vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-12-17 02:52:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

updated diagram, updated sudo wg, fixed heading sizes, replaced pub IPs

Browse Source
This commit is contained in:
usman-umer 2021-07-12 12:34:54 +01:00
parent edacdd23e5
commit ec23969bc8
3 changed files with 38 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
docs/_static/images/wireguard_site2site_diagram.jpg vendored Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 21 KiB

BIN
docs/_static/images/wireguard_vpn_diagram.jpg vendored
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 20 KiB

75
docs/configuration/interfaces/wireguard.rst
View File

@ -8,13 +8,13 @@ WireGuard is an extremely simple yet fast and modern VPN that utilizes
state-of-the-art cryptography. See https://www.wireguard.com for more state-of-the-art cryptography. See https://www.wireguard.com for more
information. information.
************* ****************
Diagram Site to Site VPN
************* ****************
This diagram corresponds with the configuration below. This diagram corresponds with the example site to site configuration below.
.. figure:: /_static/images/wireguard_vpn_diagram.jpg .. figure:: /_static/images/wireguard_site2site_diagram.jpg
************* *************
Configuration Configuration
@ -22,9 +22,9 @@ Configuration
************* ********
Keypairs Keypairs
************* ********
WireGuard requires the generation of a keypair, which includes a private WireGuard requires the generation of a keypair, which includes a private
key to decrypt incoming traffic, and a public key for peer(s) to encrypt key to decrypt incoming traffic, and a public key for peer(s) to encrypt
@ -67,9 +67,9 @@ own keypairs.
vyos@vyos:~$ generate wireguard named-keypairs KP02 vyos@vyos:~$ generate wireguard named-keypairs KP02
************************** ***********************
Interface configuration Interface configuration
************************** ***********************
The next step is to configure your local side as well as the policy The next step is to configure your local side as well as the policy
based trusted destination addresses. If you only initiate a connection, based trusted destination addresses. If you only initiate a connection,
@ -91,7 +91,7 @@ one.
set interfaces wireguard wg01 address '10.1.0.1/30' set interfaces wireguard wg01 address '10.1.0.1/30'
set interfaces wireguard wg01 description 'VPN-to-wg02' set interfaces wireguard wg01 description 'VPN-to-wg02'
set interfaces wireguard wg01 peer to-wg02 allowed-ips '192.168.2.0/24' set interfaces wireguard wg01 peer to-wg02 allowed-ips '192.168.2.0/24'
set interfaces wireguard wg01 peer to-wg02 address '2.2.2.2' set interfaces wireguard wg01 peer to-wg02 address '<Site1 Pub IP>'
set interfaces wireguard wg01 peer to-wg02 port '51820' set interfaces wireguard wg01 peer to-wg02 port '51820'
set interfaces wireguard wg01 peer to-wg02 pubkey 'XMrlPykaxhdAAiSjhtPlvi30NVkvLQliQuKP7AI7CyI=' set interfaces wireguard wg01 peer to-wg02 pubkey 'XMrlPykaxhdAAiSjhtPlvi30NVkvLQliQuKP7AI7CyI='
set interfaces wireguard wg01 port '51820' set interfaces wireguard wg01 port '51820'
@ -101,14 +101,14 @@ one.
.. code-block:: none .. code-block:: none
set interfaces wireguard wg01 address '10.1.0.1/30' # Address of the wg01 tunnel interface. set interfaces wireguard wg01 address '10.1.0.1/30' # Address of the wg01 tunnel interface.
set interfaces wireguard wg01 description 'VPN-to-wg02' set interfaces wireguard wg01 description 'VPN-to-wg02'
set interfaces wireguard wg01 peer to-wg02 allowed-ips '192.168.2.0/24'# Subnets that are allowed to travel over the tunnel set interfaces wireguard wg01 peer to-wg02 allowed-ips '192.168.2.0/24' # Subnets that are allowed to travel over the tunnel
set interfaces wireguard wg01 peer to-wg02 address '2.2.2.2' # Public IP of the peer set interfaces wireguard wg01 peer to-wg02 address '<Site2 Pub IP>' # Public IP of the peer
set interfaces wireguard wg01 peer to-wg02 port '58120' # Port of the Peer set interfaces wireguard wg01 peer to-wg02 port '58120' # Port of the Peer
set interfaces wireguard wg01 peer to-wg02 pubkey '<pubkey>' # Public Key of the Peer set interfaces wireguard wg01 peer to-wg02 pubkey '<pubkey>' # Public Key of the Peer
set interfaces wireguard wg01 port '51820' # Port of own server set interfaces wireguard wg01 port '51820' # Port of own server
set protocols static route 192.168.2.0/24 interface wg01 # Static route to remote subnet set protocols static route 192.168.2.0/24 interface wg01 # Static route to remote subnet
The last step is to define an interface route for 10.2.0.0/24 to get The last step is to define an interface route for 10.2.0.0/24 to get
through the WireGuard interface `wg01`. Multiple IPs or networks can be through the WireGuard interface `wg01`. Multiple IPs or networks can be
@ -139,7 +139,7 @@ or allows the traffic.
set interfaces wireguard wg01 address '10.1.0.2/30' set interfaces wireguard wg01 address '10.1.0.2/30'
set interfaces wireguard wg01 description 'VPN-to-wg01' set interfaces wireguard wg01 description 'VPN-to-wg01'
set interfaces wireguard wg01 peer to-wg02 allowed-ips '192.168.1.0/24' set interfaces wireguard wg01 peer to-wg02 allowed-ips '192.168.1.0/24'
set interfaces wireguard wg01 peer to-wg02 address '1.1.1.1' set interfaces wireguard wg01 peer to-wg02 address '<Site1 Pub IP>'
set interfaces wireguard wg01 peer to-wg02 port '51820' set interfaces wireguard wg01 peer to-wg02 port '51820'
set interfaces wireguard wg01 peer to-wg02 pubkey 'u41jO3OF73Gq1WARMMFG7tOfk7+r8o8AzPxJ1FZRhzk=' set interfaces wireguard wg01 peer to-wg02 pubkey 'u41jO3OF73Gq1WARMMFG7tOfk7+r8o8AzPxJ1FZRhzk='
set interfaces wireguard wg01 port '51820' set interfaces wireguard wg01 port '51820'
@ -149,18 +149,18 @@ or allows the traffic.
.. code-block:: none .. code-block:: none
set interfaces wireguard wg01 address '10.1.0.2/30' # Address of the wg01 tunnel interface. set interfaces wireguard wg01 address '10.1.0.2/30' # Address of the wg01 tunnel interface.
set interfaces wireguard wg01 description 'VPN-to-wg01' set interfaces wireguard wg01 description 'VPN-to-wg01'
set interfaces wireguard wg01 peer to-wg02 allowed-ips '192.168.1.0/24'# Subnets that are allowed to travel over the tunnel set interfaces wireguard wg01 peer to-wg02 allowed-ips '192.168.1.0/24' # Subnets that are allowed to travel over the tunnel
set interfaces wireguard wg01 peer to-wg02 address '1.1.1.1' # Public IP address of the Peer set interfaces wireguard wg01 peer to-wg02 address 'Site1 Pub IP' # Public IP address of the Peer
set interfaces wireguard wg01 peer to-wg02 port '12345' # Port of the Peer set interfaces wireguard wg01 peer to-wg02 port '51820' # Port of the Peer
set interfaces wireguard wg01 peer to-wg02 pubkey '<pubkey>' # Public key of the Peer set interfaces wireguard wg01 peer to-wg02 pubkey '<pubkey>' # Public key of the Peer
set interfaces wireguard wg01 port '51820' # Port of own server set interfaces wireguard wg01 port '51820' # Port of own server
set protocols static route 192.168.1.0/24 interface wg01 # Static route remote subnet set protocols static route 192.168.1.0/24 interface wg01 # Static route to remote subnet
************************** *******************
Firewall Exceptions Firewall Exceptions
************************** *******************
For the WireGuard traffic to pass through the WAN interface, you must create a firewall exception. For the WireGuard traffic to pass through the WAN interface, you must create a firewall exception.
@ -215,9 +215,9 @@ its content. Make sure you distribute the key in a safe manner,
wg02# set interfaces wireguard wg01 peer to-wg01 preshared-key 'rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc=' wg02# set interfaces wireguard wg01 peer to-wg01 preshared-key 'rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc='
******************************* ***********************************
Mobile "RoadWarrior" Example Remote Access "RoadWarrior" Example
******************************* ***********************************
With WireGuard, a Road Warrior VPN config is similar to a site-to-site With WireGuard, a Road Warrior VPN config is similar to a site-to-site
VPN. It just lacks the ``address`` and ``port`` statements. VPN. It just lacks the ``address`` and ``port`` statements.
@ -287,17 +287,18 @@ Operational Commands
Status Status
====== ======
.. opcmd:: sudo wg .. opcmd:: show interfaces wireguard wg0 summary
Show info about the Wireguard service. Show info about the Wireguard service.
Also shows the latest handshake. Also shows the latest handshake.
.. code-block:: none .. code-block:: none
vyos@vyos:~$ show interfaces wireguard wg0 summary
interface: wg0 interface: wg0
public key: public key:
private key: (hidden) private key: (hidden)
listening port: 51869 listening port: 51820
peer: <peer pubkey> peer: <peer pubkey>
endpoint: <peer public IP> endpoint: <peer public IP>
@ -335,9 +336,9 @@ Status
TX: bytes packets errors dropped carrier collisions TX: bytes packets errors dropped carrier collisions
0 0 0 0 0 0 0 0 0 0 0 0
************************** ***************
Encryption Keys Encryption Keys
************************** ***************
.. opcmd:: show wireguard keypair pubkey <name> .. opcmd:: show wireguard keypair pubkey <name>
@ -368,9 +369,9 @@ Encryption Keys
vyos@vyos:~$ delete wireguard keypair default vyos@vyos:~$ delete wireguard keypair default
******************************* ***********************************
Mobile "RoadWarrior" clients Remote Access "RoadWarrior" clients
******************************* ***********************************
Some users tend to connect their mobile devices using WireGuard to their VyOS Some users tend to connect their mobile devices using WireGuard to their VyOS
router. To ease deployment one can generate a "per mobile" configuration from router. To ease deployment one can generate a "per mobile" configuration from