32 
ListenPort = 51820
PrivateKey = ------

PreUp = sysctl -w net.ipv4.ip_forward=1
PreUp = iptables -t mangle -A PREROUTING -i wg1 -j MARK --set-mark 0x30
PreUp = iptables -t nat -A POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
PreUp = iptables -A FORWARD -i wg1 -o eno1 -j ACCEPT
PreUp = iptables -A FORWARD -i eno1 -o wg1 -j ACCEPT

PostDown = iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-mark 0x30
PostDown = iptables -t nat -D POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg1 -o eth0 -j ACCEPT
PostDown = iptables -D FORWARD -i eth0 -o wg1 -j ACCEPT

[Peer]
PublicKey = UiijlLcPMu8hlce3XxHja/vFcuyt+XMH0ufVyDSDyys=
AllowedIPs = 192.168.1.3/32

[Peer]
PublicKey = GP6zja0ewQxaZc6t+Q50a40W14pSSoVKFSIFnnogaiA=
AllowedIPs = 192.168.1.4/32

root@Geitenpad:/etc/wireguard# cat /proc/sys/net/ipv4/ip_forward 

1

root@iemhof:~# cat /etc/wireguard/wg1.conf 

[Interface]
Address = 192.168.1.252/32
ListenPort = 51820
PrivateKey = ---

PreUp = sysctl -w net.ipv4.ip_forward=1
PreUp = iptables -t mangle -A PREROUTING -i wg1 -j MARK --set-mark 0x30
PreUp = iptables -t nat -A POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
PostDown = iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-mark 0x30
PostDown = iptables -t nat -D POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE 

[Peer]
PublicKey = UiijlLcPMu8hlce3XxHja/vFcuyt+XMH0ufVyDSDyys=
AllowedIPs = 192.168.1.251/32

[Peer]
PublicKey = GP6zja0ewQxaZc6t+Q50a40W14pSSoVKFSIFnnogaiA=
AllowedIPs = 192.168.1.250/32
Retrieved from "https://mediawiki.geitenpad.rijkenmiel.nl/index.php?title=Wireguard&oldid=197"