WireGuard

[blackchestnut]

Install WireGuard on Ubuntu

sudo apt update
sudo apt install wireguard -y

Create the configuration directory

sudo mkdir -p /etc/wireguard
sudo cd /etc/wireguard
sudo umask 077
sudo wg genkey | sudo tee privatekey | sudo wg pubkey | sudo tee publickey

Create the WireGuard configuration file

sudo vim /etc/wireguard/wg0.conf

Add the following configuration, replacing the placeholders with your specific details:

[Interface]
PrivateKey = <ServerPrivateKey>
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = ufw route allow in on wg0 out on eth0
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = ufw route delete allow in on wg0 out on eth0
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <ClientPublicKey>
AllowedIPs = 10.0.0.2/32

• Replace <ServerPrivateKey> with the server's private key.
• Replace <ClientPublicKey> with the public key from the client device (which you'll generate later).
• Address is the IP range for the VPN network (you can adjust as needed).
• ListenPort is the port WireGuard will listen on (default is 51820).

Enable IP forwarding:

sudo vim /etc/sysctl.conf

Uncomment or add the following line:

net.ipv4.ip_forward=1

Apply the changes:

sudo sysctl -p

Start and enable the WireGuard interface:

sudo wg-quick up wg0
sudo systemctl enable wg-quick@wg0

Install the WireGuard Client (macOS or/and iOS)

www.wireguard.com/install/

Generate the client keys (on your server or client device):

wg genkey | tee client_privatekey | wg pubkey | tee client_publickey

Create the client configuration file:

On your Mac or iOS device, create a new WireGuard configuration file (client.conf) with the following content:

[Interface]
PrivateKey = <ClientPrivateKey>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <ServerPublicKey>
Endpoint = <YourServerIP>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

• Replace <ClientPrivateKey> with the client's private key.
• Replace <ServerPublicKey> with the server's public key.
• Replace <YourServerIP> with the public IP address of your server.

Import the configuration on macOS or iOS:

On macOS, open WireGuard, import the configuration file, and activate the VPN.

Create Tunnel from QR code

Install qrencode on server

sudo apt install qrencode -y

Create the WireGuard Client Configuration

[Interface]
PrivateKey = <ClientPrivateKey>
Address = 10.0.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = <ServerPublicKey>
Endpoint = <YourServerIP>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Replace the placeholders (<ClientPrivateKey>, <ServerPublicKey>, and <YourServerIP>) with your actual keys and server IP.

Save this configuration file as client.conf on your server.

Generate the QR Code

sudo qrencode -t ansiutf8 < client.conf

This will display a QR code in your terminal that you can scan with the WireGuard app on your iPhone.