How To Build Your Own Wireguard VPN Server in The Cloud

tom here from lower systems and we're going to talk about wire guard vpn and by no coincidence i'm wearing a shirt that says simplicity is genius and i thought this was something that really applied to wire guard and i grabbed this shirt figured hey this is a good shirt to wear doing this video because wire guard has a simplicity to it that makes it very attractive and one of the reasons it's very popular what we're going to discuss in this video is how to set up your own wire guard server i have all the time indexes below if you don't want to hear me talk about some of the fundamentals wire guard and want to skip right to the tutorial part and i will be discussing some of the shortcomings of wire guard and that's the first part i'm going to ramble on a little bit about and i want to make sure all the understanding of the wire guard vpn protocol is there especially some of the fundamentals before we dive into all this let's first if you'd like to learn more about me or my company head over to lawrences.com if you'd like to hire a short project there's a hires button right at the top if you'd like to help keep this channel sponsor free and thank you to everyone who already has there is a join button here for youtube and a patreon page your support is greatly appreciated if you're looking for deals or discounts on products and services we offer on this channel check out the affiliate links down below they're in the description of all of our videos including a link to our shirt store we have a wide variety of shirts that we sell and new designs come out well randomly so check back frequently and finally our forums forums.lawrencesystems.com is where you can have a more in-depth discussion about this video and other tech topics you've seen on this channel now back to our content we'll start here at wireguard.com wireguard is a modern fast secure vpn that uses modern cryptography pretty straightforward in terms of all the details they have and you know why you should use it it's simple and easy to use cryptographically sound minimal attack surface high performance well-defined thoroughly considered and people that have followed my channel for a while may ask about formal verification they do have formal verification on the protocols themselves they have several white papers several write-ups and it's gone through quite a bit of review but one thing i want to mention here and we'll get into the known limitations in a second but they have an entire white paper that breaks down exactly how it works lots of really good details and i've actually spent a lot of time reading to make sure i understand every aspect of it which is also why i want to get to known limitations and some of the challenges with wireguard now they have a whole page on this but i'm just going to speak to it one of the problems with wireguard is it does not have a username or password implementation they have left this up to third party and this may be a problem for some people because i've been asked well won't this just automatically replace openvpn and not exactly those mechanisms that are well-defined and well openvpn for example has been around for a long time and username password plus key authentication multiple factors here has been around and very popular and well thought out in openvpn wireguard just kind of left that aside and basically decided they were going to create a very basic protocol have really solid implementation but leave it up to third party for all the other features around it and many firewall vendors will then come up with how they want to implement wireguard now wireguard is a very easy replacement for something like ipsec so if you have the option to use wireguard and it has a full kernel space implementation in your distribution currently linux has a full kernel space implementation as of november 2020 the bsd one is coming for other firewalls that are ready to fully implement this in kernel space that are based on bsd but the firewall vendors are going to have to leave it up to them if they want to integrate username password in there and this is going to be a challenge because this is where the attack surface comes in where the protocol is sound and just like openvpn the protocol is very sound but many vendors start doing their own thing of how they implement it and that system they create around it for username and password is where there may be some attack surface so even though the protocol is solid and if you were just to do a site-to-site vpn you probably wouldn't have much to worry about if each firewall vendor will have to examine how they do implementations of things like username password because it's not part of the wireguard protocol it'll be their implementation of it and i bring this up because there's also a company called tail scale now the goal in the end of this video is you're going to have a completely working vpn server to connect to and wrap all your traffic in but we're doing this 100 manual because the goal is also to have an understanding of the fundamentals of how wireguard works tail scale is well it's going to be a solution for the majority who go i don't want to know the inner workings i want to secure vpn but i don't want to deal with setting it up and they're just a company that i have not used i bring them up because well they were just in the news for this and i tweeted this out uh talking about the raise of money and people who asked me to review it it's a paid service that just is a wrapper for wire guard so it's not anything i really i mean it might be a cool solution it's not something i plan on deploying anytime soon or actively using as far as i'm concerned openvpn is going to be around for quite a while a couple other limitations one of them is deep packet inspection there is nothing in wireguard to support obstacation what that means is anyone doing any type of really basic deep packet inspection is going to be able to recognize the traffic as wire guard traffic tcp mode same problem openvpn i'll throw out there's an example again openvpn has some methods to one switch it to tcp mode and then hide it to make it look like ssl to try to fool deep packet inspection systems it's not like foolproof but it's a way to hide the type of traffic wire guard makes nothing uh in no attempts to hide this and this may be a problem for some people so it's not likely to be a protocol that's getting around so to speak any type of filtering matter of fact it's quite easy to filter not based on the port but based on the definition of the traffic because any type of observation will have to come from a third party an add-on for wireguard it's not something wireguard has any native support for i'll they have a few other details in here i'm not going to dive into but they are really solid though on overall and i will at least mention on performance while hardware crypto is a thing that helps some of the other protocols it's not even really needed in wireguard but maybe it will make it even faster in the future as of right now it does not have any well right now i should say doesn't really have any need for hardware crypto which is good because it then it works on a general purpose cpu but this is actually where potential maybe someone will develop some type of processor that makes it even faster so that's some future thinking stuff but i'll leave you links to all this of course it's all at wireguard.com of some of the things we talked about and if you want to dive even deeper than i plan to dive into the white paper now we're going to go to the tutorial part and i'm going to break down how to set up a server in digitalocean and the accompanying forum post so all the commands that i'll be typing you'll be able to find uh in the forum post that will be linked below in the descriptions video so let's get started on building our server and getting routing set up now we're going to be doing this in digitalocean because i've had an account for a while and i've always been happy digital ocean it's for my forums and other projects i have are hosted we do have an affiliate code down below that does help out and give us some resources to create these and it helps out the channel if you want to use the affiliate link to sign up not required but appreciated now choose an image we chose ubuntu 20.10 basic and their five dollar month plan here really straightforward uh new york option and or choose region your uh wherever you want to come out for your vpn i chose new york for the purpose of the demo i already have my ssh keys installed in digitalocean and uh i've got a video if you were looking for more information on how ssh keys work now i just check this box to say yes load those keys and then we give it a name now i've already created the project and i have actually more than one i've created specifically the one we're going to be using is this youtube wg for wire guard demo and the public ip address is 192 241 141 25 and no for anyone that may not be completely familiar with how private ipspace works just because it begins at 192 doesn't mean it's private ip um it's this public ip is this 165 one below it but specifically this is the one we're going to be using now we're going to go over here and walk you through what was changed in here so this is the youtube wg demo and then we have the write up that will be linked as well this is the step by step right up so if you see me typing commands you don't have to grab them off the screen there's a link below to this right up in my forums and this video is embedded within so you whether you started the forums or started this video there's links back and forth to both now server site setup create the droplet load ubuntu 2010 update it we've already taken care of that but i recommend it people ask how do you get your command prompt to look like that well i do have the dot files and how that works so it's easy enough to go through and change those command prompt looks like that optional maybe you don't want to change it but that's something i have linked and listed in there the first thing we need to do is enable ip forwarding to have this server act as a forwarding server so you can connect your computer to it and forward all the traffic so it comes out of that as a public ip address you need to enable forwarding so to enable it right here we do the edit the etc sys ctl dot san conf so assist control dot conf in the etsy folder so go over here we're gonna go to vim drop that in there and right here where it says net ipv4 forward equals one so normally that's commented out all they did was get rid of it use vim use nano use whichever your one you're comfortable with and that's how you turn it on so that's all we have to do is enable the forwarding next step you can run syscontrol dash p to activate it or reboot the server once you change that it doesn't change immediately it changes next time that's loaded but says control p will activate the changes or like i said rebooting the server apt-get install wire guard uh pretty straightforward there just to go apt-get install wire guard we've already got the latest one installed so no big deal pretty straightforward this is all built right into ubuntu this is one of the reasons i chose it everything's already in here now this parts really important you want to regenerate or i should say generate private keys if i did it again it would regenerate them umass zero seven seven w g gen key now the way wire guard works wg is the server command so it starts out wg there's also wg quick it's part of the command structure that we'll be using for this and what we have is we want to we'll go to cdxc wireguard and we want to create these so they have umass zero seven seven so the permissions are proper the default umass would create them with other permissions that could be a problem you have but there's the public key and there's a private key and don't worry this server when i'm done with this video will get destroyed so it's okay that i show these public and private keys next step after you've created the keys is you're going to want to cat private key and i'll show you what that does so if we go here to cat private key there's the private key that we need from there we need to create the wg0.com file so littlevim wg0.conf now if it's not created vim and typing a blank file name or nano the file name will create the file then we got to put these settings in but we need to make sure we have this right here this private key i recommend copying it pasting it in uh to the configuration because you have to get that private key set up here so here is our private key and this is the settings for the the wireguard server we're going to ignore this part for now the peer settings we're going to focus on the top part interface address 192 168 69.1 you have to set up an internal ip address for the routing to take place it's kind of like an intermediary so this is an internal ip that we have then we need this right here this is a very important line for masquerading to work properly in that so this allows the servers that are connecting why should say the clients that are connecting to route through here via essentially nas so they're going to be able to come through from their location come through as nat assume the ip address of this particular server and then go back out post up versus post down post up means turn on all these features when the wireguard interface comes up post down means shut this interface down when you're done you don't really need the post down but i left it in here that way it shuts everything down and turns everything off on the server whenever you stop the wire guard interface listen port i'm using the default listen port of 51820 use whichever list import you want but you have to modify this tutorial of course everywhere that listing port comes up and there's that private key so when we said cat private key and dump that out that just simply goes here so straightforward private key please note there's a private key space equals space then the private key and yes there's an equals at the end don't add a space there it's very important that the formatting is right and i have the formatting in here exactly the same because this is all copy and pasted other than your private key goes here so someone doesn't try to use my private keys and mess things up they are private and public key pairs if you were to copy some of the settings i have and put my private key but have a different public key you'll get problems with this system all right now that's pretty much it for the interface setup and essentially the server side setup peers are those systems you're going to have connecting to you and we're going to go and look at our peer settings which are pretty much the same we go over here and same thing this is a debian server that i set up just for this and it's behind a firewall it's just one of my lab systems that i had conveniently located and it's running debbie and linux bullseye so if i and the kernel 5.9 which has the wire guard client built in we did the same thing updated it loaded wireguard and now we can go over here and actually we can just jump right to the edit etsy wireguard and we're going to create a config over here and we'll call it youtube.com i just want to make sure there are two different names i could have called this anything i want we called it wg0 i don't know about anything but within reason you can give it different names we're calling this one youtubevpn.conf and i did this to try to be as clear as possible when i'm on the client side which is this dubbing machine versus the ubuntu machine that's going to act as a server that way there's kind of a distinction between them so when we're in here we have the peer as in this is its peer so this is the server side this is essentially the client config the youtube vpn so this is where the public key is in the public key and we'll actually exit out of this real quick and we can go cat slash etsy wireguard public key there's the public key of the debian client system that we want to connect and you can see we'll just look at the last couple z zero pkw and we see z0 pkw so this is what allows us to have this system connect to it so we did the same thing generated those keys and we got to put the public key of this server over here and let's before we go any further jump into this this is kind of a layout so those of you that like me mapping it out in a tool this is done in draw.io and you can see this is the interface config for the ubuntu wireguard server this is the interface config for the debian test server and both of these are also laid out in that forum post so this particular box is behind a firewall it's going to go through here go out to the internet and connect to this the same thing the public key of this server is located in the config of the ubuntu server and vice versa is true the public key of the ubuntu server is going to be what we put into the debian test server so that's all you need in terms of how wire guard authenticates as i said it doesn't have a username and password it does all of this with peered authentication with public key so there's just a public key over here a public key over here as long as we know each other's public keys we keep the private keys private that's all we need to know to have these connecting so let's go back over to our config i'm going to go here look at it now comes the end point and so we have the public key over here the endpoint there's that 192 241 whoops 192.241.141.25 colon 51820 for the ports now we have allowed ips allowed ips forward all traffic to server is what i have here but if you were to say we'll insert another line afterward and we need to do allowed ips equal 192.168.69.0624 then whatever other networks we could then and we'd have to comment this one out this would allow for essentially a split tunnel type of routing you would specify what networks and ip addresses are allowed and this means the client would connect and only route that particular traffic but wireguard has the option to route all traffic through so this is where if you were doing split tunnel you would split it here if you're not doing split tunnel you want a full tunnel where all traffic you do zero zero zero zero zero and forward all traffic to server this is it this is one of the beauties of wire guard is that's all the config we need to get that working so we'll go ahead and exit that and then we'll go ahead and exit this now one more thing that's in the tutorial here is getting this set up so it works on boot so one of the things we have here is if you want the wg0 interface to be active on boot you need to run system control enable wg-quick at wg0 so this command right here let me talk about what that does so wire guard when it's up and running and we'll actually go over here we're on the server the digital ocean server clear and we use the wg quick command to down the interface so we went down the interface so there's nothing in here so if you wg show wire guard show there's no connections there's no tunnels there's no nothing here so we're going to go wg quick we're gonna up and we're gonna up that interface wg0 that's it there's the entirety of it and we do w show the interface is just sitting here waiting for something to happen so it dumps out the public key right here the listening port all udp this is the peers that are allowed so currently there's this peer right here is allowed persistent keep alive every 25 seconds now i won't get too much into it persistent keep alive you may or may not need that depending on if the client is one behind that and two whether or not you're worried about those connections going stale what that means is if you have a client and we'll explain this really quickly here and you have like this debian test client and we have it connecting to here because silence is a virtue according to the documentation of wirecard which means it does not make a bunch of noise to keep the tunnels alive and it doesn't really need to so if both devices are on public ip addresses anytime they initiate traffic it automatically renegotiates and starts passing traffic but the keep alive if you want the ubuntu wireguard server in digitalocean to be able to talk to the dbn server whenever it wants to even though it's behind a firewall you need to occasionally send a keep alive to keep the state table alive if not this will go quiet over here and then this will not be able to initiate a connection over here that's if you need that let's say and we'll use the phone as an example if i'm using a phone which is behind a firewall and i want it to connect well i only want my connections initiated from the phone so in that case i wouldn't want to keep alive or if i didn't care whether or not this server could talk back to this i don't need to keep alive because as soon as this server initiates a connection it'll go through and create its own state table or a fresh one if the old one expired and go through there so they have a better explainer if you look up the keep alive options inside of wire guard it goes more in depth of different scenarios but we'll go ahead and leave it in for purposes of this video but it just of note if you were using a phone less likely you'll be using it there so this is up and running if we go to ifconfig there is wg0 wireguard just adds an interface once you bring these up so we have our standard e0 eth1 which is an internal shared your local and then wg0 now let's go over here and we'll do wg quick and you're probably thinking i want to up the i make sure i probably have an interface up nope none of them are up so we actually go here wg quick up and we'll type in youtube vpn before we type that let me show you what ifconfig brings up there's eth0 there's our local ip address and there's the local interface so there's only the couple interfaces but when we do wg quick up and we type in youtube vpn then we type ifconfig again we have a interface called youtubevpn now this is actually kind of neat and we'll play something real quick here wg quick down youtube vpn and we'll go over to let's see wireguard and we'll list i have a handful of different ones in here i have a wg one let's even do this we're just going to copy the youtube vpn to tom.conf now we're not changing anything about it we're just creating a copy but now when we do wg quick again up we'll call it uh tom and when we go in ifconfig now there's a tom interface wg0 makes the most sense from a logical standpoint like we have over here because it's wireguard interface zero and yes you can have multiple interfaces because we can even do wg quick and then up and then we can do the youtube one and then we go ifconfig and now we have a tom vpn and a youtube vpn so this is kind of a fun thing about wireguard is you can just creating all these different interfaces this is also why wireguard is not a protocol that's very big because after this once it creates interface all the other routing information everything else is just standard linux networking and routing to configure this so now we'll go back to wg quick down and we'll take down the youtube one all right and with all the interfaces brought down we're back to just the basics now let's bring the interface back up so we can actually do some wire guard commands here so wg quick we'll up and we're going to just use youtube vpn like we have in the write-up and i want you to notice something here there's not anything really to show so if we look at it latest handshake six seconds ago and we should be able to ping now 192 192.168.69.1 which i can ping it and 69.1 if you didn't notice is this ip address here there's not anything to tell you or do anything about the interfaces like making noise matter of fact without restarting this particular one we're going to stop this one so we'll do wg quick and we'll do down wg0 so we took it down broke the connection and now we're just going to go ahead and wg quick bring the connection back up now normally and once again i'll use open vpn example you would have to go to the client and tell it to reconnect re-establish those connections and there might be some type of delay in the world of simplicity and it's going to take a second here because it's realizing that old state table probably broke but it will renegotiate without any noise without you having to re-authenticate and just start talking again to that server and that's it all done in real time i didn't edit that or make it jump ahead that's the slow delay from this server starting it to the route and connection being re-established it's really fast overall when you're doing uh things get moved around matter of fact if there's any type of roaming because we did not specify like a specific ip that this has to come from in terms of this w client so if it were to move or it's behind a different ip address that can happen relatively seamlessly because as soon as it negotiates the negotiation process extremely fast and you don't have to actively take it up and down so we didn't have to do anything on here it tried the old state table it waited it realized it was broken it establishes a new one automatically and now we're talking of course the next question is if we go here to ifconfig actually we want to know the ip addresses let's ifconfig and we see that 69.2 is where we're routing everything over but if we type the route we're now pushing out everything over here so 192.68 is now the default route the youtube vpn this means all the traffic's going to be tunneled there now if you're not familiar with the website ifconfig.co it's a really handy and i've blurred out my information here but this website tells you what's your ip address very similar to what's my p but the cool thing is you can use curl to find out what your public ip address is now i've blurred out my public ip address in my office here but let's go over here and we're going to type curl ifconfig.co after i spell it right ifconfig.co and it gives me 192.241.141 and if we do wg quick down the u2 vpn and then we go back to curl ifconfig.co i'm blurring it out but that's my public ip address so that quick we can bring it up and down and actually let's go wg quick and go up actually clear then we're going to go curl ifconfig.co and we're back to routing traffic all back out of our digitalocean vpn it very quickly brings these services up and down there's not much delay especially when you already have the server running i can take this down bring it back up there's not a long negotiation process wire goes through to get connected and routing again now the next thing i want to do and we're going to leave this debian client up and running and it has the ip address of 192 168 69.2 internally and we're going to leave it up and running while we connect another system and working in linux is pretty easy for me but i know a lot of people are going to be using windows so i have a windows client that i'll show how to do this as well and the nice thing is there's already a wire guard client for windows pretty straightforward we go here to wire guard dart wire guard dot com slash install i downloaded the windows installer and then we ran through the installer really just a couple next and yes and now we have to build our tunnel so we're gonna go here and we're gonna add an empty tunnel and call it youtube demo so we can call it whatever you want youtube demo sounds good to me and we have here the public key don't worry about the private key once again i'm going to be destroying all these when i'm done with this video but we need to get the public key over to the other server so here's that public key and let's get the server settings set up so we're going to switch back over this is our youtube wg demo server and we're going to go ahead and take down the vpn so we'll go wg down wg0 bim such the wire guard wg0 and now we have to add another pier so here's that test debian client here public allowed persistent keep alive and then we're going to create another peer over here let me call this peer windows client here's the public key there's the allowed ips 69.3 because we're going to incrementally now as i stated before there's not any type of dhcp system or any ip addressing system inside of wireguard natively you can rely on external services for it in this case because we're mainly creating the files we're just going to increment to the next ip address but you can set these however you want as long as you're within the address range here which is one nine two one six eight sixty nine dot one slash twenty four giving it a slash 24 range so we'll go to dot three here there's that public key and there's the ip address that we want go back over to here there's that same public key that we copied over there and now we got to put some settings inside of here and we got to put the peering settings in and it's the same as it was on our linux system there's the public key and that public key is related to the public key of ubuntu server and we put that public key allowed ips endpoint 192.168.141.25 and the same thing colon 51 280. one more thing we have to add up here is we got to assign the ip address so we're going to say address equals 192 168 69.3 24 and away we go so here we go hit save block until traffic kill switch i like that they built this right in that means once we wrap this system it is going to lock in all the traffic and send it out over to that tunnel so if you're looking for the whole vpn solution this is the way to implement it so we're going to hit save but we're not going to activate it just yet and the reason why is because well we didn't save this yet so we're going to go ahead and save this and then we do wg quick up wg0 all right so now this is turned up and running go back over here go to our wire guard and we're going to hit activate simple as that it's activated now we should be able to go to what's my ip and that didn't work meaning we did something wrong so let's troubleshoot this real quick and figure out which command tom copied and pasted wrong i found it i mistaped the public key right here because i copied and pasted the wrong one so this public key we'll go back over here did not match inside of here so we're gonna go here and vim where garconf delete this public key and replace it with the right one so i figured i'd leave this mistake in the video instead of editing it out so there we go there's the public key now we can do wg quick down whoops down wg0 and we'll do a quick up w0 oh and for those wondering yes we could do a system control and restart it as well i just started using wg quick and starting familiarizing myself with the wire guard commands but now this should bring the tunnel back up and running we'll go back over to our windows with the correct one in now and toggle the tunnel so we'll hit save activate we'll do a ping test real quick feel weird using oh look it's working feel weird sometimes using windows i use linux so much sorry about the little typos there now let's do a what's my ip and we see the 192 and of course i prefer to go to ifconfig.co which failed this time for a different reason um the dns isn't set i have it blocked to tunnel and i had it forced to be a local ip local dns address which we can fix pretty quickly we're going to go change the network settings for that and you can specify dns settings right inside of here i'm just choosing to use cloudflare's dns to make it simple but you can specify another dns server or even other local servers etc however you want to specify them but we'll go ahead here and hit activate now make sure dns is working hey look it's resolving and that means ifconfig.co should work now and it does and the ip address is the same as our digitalocean server so i left all these little mistakes in here because these are some of those troubleshooting things you'll find and of course go through the documentation i encourage you to do that if you want to know all the extra features that are available inside of wire guard of note so this ip address is 192 168 69.3 and if you remember our debian linux client was so if we go back over to that make sure the tunnel is still up and running yes it's still getting the right ip address we'll go back over to windows let me go over here and we're going to do a ping dot two and now i'm actually pinging all the way out to the wire guard server round trip and coming back so i'm able to talk to the servers on there this is one of the natures of the way the default settings are is all the clients that attach to this same interface are all in that same 192.168.69 subnet there's no rules written between them now you could write rules between them not necessarily in wireguard but with other firewall utilities that are built into linux but by default just so you know if you build this out all of the clients that you connect also will be able to talk to each other that may be a feature you want that may be a feature you don't want one of the ways to easily get around this is we can build multiple tunnels on the wireguard server so we can build like a tunnel for one group and another group and another group that way those groups don't necessarily talk to each other or you can go out and build rules between them now hopefully this is helpful for setting up your wireguard server i know it's a lot to go through there's a lot of documentation but i wanted to do this video to talk about the raw settings of wirecard having these fundamentals to me really helps understand when you start using it inside of a firewall or inside of another deployment or integrated with something else like i said there's popular tools out there tail skill being one of them that i mentioned at the beginning that offer basically an interface to put on top of this as the wire guard protocol becomes more popular and we see more vpn companies implementing it each one of them will do their own thing on top of it but whenever you want to get deep into network troubleshooting i always find it helpful to understand the fundamentals of how these things work and that's what i wanted to cover in this video so of course i'll leave link to the forum post feel free to comment down there but this should be enough to get you started and start playing with it and gain better understanding of it also because everything is run from the command line with this with wire guard you'll probably find if you spend some time on github a lot of automatic deployment utilities and of course you can think of ways to automatically deploy this yourself by being able to script all these installs and all the functionality of it it's actually a pretty very much powerful system to get up and running for you know tying scenes together even if they're behind firewalls hopefully this was helpful and thanks and thank you for making it to the end of the video if you like this video please give it a thumbs up if you'd like to see more content from the channel hit the subscribe button and hit the bell icon if you like youtube to notify you when new videos come out if you'd like to hire us head over to lawrencestems.com fill out our contact page and let us know what we can help you with and what projects you'd like us to work together on if you want to carry on the discussion head over to forums.laurensystems.com where we can carry on the discussion about this video other videos or other tech topics in general even suggestions for new videos that are accepted right there on our forums which are free also if you'd like to help the channel in other ways head over to our affiliate page we have a lot of great tech offers for you and once again thanks for watching and see you next time you

Channel: Lawrence Systems

Views: 71,427

Rating: 4.9451075 out of 5

Keywords: lawrencesystems, vpn server, wireguard vpn, wireguard setup, vpn for iphone, wireguard vpn setup, openvpn alternative, linux vpn, vpn server setup, free vpn, how to, vpn server explained

Id: 7yC-gJtl9mQ

Length: 36min 15sec (2175 seconds)

Published: Mon Nov 16 2020