WireGuard & TunSafe

New Wireguard Docu Volker:
https://gueldenpfennigs.blogspot.com/2025/09/firewalld.html

https://www.wireguard.com

https://docs.pi-hole.net/guides/vpn/wireguard/

WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache.

Linux native
Windows native
iOS & Andoid
Option for "Full Tunneling" through Mannheim ... (we have to think on because of using Zscaler)

How to use IPv4 & IPv6 within the tunnel?

https://oliver-kaestner.de/posts/anleitung-wireguard-vpn-server-dual-stack-einrichten

IPv6 Test: https://fast.com/de - this requires IPv6! (via 3390 OG it does not work)

Activate Routing in Ubuntu

https://serverspace.io/de/support/help/set-up-wireguard-vpn-server-on-ubuntu/

( https://www.altmetaller.de/ubuntu-als-router/ )

vi /etc/sysctl.conf

net.ipv4.ip_forward=1

( net.ipv6.conf.all.forwarding=1 )

sysctl -p

Additionally, in case IPv6 should be deactivated

vi /etc/sysctl.conf

https://itsfoss.com/disable-ipv6-ubuntu-linux/

... this seems to be very risky - perhaps nothing works then anymore ;-(((

net.ipv6.conf.all.disable_ipv6=1

net.ipv6.conf.default.disable_ipv6=1

net.ipv6.conf.lo.disable_ipv6=1

sysctl -p

vi /etc/rc.local

#!/bin/bash

# /etc/rc.local

/etc/sysctl.d

/etc/init.d/procps restart

exit 0

********

chmod 755 /etc/rc.local

... seems not really to work after reboot ...

Perhaps remove IP in /etc/netplan/50-cloud-init.yaml as well?

# Change "enp0s18" to the name of your network interface in the following two settings. This commands configures iptables for WireGuard.

PostUp = iptables -A FORWARD -i wg-service -j ACCEPT; iptables -t nat -A POSTROUTING -o enp0s18 -j MASQUERADE

PostDown = iptables -D FORWARD -i wg-service -j ACCEPT; iptables -t nat -D POSTROUTING -o enp0s18 -j MASQUERADE

Here, we could add IPv6 NAT as well ;-))

https://www.reddit.com/r/VPN/comments/1oq855m/sip_phone_through_wireguard/

ip6tables -A FORWARD -i eth1 -o wg-service -j ACCEPT;

ip6tables -A FORWARD -i wg-service -j ACCEPT

ip6tables -D FORWARD -i eth1 -o wg-service -j ACCEPT;

ip6tables -D FORWARD -i wg-service -j ACCEPT

Weitere Informationen:

https://reintech.io/blog/installing-using-iptables-ubuntu-22

Einrichtung wireguard auf Linux Host linux-volker im Internet mit IPv4

How to Install WireGuard: https://www.wireguard.com/install

apt install wireguard

IP Forwarding needs to be activated
vi /etc/sysctl.conf
net.ipv4.ip_forward=1
Config Commands

wg
wg-quick
man wg & wg-quick does work as well

Best 5-Minute-Docu ever :-)
https://www.freecodecamp.org/news/build-your-own-wireguard-vpn-in-five-minutes/
Good as well ... https://upcloud.com/resources/tutorials/get-started-wireguard-vpn
Default Quick Start: https://www.wireguard.com/quickstart (with Video)
DE Doku WireGuard: https://www.thomas-krenn.com/de/wiki/WireGuard_Grundlagen
WireGuard on Ubuntu: https://www.thomas-krenn.com/de/wiki/Ubuntu_Desktop_als_WireGuard_VPN_Client_konfigurieren
Ubuntu Wireguard Docu: https://ubuntu.com/server/docs/introduction-to-wireguard-vpn
as well: https://wiki.archlinux.org/title/WireGuard#systemd-networkd
Show own IPs
ip addr show eth0 | grep inet | awk '{ print $2; }' | sed 's/\/.*$//'
How to setup IPv6 well?
ip -6 addr
ip -6 addr show scope global
Hätte dann auch eine IPv4 :-)
Install "ifconfig" <<< mostly default in the meantime ...
apt install net-tools
Crontab Setup
crontab -e
# Update Linux every day - volker
#minute hour Day of Month Month Day of Week Command
0 3 * * * apt upgrade >/tmp/apt-upgrade.txt
0 4 * * * apt autoremove >/tmp/apt-autoremove.txt
iptables - Routing - Firewall => Documentation in Pi-hole ONLY!
netfilter-persistent save
iptables-save > /etc/iptables/rules.v4

https://www.wireguard.com/quickstart/

systemctl enable wg-quick@wg-service.service <<<

systemctl disable wg-quick@wg-service.service

systemctl status wg-quick@wg-service.service <<<

systemctl restart wg-quick@wg-service.service

systemctl start wg-quick@wg-service.service

systemctl stop wg-quick@wg-service.service

=> this file can be imported in the new client ...

... or even better: convert this into a QR Code as described here :-)

Server Config linux-volker

wg-service.conf

[Interface]

PrivateKey = <Private Key> # The server_private.key value

ListenPort = 51001 # UDP Port for incoming connections

Address = 192.168.223.1/24, 2a01:367:c204:ffff::192.168.223.1/120 # Internal IPv4 & Global IPv6 networks of the VPN server. Different network required for routing!!!

# Change "eth0/enp0s18" to the name of your network interface in the following two settings.

# This commands configures iptables for IPv4 for WireGuard.

PostUp = iptables -A FORWARD -i wg-service -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg-service -j ACCEPT

PostDown = iptables -D FORWARD -i wg-service -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg-service -j ACCEPT

# IP" .2" = iPad Volker

[Peer]

PublicKey = okNwR06gBWX8tywGeJRVu0Ep3q/wcecaG/+xEB38dyw=

AllowedIPs = 192.168.223.2/32

PersistentKeepalive = 180

... similar for all other ones as well :-)

"X" can be used for the "target IP" ...

cd /etc/wireguard/keys

umask 077

wg genkey > private-keyX

wg pubkey > public-keyX < private-keyX

IPv4 ONLY - How does a "normal" Client (!) Config File looks like?

Filename: "ipX.conf"

[Interface]

PrivateKey = [private Key of the new Device] # <<<<

# PublicKey for better reference: [public Key of the new Device] # <<<<

Address = 192.168.223.X/32 # <<<< IP of the new Device ... (needs to be unique!!!)

DNS = 8.8.8.8

[Peer]

PublicKey = crxYA4Mzmqj+Mai5vSe+D2bMT9g/Tl+rTzTu/uTmuws= # Public key of the Server!

PresharedKey = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= # this means: there is no PresharedKey ;-)

AllowedIPs = 0.0.0.0/0, ::/0 # this moves the complete IPv4 & IPv6 traffic via this Wireguard VPN - IPv6 will die and therefore not be used ;-)

Endpoint = linux.gueldenpfennig.info:51001 # this is the host & port of the Wireguard server in germany

PersistentKeepalive = 180 # we test, if this is sufficient "eats less battery on mobiles" - otherwise, the default would be 25 (on both sides!)

QR-Code Generator

https://www.wireguardconfig.com/qrcode

... just paste the ipX.conf file into this QR-Code Generator and then you do have a great QR-Code solution :-)

Einrichtung wireguard auf Linux Host h3006155 (Ole) im Internet mit IPv4

How to Install WireGuard: https://www.wireguard.com/install

apt install wireguard

ip link add dev wg0 type wireguard

RTNETLINK answers: Operation not supported
It looks like, wireguard is not installed ...

https://www.reddit.com/r/WireGuard/comments/snxc8w/rtnetlink_operation_not_supported_wireguard_error/

lsmod | grep wireguard

https://www.mpex.de/techblog/fehlermeldung-rtnetlink-answers-operation-not-supported.html

root@h3006155:/# dpkg-reconfigure wireguard-dkms

Deleting module wireguard-1.0.20210606 completely from the DKMS tree.

Loading new wireguard-1.0.20210606 DKMS files...

Building for 5.2.0

Module build for kernel 5.2.0 was skipped since the

kernel headers for this kernel does not seem to be installed.

apt-get install linux-headers-generic

https://www.zdnet.com/article/ubuntu-20-04-arrives-with-linux-5-4-kernel-and-wireguard-vpn/#google_vignette

https://www.rpiathome.com/2020/05/13/the-unofficial-non-definitive-wireguard-troubleshooting-page/#When_I_try_to_start_WireGuard_I_get_an_error_like_RTNETLINK_answers_Operation_not_supported_OR_Unable_to_access_interface_Protocol_not_supported

xxxxxxx

https://www.thomas-krenn.com/de/wiki/Ubuntu_Desktop_als_WireGuard_VPN_Client_konfigurieren

ip address add dev wg0 192.168.111.1/24

# cd /etc/wireguard/keys

# umask 077

# wg genkey > private-key

# wg pubkey > public-key < private-key

wg setconf wg0 myfirstconfig.conf

... edit the config file ...

[Interface]

PrivateKey = <Private Key>

ListenPort = 51000

Address = 192.168.222.0/24

[Peer]

# office

PublicKey = crxYA4Mzmqj+Mai5vSe+D2bMT9g/Tl+rTzTu/uTmuws=

###Endpoint = wg.example.com:51000 # fake endpoint, just an example

AllowedIPs = 0.0.0.0/0, ::/0

Example fb4040

Öffentlicher Schlüssel - AmrP03l/c09yZSoYMh/TIfzj1NH723lP/pP9RMqIXEk=

Internet-Adresse Ihrer FRITZ!Box - xxxxxx.myfritz.net:52150

[Interface]

PrivateKey = <fb4040-private-key>

ListenPort = 52150

Address = 192.168.231.1/24

DNS = 192.168.231.1

DNS = fritz.box

[Peer]

PublicKey = 4Pr7PL0MAASGljfxClAaY6RUCqaokGXmqW4WsRLPZn4=