Knowledge Base (Posts about vpn)

resolv.conf when turning off wireguard vpn

bgstack15 — Mon, 27 Nov 2023 13:53:17 GMT

This probably isn't the best way to handle things, but because I use both connman and wireguard on a laptop that I take on the road, I have this snippet in my /etc/wireguard/wg0.conf:

[Interface]
DNS = 192.168.1.1,192.168.1.2, ipa.internal.com, vm.internal.com, remote.internal.com, internal.com
PostUp = ln -sf /run/resolvconf/resolv.conf /etc/resolv.conf
PostDown = ln -sf /run/connman/resolv.conf /etc/resolv.conf

This forces my resolv.conf to use whatever resolvconf generates, which wireguard uses. And wireguard passes those non-IP address names as the search domains to resolvconf, and of course those nameserver entries.

I should probably bother to learn how to get connman to use resolvconf, or get it to use wireguard.

Setting up remote server, bgstack15-style

bgstack15 — Sun, 21 Aug 2022 13:12:03 GMT

I have previously described some of these tasks in an old post, but this is a single section of steps, updated!

When I set up a remote system I want to have a connection to it so I can control and administer it. I set up two paths to it:

autossh from $NEWSERVER back to $OLDSITE
wireguard vpn connection

Install wireguard and autossh. Additionally I used resolvconf because it makes wireguard control dns better. That might resemble:

sudo apt-get install wireguard autossh resolvconf

Establish autossh

Create a user for this purpose and generate an ssh key.

sudo useradd --create-home --shell /bin/bash autossh
sudo passwd autossh
sudo su autossh -c 'ssh-keygen'
sudo su autossh
# as user autossh:
ssh-copy-id -p 2022 autossh@www.example.com

Make a new system service with either an init file or unit file.

Restart the system service!

Establish wireguard

And for wireguard, establish the settings to connect my relevant nodes. Select an available IP address from "IP space map - Internal.ods" file. Establish file /etc/wireguard/wg0.conf like below.

[Interface]
Address = 10.222.0.102/24
ListenPort = 51820
# from `wg genkey`
PrivateKey = SCRUBBED
# this system  public key
# from `echo $PrivateKey | wg pubkey`
# SCRUBBED
# If I need dns servers and search domains
DNS = 192.168.1.10,192.168.1.11, ipa.internal.com, vm.internal.com, internal.com
[Peer]
# first main peer
PublicKey = KOQVWMYb+TMzkMrCSsG7DJm29wQFovEV1LfKrptfAjw=
AllowedIPs = 192.168.1.10/32, 192.168.1.11/32, 192.168.1.12, 192.168.1.15/32, 10.222.0.0/24
PersistentKeepalive = 25
Endpoint = www.example.com:51820
[Peer]
# second main peer
PublicKey = aReyDUOGHqhhnqyUJQltfuWw+JoG+KES8DzD1k3CNWE=
AllowedIPs = 10.222.0.3/32
PersistentKeepalive = 25
Endpoint = secondary.ddns.net:51820

And of course, add this new peer to both the primary and secondary wireguard nodes.

[Peer]
# new system comment
PublicKey = +gJ2m3vJmIQzR7AfmBNq6+8+y9gWlISeCsuCgEGvPTM=
AllowedIPs = 10.222.0.102/32
# If needed:
PersistentKeepalive = 25
Endpoint = location.remote.example.com:51820

Start wireguard. If on a non-systemd distro, use a wireguard init script.

sudo update-rc.d wireguard defaults
sudo service wireguard start
# for systemd:
sudo systemctl enable wg-quick@wg0.service
sudo systemctl start wg-quick@wg0.service

Optionally, set up new A record under remote.example.com on server1 with:

updatezone remote.example.com

Quick tray icon for wireguard

bgstack15 — Tue, 28 Dec 2021 14:24:25 GMT

I have been setting up more and more wireguard endpoints for myself. On the most recent, I actually have a desktop environment. I want to control the vpn status from the graphical environment. I use Devuan Ceres and they dropped wicd just like Debian Sid did. I switched over to ConnMan, and so I investigated connman-vpn, but it doesn't have anything to do with wireguard, at least not the version in Ceres. Debian Sid's connman version is 1.36-2.3, and a quick Internet search shows that ConnMan supports wireguard starting with 1.38.

So I wrote a quick and dirty shell script utility that uses mktrayicon. I chose some very simple icons, stylized lower- and upper-case letter "V." I got the icons under a linkware license: https://visualpharm.com/free-icons/v-595b40b65ba036ed117d4d2e.

Here's my file /usr/local/bin/vpn-trayicon

#!/bin/sh
# Startdate: 2021-12-26 21:10
# Reference: keyboard-leds-trayicons
# Documentation:
#    for some stupid reason sudo /usr/local/bin/vpn-on doesn't work, so I just use the real commands here.

clean_vpn_trayicon() {
   { test -e "${vpn_trayicon}" && echo "q" > "${vpn_trayicon}" ; } 1>/dev/null 2>&1 &
   sleep 1 && rm -f "${vpn_trayicon}" "${vpn_KILLFILE}"
}

export vpn_trayicon="/var/run/user/$( id -u )/${$}.vpn.icon"
export vpn_KILLFILE=/tmp/kill-all-vpn-trayicons

test "ON" = "ON" && {
   mkfifo "${vpn_trayicon}"
   mktrayicon "${vpn_trayicon}" &
   echo "m Turn vpn on,sudo wg-quick up wg0|Turn vpn off,sudo wg-quick down wg0|quit,echo 'q' > ${vpn_trayicon} ; touch \"${vpn_KILLFILE}\"" > "${vpn_trayicon}"
   echo "i networkmanager" > "${vpn_trayicon}"
}

rm -f "${vpn_KILLFILE}"

trap 'trap "" 2 ; touch "${vpn_KILLFILE}" '  2 # CTRL-C

while ! test -e "${vpn_KILLFILE}" 2>/dev/null ;
do
   ip -o a s wg0 1>/dev/null 2>&1 ; status_now=$? ;
   if test "${status_now}" != "${status_old}" ;
   then
      test -p "${vpn_trayicon}" && case "${status_now}" in
         0) # vpn is on now
            test -n "${VPN_DEBUG}" && echo "vpn is on (icon file ${vpn_trayicon})" 1>&2
            echo "i /usr/local/share/vpn-on.svg" > "${vpn_trayicon}"
            echo "t vpn is on" > "${vpn_trayicon}"
            ;;
         1) # vpn is off now
            test -n "${VPN_DEBUG}" && echo "vpn is off (icon file ${vpn_trayicon})" 1>&2
            echo "i /usr/local/share/vpn-off.svg" > "${vpn_trayicon}"
            echo "t vpn is off" > "${vpn_trayicon}"
            ;;
      esac
   fi
   status_old="${status_now}"
   sleep 1
done

# safety shutoff
clean_vpn_trayicon

So when I right-click the icon, I can choose "vpn on", "vpn off", or "quit". That's about it.

Extending my vpn to route all my traffic for my vpn clients

bgstack15 — Wed, 10 Mar 2021 14:25:26 GMT

I read on the Internet that you can route all traffic through your vpn to your house to take advantage of everything you already run for your home network. For me, this includes robust ad- blocking, and of course various network services not available to the public. To extend my new, fancy wireguard vpn, I took some extra steps so I could route all traffic through my home network.

On server

On my wireguard "server" (the peer that is at my house) I added firewall rules. At first I fiddled with nftables (which has supplanted iptables), but eventually found that I was supposed to use firewalld on CentOS 8.

sudo firewall-cmd --add-masquerade --permanent

And then set sysctl value to allow forwarding.

sudo sysctl net.ipv4.ip_forward=1

And for permanency, set file /etc/sysctl.d/wg.conf:

net.ipv4.ip_forward = 1

On client

And then add on the Android client the allowed IP address 0.0.0.0/0. The Android app adds the correct routing already!

References

Weblinks

Connecting my mobile phone to my home network for playing media

bgstack15 — Sat, 06 Mar 2021 14:11:04 GMT

I use Plex, which is OK, but I don't like having to depend on an external service to access my own media files. I have successfully set up a VPN to my home network, so that my mobile phone can access my media files from anywhere! I set up WireGuard as a vpn, so VLC on Android can play my files from my nfs server at home!

On Linux server

On my nfs server (CentOS 8), I installed wireguard, the up-and-coming VPN solution that can be included in the Linux kernel! I used method two, using kmod, but from rpmfusion which I already had enabled.

sudo yum install kmod-wireguard wireguard-tools

Then I set up file /etc/wireguard/wg0.conf. There was a template file somewhere with some better notes, but this is the boiled-down version.

[Interface]
Address = 10.222.0.1/24
ListenPort = 51820
# from `wg genkey`
PrivateKey = 123456789009876543211234567890=
# server1 public key, from `echo "${PrivateKey}" | wg pubkey`
# 123456789012345678901234567890=
[Peer]
# my mobile phone's public key, from below instructions
PublicKey = 01982643901625901902283497598275=
AllowedIPs = 10.222.0.2/32
PersistentKeepalive = 25

I chose to save the public key right there in the config file, in case I need to retrieve it often! And then I had to open the firewall, of course.

sudo firewall-cmd --add-port=51820/udp --permanent

I also had to forward port 51820 in my router to my server's IP address. And then I took virtual NIC up!

sudo wg-quick up wg0

Because my plan included accessing NFS with VLC for Android, I needed to add a rule in /etc/exports :

/var/server1/shares 10.222.0.0/24(ro,sync,insecure)

And update the current export list.

sudo exportfs -ra

And to make sure the wireguard interface

On android mobile phone

I installed the official Wireguard app from F-droid. I appreciate how the app lets you configure interfaces and peers in a manner that looks basically identical to the contents of the config file used to define an interface+peers on a full GNU/Linux system! I named the interface, and added my IP address of 10.222.0.2/32. I also listed DNS servers that are on my home network. I hard-coded the listen port to 51820. For the peer, I added the public key from my server1 above. Allowed IPs: 10.222.0.0/24,192.168.1.0/24 As I understand it, the allowed IP addresses indicate what networks will be routed through the VPN. So here I am including the VPN network, and also my home network's main IP network. Endpoint: (my ddns name):51820 Persistent keepalive: 25 seconds.

Conclusion

I don't know how to perform low-level network diagnostics from Android such as ping or netcat, so I really only tested from my server. I pinged the client (once all wireguard interfaces were up on both devices). And for the final test, I was out driving in my car, and I had an opportunity to enable my wireguard interface on my phone, run VLC, and connect to my nfs server and play music! So this was a successful operation (even if it is a bit flaky, due to nfs's dislike of spotty networks). And now I don't need