WireGuard VPN¶

Server setup¶

To use the VPN feature you need a running Wireguard server to connect to.

The installation instructions are best covered on the official Wireguard website: https://www.wireguard.com/install/.

Next steps are covered in their quickstart guide: https://www.wireguard.com/quickstart/.

Terminology

While Wireguard uses peers in their terminology, we will refer to the UZG device as peer and to the Wireguard server as server.

Keys¶

Private/Public key-pair¶

Peer authentication is achieved using a private/public key-pair. To generate the keys you can use the built-in wg command:

$ mkdir wg-keys
$ cd wg-keys
$ umask 077
$ wg genkey | tee privatekey | wg pubkey > publickey

This will create two files with private and public key respectively. You can use those later in the configuration process.

Each peer (and server) should have a unique key-pair. Private keys should only ever be known to the "owner" of the key-pair, wheras public key can be shared with other peers or servers.

Pre-shared key¶

Optionally, you can add another layer of cryptographic protection to your VPN with the PreSharedKey. It adds a layer of symmetric-key cryptography to the traffic between specific peers.

You can generate the key using the wg command:

$ wg genpsk > psk

Config generator¶

There is also a handy config generator website: https://www.wireguardconfig.com/. Make sure to note the Random seed so you can replicate the configuration and keys if needed.

Wireguard peer configuration¶

WireGuard Interface Settings¶

IP address of the local interface

This is the local peer IP address of the WireGuard interface. It should match AllowedIPs section in server config.
Local Subnet

The subnet for the local peer IP address. If unsure, a safe bet would be 255.255.255.0.
Local port

Port number of the local interface, normally 33333.
Local Gateway

A gateway to use on the VPN interface. It can be either the Wireguard server IP (see Example) or 0.0.0.0.
Private key of the local interface

The private key of the local peer. (see Private/Public key-pair)
Address of the endpoint peer

Address of the WG server
Public key of the endpoint peer

The public key of the WG server. (see Private/Public key-pair)
Port of the endpoint peer

Port of the WG server, normally 51820
Allowed IPs

A comma separated list of the IPs allowed to connect to this device via WG
Allowed Subnet

A comma separated list of the subnets allowed to connect to this device via WG
Make default

Use this as the default Wireguard configuration.
Pre-shared key

Optional key to encrypt traffic between peers (see Pre-shared key). Leave blank if unused.

Example¶

Demo data

Please generate new keys and use appropriate IP ranges for use in real life scenarios! (see Private/Public key-pair)

	Server	Peer
Public IP	1.2.3.4	...
Wireguard IP	10.100.0.1	10.100.0.2
Private key	Server+PrivateKey=	Peer+PrivateKey=
Public key	Server+PublicKey=	Peer+PublicKey=
Port	51820	33333

Server config¶

An example entry of the /etc/wg0.conf:

[Interface]
Address = 10.100.0.1/24
ListenPort = 51820
PrivateKey = Server+PrivateKey=

[Peer]
PublicKey = Peer+PublicKey=
AllowedIPs = 10.100.0.2/32

Peer config¶


IP address of the local interface:	10.100.0.2
Local Subnet:	255.255.255.0
Local port:	33333
Local Gateway:	10.100.0.1
Private key of the local interface:	Peer+PrivateKey=
Address of the endpoint peer:	1.2.3.4
Public key of the endpoint peer:	Server+PublicKey=
Port of the endpoint peer:	51820
Allowed IPs:	0.0.0.0
Allowed Subnet:	0.0.0.0