OpenBSD Wireguard

Hetzner Cloud Static IP

This is only necessary if you are using a Hetzner Cloud Server as VPN.

cat <<EOF> /etc/hostname.vio0
inet <public ip> 255.255.255.255
!/sbin/route add 172.31.1.1 -static -link -iface vio0
EOF
echo 172.31.1.1 > /etc/mygate

Server

Install

Install Packages:

pkg_add wireguard-tools libqrencode

Config

Create keys:

mkdir /etc/wireguard
wg genkey | tee /etc/wireguard/srv.priv | wg pubkey > /etc/wireguard/srv.pub
wg genkey | tee /etc/wireguard/clt1.priv | wg pubkey > /etc/wireguard/clt1.pub
wg genpsk >/etc/wireguard/clt1.psk
wg genkey | tee /etc/wireguard/clt2.priv | wg pubkey > /etc/wireguard/clt2.pub
wg genpsk >/etc/wireguard/clt2.psk
chmod 600 /etc/wireguard/*

Enable IP forwarding:

sysctl net.inet.ip.forwarding=1
echo net.inet.ip.forwarding=1 >> /etc/sysctl.conf

Create the wg0 interface:

ifconfig wg0 create
cat <<EOF> /etc/hostname.wg0
inet 172.17.0.1 255.255.255.248
wgkey $(cat /etc/wireguard/srv.priv) wgport 5555
wgpeer $(cat /etc/wireguard/clt1.pub) wgpsk $(cat /etc/wireguard/clt1.psk) wgaip 172.17.0.2/32
wgpeer $(cat /etc/wireguard/clt2.pub) wgpsk $(cat /etc/wireguard/clt2.psk) wgaip 172.17.0.3/32
EOF
sh /etc/netstart

Client Configs:

cat <<EOF> /etc/wireguard/client1.conf
[Interface]
PrivateKey = $(cat /etc/wireguard/clt1.priv)
Address = 172.17.0.2/32
DNS = 172.17.0.1

[Peer]
Endpoint = <wireguard server ip>:443
PublicKey = $(cat /etc/wireguard/srv.pub)
PresharedKey = $(cat /etc/wireguard/clt1.psk)
AllowedIPs = 0.0.0.0/0
EOF

cat <<EOF> /etc/wireguard/client2.conf
[Interface]
PrivateKey = $(cat /etc/wireguard/clt2.priv)
Address = 172.17.0.3/32
DNS = 172.17.0.1

[Peer]
Endpoint = <wireguard server ip>:443
PublicKey = $(cat /etc/wireguard/srv.pub)
PresharedKey = $(cat /etc/wireguard/clt2.psk)
AllowedIPs = 0.0.0.0/0
EOF

pf config:

cat <<EOF> /etc/pf.conf
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \
        172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.168.0.0/16 \
        198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/3 }
set loginterface egress
set skip on lo

# masquerading
match out on egress inet from !(egress:network) to any nat-to (egress:0)

# icmp
pass in quick on egress proto icmp from any to egress

# block orphan networks
antispoof quick for egress
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block all

# allow internet access
pass out quick inet

# allow wg
pass in quick on wg0 proto icmp from (wg0:network) to (wg0:0)
pass in quick on wg0 proto { tcp, udp } from (wg0:network) to (wg0:0) port { 53, 123 }
block in quick on wg0 from (wg0:network) to (wg0:network)
pass in quick on wg0 from (wg0:network) to any keep state

# allow inbound
pass in on egress proto tcp to any port ssh
pass in on egress proto udp to any port 5555
pass in on egress proto udp to any port 53 rdr-to egress port 5555
pass in on egress proto udp to any port 80 rdr-to egress port 5555
pass in on egress proto udp to any port 443 rdr-to egress port 5555
pass in on egress proto udp to any port 8080 rdr-to egress port 5555
EOF
pfctl -f /etc/pf.conf

Generate QR-Codes to scan via phone:

qrencode -t UTF8 -r /etc/wireguard/client1.conf
qrencode -t UTF8 -r /etc/wireguard/client2.conf

DNS Resolver

See: DNS Resolver

Client

wg genkey | tee /etc/wireguard/clt.priv | wg pubkey > /etc/wireguard/clt.pub
wg genpsk >/etc/wireguard/clt.psk
chmod 600 /etc/wireguard/*

ifconfig wg0 create
cat <<EOF> /etc/hostname.wg0
inet 172.20.0.2 255.255.255.0
wgkey $(cat /etc/wireguard/clt.priv)
wgpeer <server pub> wgpsk $(cat /etc/wireguard/clt.psk) wgendpoint example.com 5555 wgaip 172.20.0.0/24
EOF
sh /etc/netstart

queue inq on wg0 bandwidth 10M max 10M default
block in quick on wg0 from (wg0:network) to any