WireGuard - VPN Tunneled Access to a commercial VPN provider


ljm42

98 posts in this topic Last Reply

Recommended Posts

Note: this community guide is offered in the hope that it is helpful, but comes with no warranty/guarantee/etc. Follow at your own risk.

 

This guide explains how to make an outgoing WireGuard VPN connection to a commercial VPN provider. If you are trying to access your Unraid network from a remote location, see the original WireGuard quickstart guide.

 

 

Commerical VPN Providers

Several commercial VPN providers support WireGuard, a few are listed below. No endorsement is implied, you need to research and determine which one meets your needs. Comment below if you are aware of others:

 

Avoid these providers, they require a customized WireGuard client and will not work with Unraid:

  • Nord (see this)
  • PIA (see this, although with a lot of extra work it is possible. This definitely falls outside of what could be considered supported though)

 

Note that with the current state of WireGuard, VPN providers cannot guarantee the same amount of privacy as they can with OpenVPN. See:

  https://restoreprivacy.com/wireguard/ 

Typically the objections are not around security, but around the fact that it is harder for them to guarantee that they cannot track you.

 

Configuring VPN tunneled access

  • Download a config file from your preferred commercial VPN provider
  • On the Settings -> VPN Manager page, click the "Import Config" button and select the file on your hard drive. This will create a new tunnel specific to this provider.
  • There are no settings to change, except perhaps to give it a name. Click Apply.
  • Note: You do not need to forward any ports through your router for this type of connection
  • Change the Inactive slider to Active
  • Now ALL of your Unraid traffic will go through the commercial VPN tunnel.  
    • In the future it may be possible to restrict it so that only specific Dockers use the VPN tunnel.  Until then, you may need to disable the tunnel in order to check for plugin updates or perform other Unraid administrative tasks.
    • Since ALL traffic is routed through this tunnel, you cannot start a second tunnel while this one is enabled.
    • Note that currently Unraid will ignore any DNS server that is specified in the downloaded config file. Unraid's DNS should be set to something that will work whether the tunnel is up or down, such as 8.8.8.8 and 8.8.4.4

 

Testing the tunnel

  • Using Community Applications, install a browser such as the jlesage/Firefox Docker container
  • Accept all defaults
  • Launch Firefox and visit https://whatismyipaddress.com/ you should see that your IP address is in the country you selected when you signed up with the provider
  • Like 3
  • Thanks 1
Link to post
  • Replies 97
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Popular Posts

Note: this community guide is offered in the hope that it is helpful, but comes with no warranty/guarantee/etc. Follow at your own risk.   This guide explains how to make an outgoing WireGua

Yes, you are right. The import parser went wrong on the comment statement(s). I have made an update with the fix.   Thanks.

I made another update, version 2019.11.12c  

Posted Images

  • 2 weeks later...

Hi guys,

 

Nordvpn was not mentioned up top. From what I'm seeing they are actively involved with WireGuard. Not sure if they are totally done testing.  From what they have developed to enable use with WireGuard I would personally trust them first. That's just my opinion. In all honesty not sure if any of this new development with WireGuard can be fully trusted right now. It does need people testing it to find out.

 

https://nordvpn.com/blog/nordlynx-protocol-wireguard/

Link to post
10 hours ago, Badboy said:

Nordvpn was not mentioned up top.

Am I wrong or does their implementation require you to use their NordLynx client? If so that won't work with the standard WireGuard client that we use. If you can provide a link that shows how to download a standard WireGuard config file, I'll link to that.

Link to post

You are right, from the looks of it you have to use their NordLynx. I think at some point they may change this. I just thought it was interesting that they implemented additional security measures so it's usable to some Linux clients that want to try it.  As of now WireGuard will still have some security issues, which is understandable because it is still in development. Good to see a company like Nordvpn jump on board. It means the future looks bright for WireGuard.  Sorry, maybe a wasted post for this forum. I use Nordvpn myself so I just thought I would post the info.

Link to post
On 11/4/2019 at 8:24 PM, BoarAnt said:

TorGuard VPN also supports WireGuard: https://torguard.net/blog/what-is-wireguard-vpn/

 

Now if I could only figure out how to configure unraid to work with it, then I'd be golden. The steps above doesn't seem to work with TorGuard's import config by default unfortunately.

Yep, I am running into the same problem with TorGuard. Their config does not seem to work out-of-the-box.

Link to post
On 11/4/2019 at 5:24 PM, BoarAnt said:

TorGuard VPN also supports WireGuard: https://torguard.net/blog/what-is-wireguard-vpn/

 

Now if I could only figure out how to configure unraid to work with it, then I'd be golden. The steps above doesn't seem to work with TorGuard's import config by default unfortunately.

 

1 hour ago, Mantene said:

Yep, I am running into the same problem with TorGuard. Their config does not seem to work out-of-the-box.

 

Try getting a free config from TunSafe and comparing them to see what is different?

 

Also note the comment about DNS in the OP

Link to post

So, here is a TunSafe config:

[Interface]
PrivateKey = ************************************
Address = 10.34.234.162/8
DNS = 1.1.1.1

[Peer]
PublicKey = ******************************************
Endpoint = 190.2.141.162:51840
AllowedIPs = 0.0.0.0/0
 

And here is the TorGuard config:

# TorGuard WireGuard Config
[Interface]
PrivateKey = *********************************************
ListenPort = 51820
DNS = 1.1.1.1
Address = 10.29.1.64/24

[Peer]
PublicKey = **************************************************
AllowedIPs = 0.0.0.0/0
Endpoint = 159.65.247.35:443
PersistentKeepalive = 25

 

 

So, what is going on? Any ideas? 

Link to post

Did you create a new (WG1) tunnel for this connection?

In other words do not add this as another peer to an existing tunnel (WG0)

 

Set all other tunnels inactive when using VPN tunneled access

Edited by bonienl
Link to post
10 hours ago, bonienl said:

Disable UPnP, see advanced settings.

I disabled UPnP globally under Settings > Management Access, switched back to VPN Manager, got the popup message saying "UPnP stated changed to OFF", verified that the Tunnel's "Local gateway uses UPnP" setting is No, and tried to activate the tunnel... It's still alternating between active/inactive quickly. :'(

 

Any other ideas? :)

Link to post

UPNP is off. I updated the plugin. I imported the TorGuard conf. It still doesn't work, though the active switch no longer flashes. It switches to Active, but once you reload the  page or navigate away and then go back to vpn settings, it is off. Are there log files I can send you? Here is a screenshot of what the imported tunnel looks like.

 

torguard1.png

torguard2.png

Link to post

I miss a couple of mandatory fields. These should be present in the config file generated by TorGuard

  1. Local private key - generated by TorGuard
  2. Peer public key - generated by TorGuard
  3. Peer endpoint - this is the URL of the TorGuard VPN access
  4. Peer allowed IPs - this should be 0.0.0.0/0

 

Here is a screenshot of my VPN connection

image.thumb.png.339df53fc7091cfcb8ab3401b575b71b.png

Edited by bonienl
Link to post

As posted above, here is a comparison:

So, here is a TunSafe config:

[Interface]
PrivateKey = ************************************
Address = 10.34.234.162/8
DNS = 1.1.1.1

[Peer]
PublicKey = ******************************************
Endpoint = 190.2.141.162:51840
AllowedIPs = 0.0.0.0/0
 

And here is the TorGuard config:

# TorGuard WireGuard Config
[Interface]
PrivateKey = *********************************************
ListenPort = 51820
DNS = 1.1.1.1
Address = 10.29.1.64/24

[Peer]
PublicKey = **************************************************
AllowedIPs = 0.0.0.0/0
Endpoint = 159.65.247.35:443
PersistentKeepalive = 25

 

 

Oh, and I removed the ListenPort from the TorGuard conf before importing it.

Edited by Mantene
Link to post

The config files look alright, but in your screenshots there are missing mandatory fields.

Did you remove those fields or they are not populated after importing the config file?

 

What happens when all fields are filled in (see also my screenshot)?

Link to post
7 hours ago, bonienl said:

The config files look alright, but in your screenshots there are missing mandatory fields.

Did you remove those fields or they are not populated after importing the config file?

 

What happens when all fields are filled in (see also my screenshot)?

Ok. So I did some experimenting last night and got it to work. 

 

This did not work:

# TorGuard WireGuard Config
[Interface]
PrivateKey = *********************************************
DNS = 1.1.1.1
Address = 10.29.1.64/24

[Peer]
PublicKey = **************************************************
AllowedIPs = 0.0.0.0/0
Endpoint = 159.65.247.35:443
PersistentKeepalive = 25

 

This worked:

[Interface]
PrivateKey = *********************************************
DNS = 1.1.1.1
Address = 10.29.1.64/24

[Peer]
PublicKey = **************************************************

Endpoint = 159.65.247.35:443
AllowedIPs = 0.0.0.0/0

 

 

Why?

Link to post
9 hours ago, bonienl said:

The config files look alright, but in your screenshots there are missing mandatory fields.

Did you remove those fields or they are not populated after importing the config file?

 

What happens when all fields are filled in (see also my screenshot)?

To answer your question, no, those fields are not populated during the config file import.

Link to post

Following Mantene's suggestion, I also got it to work tonight by removing the comment at the top and removing any empty lines between the [Interface] and [Peer] entries.

 

Importing the original config untouched

----------------------------------------------------------------------------------

# TorGuard WireGuard Config

[Interface]

PrivateKey = yyyyyyyyyyyyyyyyyyyyyy

ListenPort = 51820

DNS = 1.1.1.1

Address = 10.29.1.55/24

 

[Peer]

PublicKey = xxxxxxxxxxxxxxxxxxxxx

AllowedIPs = 0.0.0.0/0

Endpoint = 111.111.111.111:443

PersistentKeepalive = 25

----------------------------------------------------------------------------------

would give me 4 sections total:

ss1.thumb.png.000c09f50ffdd349389859250fbe781c.png

 

whereas the more compact version

----------------------------------------------------------------------------------

[Interface]

PrivateKey = yyyyyyyyyyyyyyyyyyyyyy

ListenPort = 51820

DNS = 1.1.1.1

Address = 10.29.1.55/24

[Peer]

PublicKey = xxxxxxxxxxxxxxxxxxxxx

AllowedIPs = 0.0.0.0/0

Endpoint = 111.111.111.111:443

PersistentKeepalive = 25

----------------------------------------------------------------------------------

would give me 2 sections:

ss2.thumb.png.7c4e02020d0d7834efed3864e5af204d.png

 

The 2nd version was connecting fine, so I think it's just the import config parser that's messing up the setup.

 

Thanks.

Edited by BoarAnt
Link to post
22 minutes ago, BoarAnt said:

The 2nd version was connecting fine, so I think it's just the import config parser that's messing up the setup.

Yes, you are right. The import parser went wrong on the comment statement(s).

I have made an update with the fix.

 

Thanks.

  • Like 1
  • Thanks 1
Link to post
  • ljm42 changed the title to WireGuard - VPN Tunneled Access to a commercial VPN provider
  • itimpi pinned this topic

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.