============================ WireGuard Road Warrior Setup ============================ ------------ Introduction ------------ WireGuard is a simple, fast and modern VPN. It aims to be faster and simpler than IPSec. It intends to be considerably more performant than OpenVPN. Initially released for the Linux kernel, it is now cross-platform and widely deployable. It is currently under heavy development. We will describe here how to set up WireGuard as a central server or just as a client. --------------------- Step 1 - Installation --------------------- Install the plugin as usual, refresh the page and you will find the client via :menuselection:`VPN --> WireGuard`. -------------------------------- Step 2a - Setup WireGuard Server -------------------------------- The setup of a central VPN server is very simple. Just go to tab **Local** and create a new instance. Give it a **Name** and set a desired **Listen Port**. If you have more than one service instance be aware that you can use the **Listen Port** only once. For **Tunnel Address** choose an unused network to tunnel all clients just like with OpenVPN or GRE (e.g. 192.168.0.1/24). **Peers** can not be chosen yet since we have not created them yet. After hitting **Save changes** you can reopen the newly created instance, write down your new public key and give it to the other side in a secure way (e.g. PGP encrypted or via SMS). Now go to tab **Endpoints** and add the fist road warrior, give it a **Name**, insert the **Public Key** and **Allowed IPs** e.g. *192.168.0.2/32, 10.10.10.0/24* (it is important to use /32 for the tunnel address when using multiple endpoints). **Endpoint Address** and **Endpoint Port** can be left empty since they are mostly dynamic, now hit **Save changes**. Go back to tab **Local**, open the instance and choose the newly created endpoint in **Peers**. Now we can **Enable** the VPN in tab **General** and continue with the setup. If you want to add more users just add them in **Endpoints** and link them via **Peers**. ------------------------ Step 2b - Setup Firewall ------------------------ On :menuselection:`Firewall --> Rules` add a new rule on your WAN interface allowing the port you set in your instance (Protocol UDP). You also have a new interace **Wireguard** in rules, where you can set granular rules on connection inside your tunnel. Your tunnel is now up and running. --------------------------------- Step 2c - Assignments and Routing --------------------------------- With this setup your clients can reach your internal networks when they add it vial **Allowed IPs**. But what if you want to push all traffic via VPN in order to filter some streams out of it? Then we have to assign the interface via :menuselection:`Interface --> Assignments`, choose our instance (e.g. instance 0 is interface wg0), enable it, hit **Prevent Interface Removal** and don't configure an IP address. After this we can go to :menuselection:`Firewall --> NAT --> Outbound` and add a rule. Check that rule generation is set to manual or hybrid. Add a rule and select your WAN as **Interface**. **Source** should be the Tunnel Network you use and **Translation / target** set to WAN address. Now when you add 0.0.0.0/0 on your road warrior, outgoing packets are translated and reach the Internet via your VPN. When assigning interfaces we can also add gateways to them. This would offer you the chance to balance traffic via different VPN providers or do more complex routing scenarios. To do this, go to :menuselection:`System --> Gateways --> Single` and add a new gateway. Choose your WireGuard interface and set the Gateway to **dynamic**. ------------------------------- Step 3 - Setup WireGuard Client ------------------------------- The development of WireGuard is very dynamic so this howto won't include any screenshots since features are added rapidly or naming might change. If we have OPNsense also at the client side the configuration is similar to step 3a but you have to choose **Allowed IPs** within the range of the server side and exchange public keys after the creation of a new instance. Then networks which should be routed via WireGuard have to be added to your **Allowed IPs** in the endpoint configuration of your client (e.g. 192.168.0.0/24 when this is the LAN of WireGuard server). For pushing all network traffic via VPN you can add 0.0.0.0/0. If you do this it's important to also specifiy a DNS server which will be added to your interface. Therefore go to **Local**, edit your instance and fill in one or more IP addresses to the **DNS** field. That's it!