|
|
| Line 7: |
Line 7: |
| == Server == | | == Server == |
|
| |
|
| https://community.freedom.nl/t/wireguard-vpn-zonder-myfritz-of-dyndns/3625/16
| | root@Geitenpad:/etc/wireguard# cat wg1.conf |
| | [Interface] |
| | Address = 192.168.1.2/32 |
| | ListenPort = 51820 |
| | PrivateKey = UEClTEblGB0/DBO9VYa7DM6MRiRHOPt3nxlqTL/JykM= |
| | |
| | PreUp = sysctl -w net.ipv4.ip_forward=1 |
| | PreUp = iptables -t mangle -A PREROUTING -i wg1 -j MARK --set-mark 0x30 |
| | PreUp = iptables -t nat -A POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE |
| | PreUp = iptables -A FORWARD -i wg1 -o eno1 -j ACCEPT |
| | PreUp = iptables -A FORWARD -i eno1 -o wg1 -j ACCEPT |
| | |
| | PostDown = iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-mark 0x30 |
| | PostDown = iptables -t nat -D POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE |
| | PostDown = iptables -D FORWARD -i wg1 -o eth0 -j ACCEPT |
| | PostDown = iptables -D FORWARD -i eth0 -o wg1 -j ACCEPT |
| | |
| | [Peer] |
| | PublicKey = UiijlLcPMu8hlce3XxHja/vFcuyt+XMH0ufVyDSDyys= |
| | AllowedIPs = 192.168.1.3/32 |
| | |
| | [Peer] |
| | PublicKey = GP6zja0ewQxaZc6t+Q50a40W14pSSoVKFSIFnnogaiA= |
| | AllowedIPs = 192.168.1.4/32 |
|
| |
|
| https://www.reddit.com/r/fritzbox/comments/ymshoj/tutorialworkaround_how_to_use_fritzbox_wireguard/
| | root@Geitenpad:/etc/wireguard# cat /proc/sys/net/ipv4/ip_forward |
| | | 1 |
| [Tutorial/Workaround] How to use Fritz!Box Wireguard with unsupported DDNS mechanisms
| |
| Disclaimer:
| |
| | |
| This tutorial makes some assumptions w.r.t. your proficiency with several IT techniques, including docker, docker-compose, etc. I am simply sharing the way I worked around the (IMHO) archaic dyndns capabilities of my Fritz!Box 6951 and won't provide any assistance on how to run a docker container etc. Regardless, if you have any other questions, feel free to ask.
| |
| Prologue/Issue statement:
| |
| | |
| I'm sure some of you have had their gripes with the DDNS/Wireguard interactions on the latest Fritz!Labor. Wireguard can only be set up when DynDNS or a MyFritz! account is configured successfully on the Fritz!Box (i.e. if the Fritz!Box is in charge of and successfully handles the DynDNS process). If none of these options are set up and work properly, the Wireguard setup simply fails.
| |
| | |
| This becomes an issue if you achieve DynDNS by some other means the Fritz!Box is not aware of, but still want to use the Wireguard functionality.
| |
| Tutorial:
| |
| | |
| This assumes you have your DynDNS mechanism set up by any means other than the Fritz!Box internals (for example, I use this docker image, in combination with my cloudflare managed domain to achieve DDNS behavior). This means that the Fritz!Box needs to be reachable with the domain you intend to use for your VPN connection. For example, I use vpn.<mydomain>.<tld>.
| |
| | |
| In order for the DynDNS mechanism of the Fritz!Box to return "success" and allow the wireguard setup to complete, we require a http endpoint which returns status code 200 when given the login credentials the Fritz!Box tries to send along. One way to achieve this is is a website called http://httpstat.us which we can use to "fake" any return code we desire. Put the following configuration in your Fritz!Box DynDNS settings:
| |
| | |
| Use DynDNS: checked
| |
| url: http://httpstat.us/200?user=&password=&host=&ip=&ip6=
| |
| domain: vpn.<mydomain>.<tld>
| |
| username: abc (this can be anything, don't put a real username here)
| |
| password: 123 (this can be anything, don't put a real password here)
| |
| | |
| Apply these settings and verify that everything went well on the overview page of your Fritz!Box (mine shows
| |
| | |
| DynDNS enabled, vpn.<mydomain>.<tld>, IPv4 status: logged on successfully
| |
| | |
| )
| |
| | |
| And you're done! Now you can set up wireguard and use it with your domain.
| |
| Bonus
| |
| | |
| If you feel uncomfortable sending your VPN domain to an external website, there is, thankfully, a possibility to self-host httpstat.us. The Fritz!Box needs to be able to reach this deployment (internal network IP is also possible), but otherwise it functions pretty much the same way. Here is my docker-compose file to set up the local deployment:
| |
| | |
| version: "3.6"
| |
| services:
| |
| httpstatus:
| |
| image: ghcr.io/aaronpowell/httpstatus:058d5b93178cb9f11d9aeb9405e07ef5875331c8
| |
| container_name: httpstatus
| |
| environment:
| |
| - PUID=1000
| |
| - PGID=1000
| |
| - TZ=Europe/London
| |
| ports:
| |
| - 80:80
| |
| restart: unless-stopped
| |
| | |
| Now simply change the url field in your Fritz!Box DynDNS settings to your own deployment instead of http://httpstat.us (for example, with my deployment above, I use http://<internal deployment ip>/200?user=&password=&host=&ip=&ip6=)
| |
| | |
| Any other mechanism that returns status code 200 when hit with the query you put into your url field in the Fritz!Box might also work. Feel free to add anything you found to this thread.
| |
| | |
| Cheers,
| |
Client
Er is iets vreemds met Networkmanager, gebruik
sudo wg-quick up wg0
Server
root@Geitenpad:/etc/wireguard# cat wg1.conf
[Interface]
Address = 192.168.1.2/32
ListenPort = 51820
PrivateKey = UEClTEblGB0/DBO9VYa7DM6MRiRHOPt3nxlqTL/JykM=
PreUp = sysctl -w net.ipv4.ip_forward=1
PreUp = iptables -t mangle -A PREROUTING -i wg1 -j MARK --set-mark 0x30
PreUp = iptables -t nat -A POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
PreUp = iptables -A FORWARD -i wg1 -o eno1 -j ACCEPT
PreUp = iptables -A FORWARD -i eno1 -o wg1 -j ACCEPT
PostDown = iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-mark 0x30
PostDown = iptables -t nat -D POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg1 -o eth0 -j ACCEPT
PostDown = iptables -D FORWARD -i eth0 -o wg1 -j ACCEPT
[Peer]
PublicKey = UiijlLcPMu8hlce3XxHja/vFcuyt+XMH0ufVyDSDyys=
AllowedIPs = 192.168.1.3/32
[Peer]
PublicKey = GP6zja0ewQxaZc6t+Q50a40W14pSSoVKFSIFnnogaiA=
AllowedIPs = 192.168.1.4/32
root@Geitenpad:/etc/wireguard# cat /proc/sys/net/ipv4/ip_forward
1