<?xml version="1.0" encoding="utf-8" standalone="yes" ?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
		<title>Wireguard on tastyteablog</title>
		<link>https://blog.tastytea.de/tags/wireguard/</link>
		<description>Recent content in Wireguard on tastyteablog</description>
		<generator>Hugo 0.54.0 -- gohugo.io</generator>
		<language>en</language>
		<managingEditor>tastytea@tastytea.de (tastytea)</managingEditor>
		<webMaster>tastytea@tastytea.de (tastytea)</webMaster>
		<copyright>CC BY-NC 4.0</copyright>
		<lastBuildDate>Thu, 14 Feb 2019 21:38:28 +0100</lastBuildDate>
		<atom:link href="https://blog.tastytea.de/tags/wireguard/index.xml" rel="self" type="application/rss+xml" />
		<item>
			<title>WireGuard VPN with 2 or more subnets</title>
			<link>https://blog.tastytea.de/posts/wireguard-vpn-with-2-or-more-subnets/</link>
			<pubDate>Thu, 14 Feb 2019 21:38:28 +0100</pubDate>
			<author>tastytea@tastytea.de (tastytea)</author>
			<guid>https://blog.tastytea.de/posts/wireguard-vpn-with-2-or-more-subnets/</guid>
			<description>&lt;div class=&#34;paragraph&#34;&gt;
&lt;p&gt;I wanted to create a &lt;a href=&#34;https://en.wikipedia.org/wiki/WireGuard&#34;&gt;WireGuard&lt;/a&gt; VPN with
2 subnets in different physical places, each with their own server. I couldn&amp;#8217;t
find an example how to do that, so I wrote this one.&lt;/p&gt;
&lt;/div&gt;
&lt;div class=&#34;sect1&#34;&gt;
&lt;h2 id=&#34;_introduction&#34;&gt;Introduction&lt;/h2&gt;
&lt;div class=&#34;sectionbody&#34;&gt;
&lt;div class=&#34;paragraph&#34;&gt;
&lt;p&gt;I&amp;#8217;m going to use the IP range &lt;code&gt;fd69::/48&lt;/code&gt; for the VPN, &lt;code&gt;fd69:0:0:1::/64&lt;/code&gt; for
subnet 1 and &lt;code&gt;fd69:0:0:2::/64&lt;/code&gt; for subnet 2. I&amp;#8217;m going to call the server of
subnet 1 &lt;code&gt;server1&lt;/code&gt;, its first client &lt;code&gt;client1a&lt;/code&gt;, the second one &lt;code&gt;client1b&lt;/code&gt; and
so on.&lt;/p&gt;
&lt;/div&gt;
&lt;div class=&#34;paragraph&#34;&gt;
&lt;p&gt;All clients in subnet 1 will connect to &lt;code&gt;server1&lt;/code&gt; and all clients in subnet 2
will connect to &lt;code&gt;server2&lt;/code&gt;. &lt;code&gt;server1&lt;/code&gt; and &lt;code&gt;server2&lt;/code&gt; will be connected. If
&lt;code&gt;client1a&lt;/code&gt; wants to connect to &lt;code&gt;client2a&lt;/code&gt;, the route will be:
&lt;code&gt;client1a → server1 → server2 → client2a&lt;/code&gt;.&lt;/p&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;sect1&#34;&gt;
&lt;h2 id=&#34;_preparations&#34;&gt;Preparations&lt;/h2&gt;
&lt;div class=&#34;sectionbody&#34;&gt;
&lt;div class=&#34;paragraph&#34;&gt;
&lt;p&gt;&lt;a href=&#34;https://www.wireguard.com/install/&#34;&gt;Install WireGuard&lt;/a&gt;, create &lt;code&gt;/etc/wireguard&lt;/code&gt;
and generate a key-pair on each participating peer.&lt;/p&gt;
&lt;/div&gt;
&lt;div class=&#34;listingblock&#34;&gt;
&lt;div class=&#34;content&#34;&gt;
&lt;pre&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-sh&#34; data-lang=&#34;sh&#34;&gt;mkdir /etc/wireguard
&lt;span class=&#34;nb&#34;&gt;cd&lt;/span&gt; /etc/wireguard
&lt;span class=&#34;nb&#34;&gt;umask&lt;/span&gt; &lt;span class=&#34;m&#34;&gt;077&lt;/span&gt;
wg genkey &lt;span class=&#34;p&#34;&gt;|&lt;/span&gt; tee privatekey &lt;span class=&#34;p&#34;&gt;|&lt;/span&gt; wg pubkey &amp;gt; publickey&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;sect1&#34;&gt;
&lt;h2 id=&#34;_configure_servers&#34;&gt;Configure servers&lt;/h2&gt;
&lt;div class=&#34;sectionbody&#34;&gt;
&lt;div class=&#34;listingblock&#34;&gt;
&lt;div class=&#34;title&#34;&gt;&lt;code&gt;server1:/etc/wireguard/wg0.conf&lt;/code&gt;:&lt;/div&gt;
&lt;div class=&#34;content&#34;&gt;
&lt;pre&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-cfg&#34; data-lang=&#34;cfg&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# This peer&lt;/span&gt;
&lt;span class=&#34;k&#34;&gt;[Interface]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;Address&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69:0:0:1::1/48&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PrivateKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PRIVATE KEY OF server1&amp;gt;&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;ListenPort&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;51820&lt;/span&gt;

&lt;span class=&#34;c1&#34;&gt;# Server of subnet 2&lt;/span&gt;
&lt;span class=&#34;k&#34;&gt;[Peer]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PublicKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PUBLIC KEY OF server2&amp;gt;&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;Endpoint&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;server2:51820&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;AllowedIPs&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69:0:0:2::/64&lt;/span&gt;

&lt;span class=&#34;c1&#34;&gt;# Clients of subnet 1&lt;/span&gt;
&lt;span class=&#34;k&#34;&gt;[Peer]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PublicKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PUBLIC KEY OF client1a&amp;gt;&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;AllowedIPs&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69:0:0:1::a/128&lt;/span&gt;

&lt;span class=&#34;k&#34;&gt;[Peer]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PublicKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PUBLIC KEY OF client1b&amp;gt;&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;AllowedIPs&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69:0:0:1::b/128&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;listingblock&#34;&gt;
&lt;div class=&#34;title&#34;&gt;&lt;code&gt;server2:/etc/wireguard/wg0.conf&lt;/code&gt;:&lt;/div&gt;
&lt;div class=&#34;content&#34;&gt;
&lt;pre&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-cfg&#34; data-lang=&#34;cfg&#34;&gt;&lt;span class=&#34;c1&#34;&gt;# This peer&lt;/span&gt;
&lt;span class=&#34;k&#34;&gt;[Interface]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;Address&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69:0:0:2::1/48&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PrivateKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PRIVATE KEY OF server2&amp;gt;&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;ListenPort&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;51820&lt;/span&gt;

&lt;span class=&#34;c1&#34;&gt;# Server of subnet 1&lt;/span&gt;
&lt;span class=&#34;k&#34;&gt;[Peer]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PublicKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PUBLIC KEY OF server1&amp;gt;&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;Endpoint&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;server1:51820&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;AllowedIPs&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69:0:0:1::/64&lt;/span&gt;

&lt;span class=&#34;c1&#34;&gt;# Clients of subnet 2&lt;/span&gt;
&lt;span class=&#34;k&#34;&gt;[Peer]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PublicKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PUBLIC KEY OF client2a&amp;gt;&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;AllowedIPs&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69:0:0:2::a/128&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;sect1&#34;&gt;
&lt;h2 id=&#34;_configure_clients&#34;&gt;Configure clients&lt;/h2&gt;
&lt;div class=&#34;sectionbody&#34;&gt;
&lt;div class=&#34;listingblock&#34;&gt;
&lt;div class=&#34;title&#34;&gt;&lt;code&gt;client1a:/etc/wireguard/wg0.conf&lt;/code&gt;:&lt;/div&gt;
&lt;div class=&#34;content&#34;&gt;
&lt;pre&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-cfg&#34; data-lang=&#34;cfg&#34;&gt;&lt;span class=&#34;k&#34;&gt;[Interface]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;Address&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69:0:0:1::a/48&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PrivateKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PRIVATE KEY OF client1a&amp;gt;&lt;/span&gt;

&lt;span class=&#34;k&#34;&gt;[Peer]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PublicKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PUBLIC KEY OF server1&amp;gt;&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;Endpoint&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;server1:51820&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;AllowedIPs&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69::/48&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PersistentKeepalive&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;25&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;listingblock&#34;&gt;
&lt;div class=&#34;title&#34;&gt;&lt;code&gt;client1b:/etc/wireguard/wg0.conf&lt;/code&gt;:&lt;/div&gt;
&lt;div class=&#34;content&#34;&gt;
&lt;pre&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-cfg&#34; data-lang=&#34;cfg&#34;&gt;&lt;span class=&#34;k&#34;&gt;[Interface]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;Address&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69:0:0:1::b/48&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PrivateKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PRIVATE KEY OF client1b&amp;gt;&lt;/span&gt;

&lt;span class=&#34;k&#34;&gt;[Peer]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PublicKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PUBLIC KEY OF server1&amp;gt;&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;Endpoint&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;server1:51820&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;AllowedIPs&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69::/48&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PersistentKeepalive&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;25&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;listingblock&#34;&gt;
&lt;div class=&#34;title&#34;&gt;&lt;code&gt;client2a:/etc/wireguard/wg0.conf&lt;/code&gt;:&lt;/div&gt;
&lt;div class=&#34;content&#34;&gt;
&lt;pre&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;pre class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-cfg&#34; data-lang=&#34;cfg&#34;&gt;&lt;span class=&#34;k&#34;&gt;[Interface]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;Address&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69:0:0:2::a/48&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PrivateKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PRIVATE KEY OF client2a&amp;gt;&lt;/span&gt;

&lt;span class=&#34;k&#34;&gt;[Peer]&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PublicKey&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;&amp;lt;PUBLIC KEY OF server2&amp;gt;&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;Endpoint&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;server1:51820&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;AllowedIPs&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;fd69::/48&lt;/span&gt;
&lt;span class=&#34;na&#34;&gt;PersistentKeepalive&lt;/span&gt; &lt;span class=&#34;o&#34;&gt;=&lt;/span&gt; &lt;span class=&#34;s&#34;&gt;25&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/pre&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;paragraph&#34;&gt;
&lt;p&gt;The &lt;code&gt;AllowedIPs&lt;/code&gt; setting acts as a routing table. When a peer tries to send a
packet to an IP, it will check &lt;code&gt;AllowedIPs&lt;/code&gt;, and if the IP appears in the list,
it will send it through the WireGuard interface.&lt;/p&gt;
&lt;/div&gt;
&lt;div class=&#34;paragraph&#34;&gt;
&lt;p&gt;The &lt;code&gt;PersistentKeepalive&lt;/code&gt; setting ensures that the connection is maintained and
that the peer continues to be reachable, even behind a NAT.&lt;/p&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;sect1&#34;&gt;
&lt;h2 id=&#34;_start_vpn&#34;&gt;Start VPN&lt;/h2&gt;
&lt;div class=&#34;sectionbody&#34;&gt;
&lt;div class=&#34;paragraph&#34;&gt;
&lt;p&gt;Run &lt;code&gt;wg-quick up wg0&lt;/code&gt; on each peer.&lt;/p&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;div class=&#34;sect1&#34;&gt;
&lt;h2 id=&#34;_further_reading&#34;&gt;Further reading&lt;/h2&gt;
&lt;div class=&#34;sectionbody&#34;&gt;
&lt;div class=&#34;paragraph&#34;&gt;
&lt;p&gt;The article &lt;a href=&#34;https://www.stavros.io/posts/how-to-configure-wireguard/&#34;&gt;How to easily configure WireGuard&lt;/a&gt;
by Stavros Korokithakis helped me a great deal in understanding WireGuard.&lt;/p&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;/div&gt;
</description>
		</item>
	</channel>
</rss>
