October 16, 20196 yr Note: this community guide is offered in the hope that it is helpful, but comes with no warranty/guarantee/etc. Follow at your own risk. This guide explains how to make an outgoing WireGuard VPN connection to a commercial VPN provider. If you are trying to access your Unraid network from a remote location, see the original WireGuard quickstart guide. Commerical VPN Providers Several commercial VPN providers support WireGuard, a few are listed below. No endorsement is implied, you need to research and determine which one meets your needs. Comment below if you are aware of others: VPN Jantit (Free! Scroll down and pick a location. Note that the free options have to be recreated every few days.) Azire VPN Mullvad (download WireGuard config files - requires login. See this tip.) IVPN (download WireGuard config files - requires login) OVPN Windscribe (See this) Avoid these providers, they require a customized WireGuard client and will not work with Unraid: TunSafe (this seems to require a custom WireGuard client now) Nord (see this) PIA (see this, although with a lot of extra work it is possible. This definitely falls outside of what could be considered supported though. Also see this.) Note that with the current state of WireGuard, VPN providers cannot guarantee the same amount of privacy as they can with OpenVPN. See: https://restoreprivacy.com/wireguard/ Typically the objections are not around security, but around the fact that it is harder for them to guarantee that they cannot track you. Configuring “VPN tunneled access for docker” (New in 6.10.0-rc5! For older versions see the next post) Download a config file from your preferred commercial VPN provider On the Settings -> VPN Manager page, click the "Import Config" button and select the file on your hard drive. This will create a new tunnel specific to this provider. The “Peer type of access” will default to “VPN tunneled access for docker”. There are no settings to change, except perhaps to give it a local name. Click Apply. Note: You do not need to forward any ports through your router for this type of connection Change the Inactive slider to Active Take note the name of this tunnel, it will be wg0 or wg1 or wg2, etc. You'll need this later when setting up your containers Also note that any DNS setting the Commercial VPN provides is not imported. Open their config file and see if there is a "DNS" entry, make note of the server they provided, you will use it below. If they didn't provide one, you may want to use Google's at 8.8.8.8. Testing the tunnel Note: The "VPN tunneled access for docker" tunnel includes a kill switch - if the tunnel drops then any containers using that tunnel will lose access to the Internet. Important! Prior to Unraid 6.11.2, you must take care to start the WireGuard tunnel *before* the Docker container in order for the kill switch to work. If the docker container is started first, it will use the server's default Internet connection. That is no longer an issue for tunnels created/updated after installing Unraid 6.11.2. Using Community Applications, install a Firefox Docker container When setting up the container, set the “Network Type” to “Custom: wg2” (or whatever the name of the tunnel was in the previous step) Switch to Advanced view and add your preferred DNS provider to the "Extra Parameters". i.e.: --dns=8.8.8.8 (if you don't set this, the container may leak your ISP's DNS server) The rest of the defaults should be fine, apply the changes and start the container Launch Firefox and visit https://whatismyipaddress.com/ you should see that your IP address is in the country you selected when you signed up with the provider Also visit https://www.dnsleaktest.com/ and run a test, confirm that it only finds IPs related to the DNS provider you specified. Feel free to add more containers to this same tunnel, or create multiple tunnels if desired.
October 16, 20196 yr Author Configuring “VPN tunneled access for system” (6.10.0-rc5 and later) or “VPN tunneled access” (6.10.0-rc4 and earlier) Download a config file from your preferred commercial VPN provider On the Settings -> VPN Manager page, click the "Import Config" button and select the file on your hard drive. This will create a new tunnel specific to this provider. There are no settings to change, except perhaps to give it a name. Click Apply. Note: You do not need to forward any ports through your router for this type of connection Change the Inactive slider to Active Now ALL of your Unraid traffic will go through the commercial VPN tunnel. You may need to disable the tunnel in order to check for plugin updates or perform other Unraid administrative tasks. Since ALL traffic is routed through this tunnel, you cannot start a second tunnel while this one is enabled. Note that currently Unraid will ignore any DNS server that is specified in the downloaded config file. Unraid's DNS should be set to something that will work whether the tunnel is up or down, such as 8.8.8.8 and 8.8.4.4 Testing the tunnel Using Community Applications, install a Firefox Docker container Accept all defaults Launch Firefox and visit https://whatismyipaddress.com/ you should see that your IP address is in the country you selected when you signed up with the provider
October 28, 20196 yr Hi guys, Nordvpn was not mentioned up top. From what I'm seeing they are actively involved with WireGuard. Not sure if they are totally done testing. From what they have developed to enable use with WireGuard I would personally trust them first. That's just my opinion. In all honesty not sure if any of this new development with WireGuard can be fully trusted right now. It does need people testing it to find out. https://nordvpn.com/blog/nordlynx-protocol-wireguard/
October 29, 20196 yr Author 10 hours ago, Badboy said: Nordvpn was not mentioned up top. Am I wrong or does their implementation require you to use their NordLynx client? If so that won't work with the standard WireGuard client that we use. If you can provide a link that shows how to download a standard WireGuard config file, I'll link to that.
October 29, 20196 yr You are right, from the looks of it you have to use their NordLynx. I think at some point they may change this. I just thought it was interesting that they implemented additional security measures so it's usable to some Linux clients that want to try it. As of now WireGuard will still have some security issues, which is understandable because it is still in development. Good to see a company like Nordvpn jump on board. It means the future looks bright for WireGuard. Sorry, maybe a wasted post for this forum. I use Nordvpn myself so I just thought I would post the info.
November 5, 20196 yr TorGuard VPN also supports WireGuard: https://torguard.net/blog/what-is-wireguard-vpn/ Now if I could only figure out how to configure unraid to work with it, then I'd be golden. The steps above doesn't seem to work with TorGuard's import config by default unfortunately.
November 8, 20196 yr On 11/4/2019 at 8:24 PM, BoarAnt said: TorGuard VPN also supports WireGuard: https://torguard.net/blog/what-is-wireguard-vpn/ Now if I could only figure out how to configure unraid to work with it, then I'd be golden. The steps above doesn't seem to work with TorGuard's import config by default unfortunately. Yep, I am running into the same problem with TorGuard. Their config does not seem to work out-of-the-box.
November 8, 20196 yr Author On 11/4/2019 at 5:24 PM, BoarAnt said: TorGuard VPN also supports WireGuard: https://torguard.net/blog/what-is-wireguard-vpn/ Now if I could only figure out how to configure unraid to work with it, then I'd be golden. The steps above doesn't seem to work with TorGuard's import config by default unfortunately. 1 hour ago, Mantene said: Yep, I am running into the same problem with TorGuard. Their config does not seem to work out-of-the-box. Try getting a free config from TunSafe and comparing them to see what is different? Also note the comment about DNS in the OP
November 8, 20196 yr So, here is a TunSafe config: [Interface] PrivateKey = ************************************ Address = 10.34.234.162/8 DNS = 1.1.1.1 [Peer] PublicKey = ****************************************** Endpoint = 190.2.141.162:51840 AllowedIPs = 0.0.0.0/0 And here is the TorGuard config: # TorGuard WireGuard Config [Interface] PrivateKey = ********************************************* ListenPort = 51820 DNS = 1.1.1.1 Address = 10.29.1.64/24 [Peer] PublicKey = ************************************************** AllowedIPs = 0.0.0.0/0 Endpoint = 159.65.247.35:443 PersistentKeepalive = 25 So, what is going on? Any ideas?
November 9, 20196 yr Remove the "ListenPort" in the TorGuard config, it is not needed/used because the peer will always initiate the connection.
November 9, 20196 yr Unfortunately, that did not solve the problem. When I try to turn it on the active/inactive switch just keeps flashing on and off really fast!
November 9, 20196 yr Did you create a new (WG1) tunnel for this connection? In other words do not add this as another peer to an existing tunnel (WG0) Set all other tunnels inactive when using VPN tunneled access Edited November 9, 20196 yr by bonienl
November 9, 20196 yr importing a conf file automatically creates wg1. And I made sure wg0 was turned off before trying this.
November 9, 20196 yr 3 hours ago, Mantene said: When I try to turn it on the active/inactive switch just keeps flashing on and off really fast! Disable UPnP, see advanced settings.
November 10, 20196 yr 10 hours ago, bonienl said: Disable UPnP, see advanced settings. I disabled UPnP globally under Settings > Management Access, switched back to VPN Manager, got the popup message saying "UPnP stated changed to OFF", verified that the Tunnel's "Local gateway uses UPnP" setting is No, and tried to activate the tunnel... It's still alternating between active/inactive quickly. Any other ideas?
November 10, 20196 yr UPNP is off. I updated the plugin. I imported the TorGuard conf. It still doesn't work, though the active switch no longer flashes. It switches to Active, but once you reload the page or navigate away and then go back to vpn settings, it is off. Are there log files I can send you? Here is a screenshot of what the imported tunnel looks like.
November 10, 20196 yr I miss a couple of mandatory fields. These should be present in the config file generated by TorGuard Local private key - generated by TorGuard Peer public key - generated by TorGuard Peer endpoint - this is the URL of the TorGuard VPN access Peer allowed IPs - this should be 0.0.0.0/0 Here is a screenshot of my VPN connection Edited November 10, 20196 yr by bonienl
November 10, 20196 yr As posted above, here is a comparison: So, here is a TunSafe config: [Interface] PrivateKey = ************************************ Address = 10.34.234.162/8 DNS = 1.1.1.1 [Peer] PublicKey = ****************************************** Endpoint = 190.2.141.162:51840 AllowedIPs = 0.0.0.0/0 And here is the TorGuard config: # TorGuard WireGuard Config [Interface] PrivateKey = ********************************************* ListenPort = 51820 DNS = 1.1.1.1 Address = 10.29.1.64/24 [Peer] PublicKey = ************************************************** AllowedIPs = 0.0.0.0/0 Endpoint = 159.65.247.35:443 PersistentKeepalive = 25 Oh, and I removed the ListenPort from the TorGuard conf before importing it. Edited November 10, 20196 yr by Mantene
November 11, 20196 yr The config files look alright, but in your screenshots there are missing mandatory fields. Did you remove those fields or they are not populated after importing the config file? What happens when all fields are filled in (see also my screenshot)?
November 11, 20196 yr 7 hours ago, bonienl said: The config files look alright, but in your screenshots there are missing mandatory fields. Did you remove those fields or they are not populated after importing the config file? What happens when all fields are filled in (see also my screenshot)? Ok. So I did some experimenting last night and got it to work. This did not work: # TorGuard WireGuard Config [Interface] PrivateKey = ********************************************* DNS = 1.1.1.1 Address = 10.29.1.64/24 [Peer] PublicKey = ************************************************** AllowedIPs = 0.0.0.0/0 Endpoint = 159.65.247.35:443 PersistentKeepalive = 25 This worked: [Interface] PrivateKey = ********************************************* DNS = 1.1.1.1 Address = 10.29.1.64/24 [Peer] PublicKey = ************************************************** Endpoint = 159.65.247.35:443 AllowedIPs = 0.0.0.0/0 Why?
November 11, 20196 yr 9 hours ago, bonienl said: The config files look alright, but in your screenshots there are missing mandatory fields. Did you remove those fields or they are not populated after importing the config file? What happens when all fields are filled in (see also my screenshot)? To answer your question, no, those fields are not populated during the config file import.
November 12, 20196 yr Following Mantene's suggestion, I also got it to work tonight by removing the comment at the top and removing any empty lines between the [Interface] and [Peer] entries. Importing the original config untouched ---------------------------------------------------------------------------------- # TorGuard WireGuard Config [Interface] PrivateKey = yyyyyyyyyyyyyyyyyyyyyy ListenPort = 51820 DNS = 1.1.1.1 Address = 10.29.1.55/24 [Peer] PublicKey = xxxxxxxxxxxxxxxxxxxxx AllowedIPs = 0.0.0.0/0 Endpoint = 111.111.111.111:443 PersistentKeepalive = 25 ---------------------------------------------------------------------------------- would give me 4 sections total: whereas the more compact version ---------------------------------------------------------------------------------- [Interface] PrivateKey = yyyyyyyyyyyyyyyyyyyyyy ListenPort = 51820 DNS = 1.1.1.1 Address = 10.29.1.55/24 [Peer] PublicKey = xxxxxxxxxxxxxxxxxxxxx AllowedIPs = 0.0.0.0/0 Endpoint = 111.111.111.111:443 PersistentKeepalive = 25 ---------------------------------------------------------------------------------- would give me 2 sections: The 2nd version was connecting fine, so I think it's just the import config parser that's messing up the setup. Thanks. Edited November 12, 20196 yr by BoarAnt
November 12, 20196 yr 22 minutes ago, BoarAnt said: The 2nd version was connecting fine, so I think it's just the import config parser that's messing up the setup. Yes, you are right. The import parser went wrong on the comment statement(s). I have made an update with the fix. Thanks.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.