> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/linux-server-administrator/servers-configurations-debian/wireguard.md).

# WireGuard

## **WireGuard Server Configuration**

This setup configures a server for both **internet access** and **internal access**.

***

#### **Package Installation**

Install WireGuard and required dependencies on both client and server:

```bash
apt install wireguard -y
apt install resolvconf
```

***

#### **Generate Keys**

**Server**\
Generate keys and store them in the `/etc/wireguard` directory:

```bash
wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
```

**Client**\
Generate keys and store them in the `/tmp` directory:

```bash
wg genkey | tee privatekey | wg pubkey > publickey
```

***

#### **Server Configuration**

Create the server configuration file:

```bash
vim /etc/wireguard/wg0.conf
```

**`wg0.conf` Example**

```ini
[Interface]
Address = 10.0.0.1/8 # Tunnel interface
SaveConfig = true
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp0s3 -j MASQUERADE
ListenPort = 51820 # Replace with your listening port
PrivateKey = {server-private-key} # Use /etc/wireguard/privatekey

[Peer]
PublicKey = {client-public-key} # Use /tmp/publickey from client
AllowedIPs = 10.0.0.2/32
```

***

#### **Enable IP Forwarding**

Edit the system configuration file:

```bash
vim /etc/sysctl.conf
```

Uncomment or add the following line:

```bash
net.ipv4.ip_forward=1
```

Apply the changes:

```bash
sysctl -p
```

***

#### **Start the WireGuard Service**

Start the service using one of the following commands:

```bash
systemctl start wg-quick@wg0
# OR
wg-quick up wg0
```

***

#### **Client Configuration**

Create the client configuration file:

```bash
vim /etc/wireguard/client.conf
```

**`client.conf` Example**

```ini
[Interface]
PrivateKey = {client-private-key} # Use /tmp/privatekey
Address = 10.0.0.2/8

[Peer]
PublicKey = {server-public-key} # Use /etc/wireguard/publickey from server
AllowedIPs = 0.0.0.0/0
Endpoint = {server-public-ip}:{port} # Replace with server's public IP and port (e.g., 51820)
PersistentKeepalive = 25
```

Start the client service:

```bash
wg-quick up client
```

***

#### **Log Management**

Add the following rule for logging client activity:

```bash
iptables -A INPUT -p udp --dport 51820 -m state --state NEW -j LOG --log-prefix "WireGuard-Client-IP: " --log-level 4
```

***

## **Internal Access Configuration**

To restrict the setup to internal access only:

**Server Configuration**

**Modify** the following rules in `PostUp` and `PostDown`:

```ini
PostUp = iptables -A FORWARD -i %i -s 10.0.0.2 -d 192.168.1.0/24 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o enp0s3 -s 10.0.0.2 -d 192.168.1.0/24 -j MASQUERADE
PostUp = iptables -A FORWARD -i %i -s 10.0.0.2 -d 0.0.0.0/0 -j REJECT
PostUp = iptables -A FORWARD -i %i -s 10.0.0.2 -d 10.0.0.0/8 -j ACCEPT
PostUp = iptables -A FORWARD -i %i -s 10.0.0.2 -d 192.168.1.0/24 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o enp0s3 -s 10.0.0.2 -d 192.168.1.0/24 -j MASQUERADE
PostUp = iptables -A FORWARD -i %i -s 10.0.0.2 -d 0.0.0.0/0 -j REJECT
PostUp = iptables -A FORWARD -i %i -s 10.0.0.2 -d 10.0.0.0/8 -j ACCEPT
```

**Client Configuration**

**Modify** the `AllowedIPs` directive:

```ini
AllowedIPs = 192.168.1.0/24
```

***

#### **Reference**

{% embed url="<https://www.youtube.com/watch?v=bVKNSf1p1d0>" %}