Hacker News Reader

Comment by stavros | Hacker News Reader

I was going to post this tomorrow, but I figure people here might find it useful now. I wrote an article on how to configure Wireguard for common scenarios:

https://www.stavros.io/posts/how-to-configure-wireguard/

View on HN

I think the wg0 references should be swapped with `%i` as the config is dependent on the filename with that setup. Neat write up however.

Oh, great suggestion, thanks for that! I'll update it as soon as I get home.

EDIT: Updated and published, thanks again.

Nice, that's the kind of writeup I was waiting for. :) planning on setting this up in the next couple weeks.

However, I found a huge error:

> Linus Torvalds himself said that he loves it, which took the software world by storm, as we weren’t aware that Linus was capable of love or any emotion other than perkele.

Linus belongs to the Swedish minority living in Finland, so while he's probably able to perkele he jävlas most of the time.

Currently he belongs to the Swedish minority living in Portland, Oregon (USA). ;-).

This is a great guide, thank you! One suggestion though (from someone who has never set up Wireguard before): Could you elaborate on what the "AllowedIPs" setting does exactly? The name confuses me as your comments suggest that it doesn't have anything to do with permissions (as in "allow connections from the following IP addresses") but rather specifies the IP address or range of IP addresses that locally (on the machine I'm configuring) should be associated with the remote peer in question. (Such that packets to these IP addresses get routed to said remote peer.) Is this correct?

Almost: It specifies which addresses or ranges the remote peer can send packets from. Basically, if a packet comes in on the interface with an address that's not in AllowedIPs, it gets dropped. That's why for the "tunnel everything" example, the AllowedIPs are "0.0.0.0/0", i.e. a wildcard, so that packets from all addresses are allowed to come in from the remote server.

EDIT: I've updated the article with more information and a link to the official docs, which explain this better.

Ahh, that makes sense. Thanks a lot!

You mentioned that there are lots of little networking things that you don't know about. Have you tried a setup where you use another network namespace to put only certain apps living in that namespace through the tunnel? REF vpnshift. https://github.com/crasm/vpnshift.sh

Reply on news.ycombinator.com