31
votes
How to see debug logs for WireGuard (e.g. to see authentication attempts)
Assuming you are running a kernel which supports dynamic debugging, you can enable debug logs by executing:
# modprobe wireguard
# echo module wireguard +p > /sys/kernel/debug/dynamic_debug/...
- 9,186
12
votes
Accepted
Wireguard not completing handshake
It might be stupid, but did you try to create new server keys, client keys, and retry? Wireguard can act exactly like this when the profiles are wrong.
- 1,180
8
votes
Ubuntu 18.04.1, cannot add PPA wireguard/ubuntu/wireguard
Info from https://launchpad.net/~wireguard : This formerly was responsible for producing a PPA for WireGuard on Ubuntu. That functionality has now been folded into Ubuntu itself, so our old PPA has ...
- 81
7
votes
Accepted
Make wireguard listen on multiple port
Something like this should do the trick
iptables -t nat -I PREROUTING -i eth0 -d <yourIP/32> -p udp -m multiport --dports 53,80,4444 -j REDIRECT --to-ports 15351
- 115k
7
votes
Cannot setup WireGuard VPN
Use wg-quick instead of wg with the config file and it would work ;-). You wrote you are using directly wg command which uses a different configuration file format, resulting in the error:
Line ...
- 1,622
7
votes
Wireguard Client Addition without restart
You can use wg conjointly with wg-quick. wg is a lower-level command, actually the one used by wg-quick to really do WireGuard-specific configuration on the interface (along various ip xxx commands ...
- 10.4k
6
votes
Accepted
Wiregurard override wg0.conf
Solved the issue. The magic trick: always stop the Interface with wg-quick down wg0 before editing the wg0.conf File. systemctl stop wg-quick@wg0.service will override the wg0.conf File after the next ...
- 545
6
votes
Accepted
Wireguard VPN can't access internet and LAN
Needed PostUp and PostDown lines in wireguard.conf:
[Interface]
Address = 10.0.0.1/24
SaveConfig = true
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t ...
6
votes
Wireguard not completing handshake
OK, you mentioned that the client is on VDSL, so I suspect you have an MTU problem.
The normal MTU of a wired (and these days, wireless) network connection is 1500 bytes, but on *DSL the PPPoE layer ...
- 242k
5
votes
Accepted
Cannot setup WireGuard VPN
Well, in several of days, nights, and killed servers, I solved all the problems myself :)
Firstly, I'd like to mention that wg and wg-quick utilities treats config files differently. So, my wg ...
- 283
5
votes
Accepted
Port forwarding with wireguard
Since you're using UFW, first make sure the UFW rule for port 56000 that you added is not a regular input rule, but instead a "route" (aka forwarding) rule, like this (assuming it's for a ...
- 1,186
5
votes
Accepted
How can I convert a wireguard vpn config file to openvpn?
You cannot do this, WireGuard is not OpenVPN, OpenVPN is not WireGuard they are different things that are only related by being VPNs.
- 115k
4
votes
WireGuard user authentication
Each side of the tunnel has its own generated key and derived public key (defined as "peer" on the other side of the connection). To act as you are writing, you would need to share the ...
- 1,622
4
votes
Accepted
Is it possible to disable default gateway in WireGuard VPN client?
Instead of specifying AllowedIPs = 0.0.0.0/0 specify an ip address.
Ran into this question wondering the same thing. The use case detailed here pointed me in the right direction: https://emanuelduss....
- 56
4
votes
Accepted
the wireguard not listening on port after started
I will assume that this is done on Linux, since not told otherwise and because of container context.
The description of lsof tells:
DESCRIPTION
Lsof revision 4.91 lists on its standard output ...
- 10.4k
4
votes
How to configure FreeNAS for a WireGuard VPN?
In addition to WireGuard also enable the FreeBSD packet filter pf using rc.conf tunables:
wireguard_enable="YES"
wireguard_interfaces="wg0"
pf_enable="YES"
pf_rules="/usr/local/etc/pf.conf"
...
- 585
4
votes
Wireguard - How to only tunnel some of the traffic
You can use iptables.
Replace eth0 with the network interface that connects to the internet and 10.6.0.1/24 with your client subnet.
Insert this somewhere in your Wireguard config below [INTERFACE]
# ...
- 71
4
votes
Accepted
WireGuard & UFW : UFW blocks traffic on wg0, even if a rule allows it
The log shows two interfaces: IN=wg0 OUT=eth0. That means it's routed/forwarded traffic and not traffic with the node as destination, where OUT= would be empty. It translates in the backend (iptables) ...
- 10.4k
4
votes
Accepted
Enabling wireguard log messages with secure boot / kernel lockdown enabled
To temporary enable wireguard kernel log messages, execute:
sudo modprobe -r wireguard && sudo modprobe wireguard dyndbg
reference: https://www.kernel.org/doc/html/v5.0/admin-guide/dynamic-...
- 877
3
votes
Cannot setup WireGuard VPN
Ok solved the wireguard "Line unrecognized Address=" with wg show wg0
NOT using wg-quick.
Just removed/commented the line in config Address = x.x.x.x in /etc/wireguard/wg0.conf
My setup on ...
- 768
3
votes
Accepted
Wireguard as VM bridge without hypervisor visible on VPN
Wireguard works at layer 3 (routed IP packet) while a bridge works at layer 2 (switched ethernet frame). So wireguard can't do this. This question was already asked and an answer made by wireguard's ...
- 10.4k
3
votes
WireGuard user authentication
To expand upon @Securez's suggestion, what about combining something like SSH with Wireguard? The idea here would be that SSH provides the desired "authentication" service, while Wireguard ...
- 321
3
votes
WireGuard user authentication
As @Kamil says, WireGuard's concept is a bit different than other VPN solutions. I also started using it not a long time ago, and if you want to implement something that uses existing authentication, ...
- 51
3
votes
How to forward/route packets via wireguard overlay network?
Here is a working configuration. Phew, I actually got it myself, but it took me a while to get things right.
Client
I had to make sure that the peer (VPN Server) is allowed to use the 192.168.178.0/24 ...
- 413
3
votes
Accepted
Wireguard Unable to Complete Handshake on Android only 4G network
MASQUERADE/POSTROUTING rules do not change where certain traffics go. Routes do. The problem is that you have a default route (or what's equivalent) that leads traffics into the pia tunnel.
You will ...
- 722
3
votes
Accepted
IPv6 network for WireGuard VPN
Get an IPv6 allocation from your ISP or RIR.
Define an address plan to cover the number of /64s you need, as far forward as you can project. The smallest you should ask for is a /48, a typical size ...
- 31.4k
3
votes
Accepted
Firewalld Forwarding Functionality with Wireguard
From your previous UFW question, sounds like you're using WireGuard for two purposes?: 1) forward traffic from a WireGuard client of your VPS out to the Internet, and 2) forward a few public ports ...
- 1,186
3
votes
Accepted
Remote mysql server in docker container - access using macvlan and wireguard?
What you can do is you can expose your port (3306) only on the internal ip, accessible via wireguard, such as the tunnel ip (as opposed to exposing it on all ips (0.0.0.0/0), as it happens by default)....
- 710
3
votes
Accepted
Route all traffic through Wireguard peer
You should probably start with using Table=off in the wg-quick conf on both S and P. The value of AllowedIPs= will not cause changes to the routes / policy routing rules on them then.
EDIT: Actually ...
- 722
3
votes
Accepted
QNAP QTS v5 OpenVPN to Wireguard server migration
In order to switch from OpenVPN to WireGuard, there are a few main differences one has to know:
Wireguard is not a "server with users that login" but rather a set of computers that connect ...
- 305
Only top scored, non community-wiki answers of a minimum length are eligible