Jump to content
ljm42

WireGuard - VPN Tunneled Access

34 posts in this topic Last Reply

Recommended Posts

Note: this community guide is offered in the hope that it is helpful, but comes with no warranty/guarantee/etc. Follow at your own risk.

 

This guide explains how to make an outgoing WireGuard VPN connection to a commercial VPN provider. If you are trying to access your Unraid network from a remote location, see the original WireGuard quickstart guide.

 

 

Commerical VPN Providers

Several commercial VPN providers support WireGuard, a few are listed below. No endorsement is implied, you need to research and determine which one meets your needs. Comment below if you are aware of others:

 

Note that with the current state of WireGuard, VPN providers cannot guarantee the same amount of privacy as they can with OpenVPN. See:

  https://restoreprivacy.com/wireguard/ 

Typically the objections are not around security, but around the fact that it is harder for them to guarantee that they cannot track you.

 

Configuring VPN tunneled access

  • Download a config file from your preferred commercial VPN provider
  • On the Settings -> VPN Manager page, click the "Import Config" button and select the file on your hard drive. This will create a new tunnel specific to this provider.
  • There are no settings to change, except perhaps to give it a name. Click Apply.
  • Note: You do not need to forward any ports through your router for this type of connection
  • Change the Inactive slider to Active
  • Now ALL of your Unraid traffic will go through the commercial VPN tunnel.  
    • In the future it may be possible to restrict it so that only specific Dockers use the VPN tunnel.  Until then, you may need to disable the tunnel in order to check for plugin updates or perform other Unraid administrative tasks.
    • Note that currently Unraid will ignore any DNS server that is specified in the downloaded config file. Unraid's DNS should be set to something that will work whether the tunnel is up or down, such as 8.8.8.8 and 8.8.4.4

 

Testing the tunnel

  • Using Community Applications, install a browser such as the jlesage/Firefox Docker container
  • Accept all defaults
  • Launch Firefox and visit https://whatismyipaddress.com/ you should see that your IP address is in the country you selected when you signed up with the provider
Edited by ljm42

Share this post


Link to post

Hi guys,

 

Nordvpn was not mentioned up top. From what I'm seeing they are actively involved with WireGuard. Not sure if they are totally done testing.  From what they have developed to enable use with WireGuard I would personally trust them first. That's just my opinion. In all honesty not sure if any of this new development with WireGuard can be fully trusted right now. It does need people testing it to find out.

 

https://nordvpn.com/blog/nordlynx-protocol-wireguard/

Share this post


Link to post
10 hours ago, Badboy said:

Nordvpn was not mentioned up top.

Am I wrong or does their implementation require you to use their NordLynx client? If so that won't work with the standard WireGuard client that we use. If you can provide a link that shows how to download a standard WireGuard config file, I'll link to that.

Share this post


Link to post

You are right, from the looks of it you have to use their NordLynx. I think at some point they may change this. I just thought it was interesting that they implemented additional security measures so it's usable to some Linux clients that want to try it.  As of now WireGuard will still have some security issues, which is understandable because it is still in development. Good to see a company like Nordvpn jump on board. It means the future looks bright for WireGuard.  Sorry, maybe a wasted post for this forum. I use Nordvpn myself so I just thought I would post the info.

Share this post


Link to post
On 11/4/2019 at 8:24 PM, BoarAnt said:

TorGuard VPN also supports WireGuard: https://torguard.net/blog/what-is-wireguard-vpn/

 

Now if I could only figure out how to configure unraid to work with it, then I'd be golden. The steps above doesn't seem to work with TorGuard's import config by default unfortunately.

Yep, I am running into the same problem with TorGuard. Their config does not seem to work out-of-the-box.

Share this post


Link to post
On 11/4/2019 at 5:24 PM, BoarAnt said:

TorGuard VPN also supports WireGuard: https://torguard.net/blog/what-is-wireguard-vpn/

 

Now if I could only figure out how to configure unraid to work with it, then I'd be golden. The steps above doesn't seem to work with TorGuard's import config by default unfortunately.

 

1 hour ago, Mantene said:

Yep, I am running into the same problem with TorGuard. Their config does not seem to work out-of-the-box.

 

Try getting a free config from TunSafe and comparing them to see what is different?

 

Also note the comment about DNS in the OP

Share this post


Link to post

So, here is a TunSafe config:

[Interface]
PrivateKey = ************************************
Address = 10.34.234.162/8
DNS = 1.1.1.1

[Peer]
PublicKey = ******************************************
Endpoint = 190.2.141.162:51840
AllowedIPs = 0.0.0.0/0
 

And here is the TorGuard config:

# TorGuard WireGuard Config
[Interface]
PrivateKey = *********************************************
ListenPort = 51820
DNS = 1.1.1.1
Address = 10.29.1.64/24

[Peer]
PublicKey = **************************************************
AllowedIPs = 0.0.0.0/0
Endpoint = 159.65.247.35:443
PersistentKeepalive = 25

 

 

So, what is going on? Any ideas? 

Share this post


Link to post

Remove the "ListenPort" in the TorGuard config, it is not needed/used because the peer will always initiate the connection.

Share this post


Link to post

Unfortunately, that did not solve the problem. When I try to turn it on the active/inactive switch just keeps flashing on and off really fast!

Share this post


Link to post

Did you create a new (WG1) tunnel for this connection?

In other words do not add this as another peer to an existing tunnel (WG0)

 

Set all other tunnels inactive when using VPN tunneled access

Edited by bonienl

Share this post


Link to post

importing a conf file automatically creates wg1. And I made sure wg0 was turned off before trying this.

Share this post


Link to post
3 hours ago, Mantene said:

When I try to turn it on the active/inactive switch just keeps flashing on and off really fast!

Disable UPnP, see advanced settings.

Share this post


Link to post
10 hours ago, bonienl said:

Disable UPnP, see advanced settings.

I disabled UPnP globally under Settings > Management Access, switched back to VPN Manager, got the popup message saying "UPnP stated changed to OFF", verified that the Tunnel's "Local gateway uses UPnP" setting is No, and tried to activate the tunnel... It's still alternating between active/inactive quickly. :'(

 

Any other ideas? :)

Share this post


Link to post
1 hour ago, BoarAnt said:

Any other ideas?

I made an update, please try again.

Share this post


Link to post

UPNP is off. I updated the plugin. I imported the TorGuard conf. It still doesn't work, though the active switch no longer flashes. It switches to Active, but once you reload the  page or navigate away and then go back to vpn settings, it is off. Are there log files I can send you? Here is a screenshot of what the imported tunnel looks like.

 

torguard1.png

torguard2.png

Share this post


Link to post

I miss a couple of mandatory fields. These should be present in the config file generated by TorGuard

  1. Local private key - generated by TorGuard
  2. Peer public key - generated by TorGuard
  3. Peer endpoint - this is the URL of the TorGuard VPN access
  4. Peer allowed IPs - this should be 0.0.0.0/0

 

Here is a screenshot of my VPN connection

image.thumb.png.339df53fc7091cfcb8ab3401b575b71b.png

Edited by bonienl

Share this post


Link to post

As posted above, here is a comparison:

So, here is a TunSafe config:

[Interface]
PrivateKey = ************************************
Address = 10.34.234.162/8
DNS = 1.1.1.1

[Peer]
PublicKey = ******************************************
Endpoint = 190.2.141.162:51840
AllowedIPs = 0.0.0.0/0
 

And here is the TorGuard config:

# TorGuard WireGuard Config
[Interface]
PrivateKey = *********************************************
ListenPort = 51820
DNS = 1.1.1.1
Address = 10.29.1.64/24

[Peer]
PublicKey = **************************************************
AllowedIPs = 0.0.0.0/0
Endpoint = 159.65.247.35:443
PersistentKeepalive = 25

 

 

Oh, and I removed the ListenPort from the TorGuard conf before importing it.

Edited by Mantene

Share this post


Link to post

The config files look alright, but in your screenshots there are missing mandatory fields.

Did you remove those fields or they are not populated after importing the config file?

 

What happens when all fields are filled in (see also my screenshot)?

Share this post


Link to post
7 hours ago, bonienl said:

The config files look alright, but in your screenshots there are missing mandatory fields.

Did you remove those fields or they are not populated after importing the config file?

 

What happens when all fields are filled in (see also my screenshot)?

Ok. So I did some experimenting last night and got it to work. 

 

This did not work:

# TorGuard WireGuard Config
[Interface]
PrivateKey = *********************************************
DNS = 1.1.1.1
Address = 10.29.1.64/24

[Peer]
PublicKey = **************************************************
AllowedIPs = 0.0.0.0/0
Endpoint = 159.65.247.35:443
PersistentKeepalive = 25

 

This worked:

[Interface]
PrivateKey = *********************************************
DNS = 1.1.1.1
Address = 10.29.1.64/24

[Peer]
PublicKey = **************************************************

Endpoint = 159.65.247.35:443
AllowedIPs = 0.0.0.0/0

 

 

Why?

Share this post


Link to post
9 hours ago, bonienl said:

The config files look alright, but in your screenshots there are missing mandatory fields.

Did you remove those fields or they are not populated after importing the config file?

 

What happens when all fields are filled in (see also my screenshot)?

To answer your question, no, those fields are not populated during the config file import.

Share this post


Link to post

Following Mantene's suggestion, I also got it to work tonight by removing the comment at the top and removing any empty lines between the [Interface] and [Peer] entries.

 

Importing the original config untouched

----------------------------------------------------------------------------------

# TorGuard WireGuard Config

[Interface]

PrivateKey = yyyyyyyyyyyyyyyyyyyyyy

ListenPort = 51820

DNS = 1.1.1.1

Address = 10.29.1.55/24

 

[Peer]

PublicKey = xxxxxxxxxxxxxxxxxxxxx

AllowedIPs = 0.0.0.0/0

Endpoint = 111.111.111.111:443

PersistentKeepalive = 25

----------------------------------------------------------------------------------

would give me 4 sections total:

ss1.thumb.png.000c09f50ffdd349389859250fbe781c.png

 

whereas the more compact version

----------------------------------------------------------------------------------

[Interface]

PrivateKey = yyyyyyyyyyyyyyyyyyyyyy

ListenPort = 51820

DNS = 1.1.1.1

Address = 10.29.1.55/24

[Peer]

PublicKey = xxxxxxxxxxxxxxxxxxxxx

AllowedIPs = 0.0.0.0/0

Endpoint = 111.111.111.111:443

PersistentKeepalive = 25

----------------------------------------------------------------------------------

would give me 2 sections:

ss2.thumb.png.7c4e02020d0d7834efed3864e5af204d.png

 

The 2nd version was connecting fine, so I think it's just the import config parser that's messing up the setup.

 

Thanks.

Edited by BoarAnt

Share this post


Link to post
22 minutes ago, BoarAnt said:

The 2nd version was connecting fine, so I think it's just the import config parser that's messing up the setup.

Yes, you are right. The import parser went wrong on the comment statement(s).

I have made an update with the fix.

 

Thanks.

  • Like 1
  • Thanks 1

Share this post


Link to post

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.