WireGuard on Ubuntu (server) and Android (client)

2019-12-22
#howto #ubuntu #VPN #server

WireGuard is a lightweight VPN with an extremely simple configuration. Everything below was tested on Ubuntu 18.04 as the server and Android 8.0.0 as the client.

§ Server

Installation from the official PPA:

1apt-add-repository ppa:wireguard/wireguard
2apt update
3apt install wireguard

The client and server authenticate each other with asymmetric keys (as in SSH). The keys are generated with the management utility wg:

1wg genkey

This will be the server auth key (the client auth key can be generated with the same command or in the mobile application; you will need the public part in the config).

Add the configuration file sudo vim /etc/wireguard/wg0.conf:

 1[Interface]
 2Address = 10.9.0.1/24
 3PrivateKey = <generaed by wg0 private key>
 4ListenPort = 51820
 5PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
 6PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
 7
 8[Peer]
 9PublicKey = <public key generated on client (android app)>
10AllowedIPs = 10.9.0.2/32

And fix chmod:

1chmod 600 /etc/wireguard/wg0.conf

This configuration includes routing internet requests from the VPN clients. If you do not need it (communication between the server and client is enough), omit the MASQUERADE lines.

Enable systemd to autorun the service:

1sudo systemctl enable wg-quick@wg0.service
2sudo systemctl daemon-reload

Start it manually the first time:

1wg-quick up wg0

Enable IP forwarding if you have kept the MASQUERADE lines in the config:

1vim /etc/sysctl.conf
2net.ipv4.ip_forward=1

§ Client

Install the application from Play

Create the configuration from scratch.

  • Name is anything
  • Private key can be generated with the “generate” button or with the wg utility on the server and copied from there
  • Addresses are the same as in the client section of the server (10.9.0.2/32 in this note)
  • Listen port is any; you can keep 51820, similar to the server
  • DNS server - any, use Yandex’s 77.88.8.8 or Google’s 8.8.8.8
  • MTU copy from server (after starting wireguard service, run ifconfig wg0)

Peer section - server config:

  • Public key: the public part of the server key (you can extract it from the private key with echo public key | wg pubkey)
  • Allowed IPs: the server IP 10.9.0.1 if you do not want to route all traffic via the server, or 0.0.0.0/0 if you do
  • Endpoint: server_host:server port (like myhost.com:51820)