PUQ Mautic

WireGuard

Basic concepts WireGuard

Order now | Download | FAQ

 Since version 1.3 PUQVPNCP supports VPN protocol WireGuard

WireGuard is the main VPN protocol of the PUQVPNCP system. 
This means that the WireGuard protocol must be installed and configured correctly. If you have carefully carried out the panel installation process according to our instructions, then all packages are ready to work and you do not need to do anything else.

The primary place where configuration changes are made is the WireGuard interface, the internal network address space is configured on the interface, the public IP address for NAT implementation, as well as DNS server settings, and VPN clients are connected to the interface and much more.
WireGard interface cannot be disabled (only removed)

WireGuard protocol available to clients

Usage features WireGuard

Technical requirements and installation

Order now | Download | FAQ

Technical requirements

Installation

We issue all comments after logging into the SSH terminal window as the root user.

Linux kernels less than 5.6 (<=5.5) did not include Wireguard as a feature in the upstream kernel code. Adding Wireguard support to these (older) kernels is possible via additional modules

Check kernel version

uname -sr

Linux 5.10.0-10-amd64
apt-get update
apt-get upgrade
reboot

For Debian 10:  WireGuard is in Debian backported repo. Hence, enable backports as follows, run:

sudo sh -c "echo 'deb http://deb.debian.org/debian buster-backports main contrib non-free' > /etc/apt/sources.list.d/buster-backports.list"
sudo apt update

 

apt-get install wireguard wireguard-dkms wireguard-tools -y

Checking installed packages

Checking the wireguard status
dpkg -s wireguard

Output should looks similar to this:

Package: wireguard
Status: install ok installed
Priority: optional
Section: net
Installed-Size: 17
Maintainer: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Architecture: all
Version: 1.0.20210223-1
Depends: wireguard-modules (>= 0.0.20191219) | wireguard-dkms (>= 0.0.20200121-2), wireguard-tools (>= 1.0.20210223-1)
Description: fast, modern, secure kernel VPN tunnel (metapackage)
 WireGuard is a novel VPN that runs inside the Linux Kernel and uses
 state-of-the-art cryptography (the "Noise" protocol). It aims to be
 faster, simpler, leaner, and more useful than IPSec, while avoiding
 the massive headache. It intends to be considerably more performant
 than OpenVPN. WireGuard is designed as a general purpose VPN for
 running on embedded interfaces and super computers alike, fit for
 many different circumstances. It runs over UDP.
 .
 This metapackage explicitly depends on both the kernel module and the
 userspace tooling.
Homepage: https://www.wireguard.com

Checking installed packages

Checking the wireguard-dkms
dpkg -s wireguard-dkms

Output should looks similar to this:

Package: wireguard-dkms
Status: install ok installed
Priority: optional
Section: kernel
Installed-Size: 1724
Maintainer: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Architecture: all
Source: wireguard-linux-compat
Version: 1.0.20210219-1
Depends: dkms (>= 2.1.0.0), perl:any
Recommends: wireguard (>= 0.0.20191219), wireguard-tools (>= 0.0.20191219)
Description: fast, modern, secure kernel VPN tunnel (DKMS version)
 WireGuard is a novel VPN that runs inside the Linux Kernel and uses
 state-of-the-art cryptography (the "Noise" protocol). It aims to be
 faster, simpler, leaner, and more useful than IPSec, while avoiding
 the massive headache. It intends to be considerably more performant
 than OpenVPN. WireGuard is designed as a general purpose VPN for
 running on embedded interfaces and super computers alike, fit for
 many different circumstances. It runs over UDP.
 .
 This package uses DKMS to automatically build the wireguard kernel
 module.
Homepage: https://www.wireguard.com

Checking installed packages

Checking the wireguard-tools
dpkg -s wireguard-tools

Output should looks similar to this:

Package: wireguard-tools
Status: install ok installed
Priority: optional
Section: net
Installed-Size: 319
Maintainer: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Architecture: amd64
Source: wireguard
Version: 1.0.20210223-1
Depends: libc6 (>= 2.14)
Recommends: nftables | iptables, wireguard-modules (>= 0.0.20171001) | wireguard-dkms (>= 0.0.20191219)
Suggests: openresolv | resolvconf
Description: fast, modern, secure kernel VPN tunnel (userland utilities)
 WireGuard is a novel VPN that runs inside the Linux Kernel and uses
 state-of-the-art cryptography (the "Noise" protocol). It aims to be
 faster, simpler, leaner, and more useful than IPSec, while avoiding
 the massive headache. It intends to be considerably more performant
 than OpenVPN. WireGuard is designed as a general purpose VPN for
 running on embedded interfaces and super computers alike, fit for
 many different circumstances. It runs over UDP.
 .
 This package contains command-line tools to interact with the
 WireGuard kernel module.  Currently, it provides only a single tool:
 .
 wg: set and retrieve configuration of WireGuard interfaces
Homepage: https://www.wireguard.com

 

 

 

Creating a WireGuard Configuration

Order now | Download | FAQ

In order for the WireGuard solution to work properly, it is necessary to create, among others: interface for Wireguard and configure other settings

WireGuard's configuration is available in the menu item VPN servers->WireGuard

image-1690791351780.png

To create a new WireGuard server, click the Create button.

image-1697374139408.png

The system will automatically fill in the form for creating a new server with unique data.

You can change the data if necessary.

 

 

 

 

Changing WireGuard Configuration

Order now | Download | FAQ
WireGuard configuration is available in the menu item VPN servers->WireGuard

Select the WireGuard interface you want to change and click on the Edit button

You must understand that changing any interface parameters will completely remove all old configuration and create an interface with new parameters.

In case of changing critical parameters, each client must reconfigure the connection taking into account the new configuration.

 

image-1690793942519.png

image-1690793950704.png

You can change the following parameters of the WireGuard interface

 

"Set Bandwidth" button, which automatically sets the bandwidth of all clients of the external interface/server Set Bandwidth for the parameters that are entered in the section Peer configuration

 

 

 

 

 

 

 

 

 

 

 

 

Diagnostic Information

Order now | Download | FAQ
WireGuard diagnostic Information is available in the menu item VPN servers->WireGuard

Select the WireGuard interface for which you want to display diagnostic information and click the button "Edit" in the corresponding row.

image-1671007016158.png

image-1671007061670.png

Further, there is a table in which the list of all clients which are assigned to this interface.

 

 

 

 

 

 

 

 

 

 

 

Port Forwarding

Order now | Download | FAQ

Port forwarding is a networking technique used to allow external devices to access services running on a local network. Essentially, it involves redirecting incoming network traffic from a specific port on a router or firewall to a specific device or port on the internal network. This allows devices outside the local network to access resources such as web servers, FTP servers, or game servers hosted on a local network. Port forwarding is often used for remote access to devices, for example, accessing a security camera or a home automation system from a remote location.

To access port forwarding settings, select the Wireguard server for which you wish to configure port forwarding and click on the port forwarding button.

image-1677505786729.png

When you access the port forwarding settings, a list of all currently forwarded ports from the external IP address to the internal account will be displayed. If you wish to add a new port forwarding rule, simply fill out the necessary information and click on the "ADD" button. Conversely, if you need to remove an existing port forwarding rule, click on the "DELETE" button associated with the relevant entry. These options provide a great deal of flexibility in managing your port forwarding settings to ensure that external devices can access the resources on your VPN network that you want to make available.

image-1677505845931.png