How to conifugre wireguard in vyos

1
2
3
4
5
6
7

Toplogy
|--------------------------------|               |---------------------------------|
|      Server                    |               |        Client                   | 
|                                |-----cloud ----|  wan:${wan-address}             |                            
| wireguard tunnel interface:wg01|               | Wireguard tunnel interface:wg01 |
|--------------------------------|               |---------------------------------|

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

# Generates a new keypair, if one exists already is asks you if you want to overwrite the existing one.
generate wireguard keypair

#Show the private key
show wireguard privkey 

#Show the public key
show wireguard pubkey

#Enter configuration mode
configure

#set virtual network interfaces for wireguard
set interfaces wireguard wg01 address '172.16.100.1/24'

#Set Wireguard listen port
set interfaces wireguard wg01 port '50100'

#Add CLIENT1
#Set wireguard allow client ip ranges to access.
set interfaces wireguard wg01 peer CLIENT1 allowed-ips '172.16.100.2/32' 

#Set how offten to send keep alives in seconds
set interfaces wireguard wg01 peer CLIENT1 persistent-keepalive '15'

#Set presharekey
set interfaces wireguard wg01 peer CLIENT1 preshared-key gLdIlCM/AsobjfDgFK/cdgsAcjILTzLY4df5BskRcqY=
#Set client public key
set interfaces wireguard wg01 peer CLIENT1 pubkey '${client-pubkey}'


#set static routing.
set protocols static interface-route '172.16.100.0/24' next-hop-interface wg01


#make configuration applied
commit

#Save configuration
save



 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

# Generates a new keypair, if one exists already is asks you if you want to overwrite the existing one.
generate wireguard keypair

#Show the private key
show wireguard privkey 

#Show the public key
show wireguard pubkey


#Set wireguard virtual network interfaces
set interfaces wireguard wg01 address '172.16.100.2/32'


#set wireguard accept packets of network.
set interfaces wireguard wg01 peer SERVER allow-ips '0.0.0.0/0'

#Set connection to server
set interfaces wireguard wg01 peer SERVER endpoint '${server-wan-address}:50100'

#Set how offten to send keep alives in seconds
set interfaces wireguard wg01 peer SERVEr persistent-keepalive 15

#Set public key for server
set interfaces wireguard wg01 peer SERVER pubkey '${server-pubkey}'

#Set presharekey
set interfaces wireguard wg01 peer SERVER preshared-key gLdIlCM/AsobjfDgFK/cdgsAcjILTzLY4df5BskRcqY=




#set static routing to client.
set protocols static interface-route '172.16.100.0/24' next-hop-interface wg01


#Make the settings applied!
commit 

#save configuration
save


#Test wireguard connection

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

[Interface]
PrivateKey = AJ2oJcAbxCmeovofOMrJooMMlLMNNKGWuTqffF7oXVU=
Address = 172.16.100.3/32
DNS = 1.1.1.1

[Peer]
PublicKey = m6oJcAbxCmeovofOMrPCCCDkGWuTqfkGWufeovofEII=
PresharedKey = k82ffjxKzt3vy4JR5lUMRUj1eH6PGRkLgqk)knYIHaM=
AllowedIPs = 0.0.0.0/0
Endpoint = $WIREGUARD_SERVER_ADDRESS:$PORT
PersistentKeepalive = 15

1
2
3

brew install qrencode
qrencode
qrencode -t ansiutf8 < client_wireguard_ios.conf