GoWiki | openbsd | Wireguard

# OpenBSD Wireguard

## Hetzner Cloud Static IP

This is only necessary if you are using a Hetzner Cloud Server as VPN.

```
cat <<EOF> /etc/hostname.vio0
inet <public ip> 255.255.255.255
!/sbin/route add 172.31.1.1 -static -link -iface vio0
EOF
echo 172.31.1.1 > /etc/mygate
```

## Server

### Install

Install Packages:

```
pkg_add wireguard-tools libqrencode
```

### Config

Create keys:
```
mkdir /etc/wireguard
wg genkey | tee /etc/wireguard/srv.priv | wg pubkey > /etc/wireguard/srv.pub
wg genkey | tee /etc/wireguard/clt1.priv | wg pubkey > /etc/wireguard/clt1.pub
wg genpsk >/etc/wireguard/clt1.psk
wg genkey | tee /etc/wireguard/clt2.priv | wg pubkey > /etc/wireguard/clt2.pub
wg genpsk >/etc/wireguard/clt2.psk
chmod 600 /etc/wireguard/*
```

Enable IP forwarding:
```
sysctl net.inet.ip.forwarding=1
echo net.inet.ip.forwarding=1 >> /etc/sysctl.conf
```

Create the `wg0` interface:
```
ifconfig wg0 create
cat <<EOF> /etc/hostname.wg0
inet 172.17.0.1 255.255.255.248
wgkey $(cat /etc/wireguard/srv.priv) wgport 5555
wgpeer $(cat /etc/wireguard/clt1.pub) wgpsk $(cat /etc/wireguard/clt1.psk) wgaip 172.17.0.2/32
wgpeer $(cat /etc/wireguard/clt2.pub) wgpsk $(cat /etc/wireguard/clt2.psk) wgaip 172.17.0.3/32
EOF
sh /etc/netstart
```

Client Configs:
```
cat <<EOF> /etc/wireguard/client1.conf
[Interface]
PrivateKey = $(cat /etc/wireguard/clt1.priv)
Address = 172.17.0.2/32
DNS = 172.17.0.1

[Peer]
Endpoint = <wireguard server ip>:443
PublicKey = $(cat /etc/wireguard/srv.pub)
PresharedKey = $(cat /etc/wireguard/clt1.psk)
AllowedIPs = 0.0.0.0/0
EOF

cat <<EOF> /etc/wireguard/client2.conf
[Interface]
PrivateKey = $(cat /etc/wireguard/clt2.priv)
Address = 172.17.0.3/32
DNS = 172.17.0.1

[Peer]
Endpoint = <wireguard server ip>:443
PublicKey = $(cat /etc/wireguard/srv.pub)
PresharedKey = $(cat /etc/wireguard/clt2.psk)
AllowedIPs = 0.0.0.0/0
EOF
```

pf config:
```
cat <<EOF> /etc/pf.conf
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \
        172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.168.0.0/16 \
        198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/3 }
set loginterface egress
set skip on lo

# masquerading
match out on egress inet from !(egress:network) to any nat-to (egress:0)

# icmp
pass in quick on egress proto icmp from any to egress

# block orphan networks
antispoof quick for egress
block in quick on egress from <martians> to any
block return out quick on egress from any to <martians>
block all

# allow internet access
pass out quick inet

# allow wg
pass in quick on wg0 proto icmp from (wg0:network) to (wg0:0)
pass in quick on wg0 proto { tcp, udp } from (wg0:network) to (wg0:0) port { 53, 123 }
block in quick on wg0 from (wg0:network) to (wg0:network)
pass in quick on wg0 from (wg0:network) to any keep state

# allow inbound
pass in on egress proto tcp to any port ssh
pass in on egress proto udp to any port 5555
pass in on egress proto udp to any port 53 rdr-to egress port 5555
pass in on egress proto udp to any port 80 rdr-to egress port 5555
pass in on egress proto udp to any port 443 rdr-to egress port 5555
pass in on egress proto udp to any port 8080 rdr-to egress port 5555
EOF
pfctl -f /etc/pf.conf
```

Generate QR-Codes to scan via phone:
```
qrencode -t UTF8 -r /etc/wireguard/client1.conf
qrencode -t UTF8 -r /etc/wireguard/client2.conf
```

### DNS Resolver

See: [DNS Resolver](/openbsd/DNS+Resolver)

## Client

```
wg genkey | tee /etc/wireguard/clt.priv | wg pubkey > /etc/wireguard/clt.pub
wg genpsk >/etc/wireguard/clt.psk
chmod 600 /etc/wireguard/*
```

```
ifconfig wg0 create
cat <<EOF> /etc/hostname.wg0
inet 172.20.0.2 255.255.255.0
wgkey $(cat /etc/wireguard/clt.priv)
wgpeer <server pub> wgpsk $(cat /etc/wireguard/clt.psk) wgendpoint example.com 5555 wgaip 172.20.0.0/24
EOF
sh /etc/netstart
```

```
queue inq on wg0 bandwidth 10M max 10M default
block in quick on wg0 from (wg0:network) to any
```