Building a Simple VPN with WireGuard with a Raspberry Pi as Server | Hacker News Reader

Building a Simple VPN with WireGuard with a Raspberry Pi as Server

snikt.net

575 pointskingsomething122 comments

For anyone else wanting to set this up at home, I’d recommend installing the vyatta-wireguard module [1] on an EdgeRouter X instead. It costs about the same as a Raspberry Pi, and you get a reliable network appliance with four gigabit ports and PoE, rather than a general purpose Linux box with graphics and USB. I’ve found the WireGuard module to be fast enough to keep up with my 100/40 Mbps internet connection, and now when my Linux server goes down, the network it’s connected to stays up.

[1]: https://github.com/Lochnair/vyatta-wireguard

I have this router and set up the wg interface but got stuck at how to route all my home traffic through wg. Any recommendations on how to troubleshoot this part?

I believe you can do this with policy based routing rules. Effectively you create a second routing table where the default route goes through your wireguard device and then you create firewall modify rules that assign traffic to that routing table by source, your local LAN range and interface in this case.

The following article has an example of using policy based routing. Your setup isn't all that different, you don't need to have more than one default route in each routing table is all and you also might only need one additional route table.

https://help.ubnt.com/hc/en-us/articles/204952274-EdgeMAX-Po...

As suggested in the sibling comment, use policy-based routing, specifically something like:

    set protocols static table <table-number> interface-route 0.0.0.0/0 next-hop-interface wg1

I recommend following this blog post. Helped me a lot: https://andrew.dunn.dev/posts/wireguard-from-your-isp/

I upgraded from an ER-X to an ER-4 because the X can’t do full 1000 Mbit with PPPoE fiber without hardware offload. With hardware offload turned on there’s a bug in the hardware that causes some sites, most notably Netflix, to not route at all.

The ER-4 has been great with the Cavium hardware. No hardware offload issues like this.

Edit: The ER-X tops out around 500 Mbit with hardware offload turned off.

Love my ER-4 and all its offloading capabilities. I just wish it had a switch chip so you could bridge ports without a performance penalty.

Huh. I have a er-x with hardware offloading turned on. I have noticed no issues with netflix.

I get about 900 megabit on my gigabit fiber.

while i don’t use it it should be possible for ppoe with hw offloading, so i don’t get it either. maybe that’s disabled on the slow one...

https://help.ubnt.com/hc/en-us/articles/115006567467-EdgeRou...

but i’d assume it should handle fast rates like this if hw offloading was on.

I had an ER Lite, and hardware offload was re-validating packets. Things would come in as error, and come out the other side still invalid, but validated. And at the time my ISP was sending me a lot of uncorrectable errors. So a lot of services would refuse to run with hardware offload on, because the errors weren't being handled. (with it off, the errors were identified as errors and handled. slow, but accurate).

Then the pole outside my house got hit by lightning and fried the thing, and I replaced it with something from mikrotik.

Be careful with this module, lots of the `set` and `delete` commands aren't quite working right yet, leading to some commit failed errors for me. I was trying to get something working and ended up with an ERX that couldn't pass traffic last night. Luckily I had a serial-to-USB cable so I could fix it.

That's partially my fault. I wrote a lot of the configuration command stuff for that module and there are a couple of bugs when it comes to validation for setting and deleting items so you can get yourself in a bad position. Plus there are some issues with EdgeOS which this seems to trigger.

I migrated from Wireguard to ipsec quite a long time ago because it was less complicated for my particular needs. It has probably been close to 2 years. No one else seems to have taken up resolving the lingering problems with the configuration issues.

I'm running the latest 2.x firmware so I wasn't sure where to point fingers :)

I'll give it another shot at some point, but it was more just to try out. I've also got ipsec set up on that router and that continues to work just fine.

I may dust my personal ER-X off soon and take a look at addressing the issues. I would have more enthusiasm about it if it didn't involve writing perl scripts.

If you do attempt it again there are "generate" commands which will generate they keys needed and place them in the proper area in the file system. Most of the guides to configuring Wireguard on edgeos seem unaware these exist and have people using the "wg" command directly instead to generate keys.

Ahhh good to know!

I think part of my issue is just that I need to do some more reading around what IPs should be what. It's usually clear what's going on in WireGuard-land, but not clear how that interacts with the other interfaces or the networks on either side.

Cool project - if you're looking to set up a secure VPN in a quick, no-nonsense way, be sure to look at [Algo](https://github.com/trailofbits/algo). Does WireGuard (and IPSec if you want), only secure, sane defaults, and nothing more. Hands down the easiest, most secure way to setup a modern VPN in a few minutes. Far better than using some random anonymous VPN service running out of some random person's closet that's.

+1 for Algo. I've been using it since last year on a VM (took under 5 minutes to setup), for firewall access (SSH, RDP, DBs etc.) to work servers.

Works great for secure access from anywhere when working remotely or travelling.

Also check out Streisand[0] if you're interested in this.

[0] https://github.com/StreisandEffect/streisand

I've had good luck with Streisand.

The major advantage to using Streisand instead of Algo is that it comes with lots of obfuscation goodies to help get around restrictive firewalls, like shadowsocks.

Also, if you're on a restrictive firewall and you need to quickly assess what ports are even open for egress, you can do `nmap --open allports.exposed` to find them. Then use one of streissand's VPN options and connect.

Or even quicker (no need to deal with Ansible) for IKEv2 IPSec only, my Bash script: https://github.com/jawj/IKEv2-setup

A question for people with experience in this area:

I've been considering setting up WireGuard so I can keep my mobile phone always connected to my home network.

Will I experience degraded network performance (either latency or bandwidth) if I have my mobile phone always connected to a VPN 24/7?

My phone is an iPhone 11 Pro and I would be running WireGuard on a Pi4

Some bandwidth and latency downgrade seems certain. Google, Netflix, and others invest a lot to cache content closer to your phone. A VPN circumvents that approach. The experience, though, is individual enough, that nothing other than trying it would tell if it it's "good enough" for you.

You don't have to route all your traffic through the VPN (though it's unclear from the question whether or not that's the goal). If he only wants access to resources on his home network, it's entirely feasible to set that up while still routing other traffic out through the public internet via your ISP/carrier.

Ah, yes, sure...missed that. I had assumed it was all VPN.

I should have mentioned above, but I want to use pihole as well so ideally I’d route almost all my traffic through my home vpn.

You can still just have a local pihole dns server with your web traffic going out over your mobile isp.

No degraded performance in my experience, at least not visibly. Only drawback is more battery consumption.

About how much more consumption?

I am not on an iphone but I would say 10 to 15 percent more.

On an iPhone you will not notice the difference, it's negligible

It does shows around 15% battery usage in settings if wireguard is always on for my iPhone 11

I dont think you can express Wireguard's battery usage by that %.

Imagine these 2 use cases:

#1. You do not use/touch your iPhone for 24 hours. Wireguard will now show 40% of the total battery that was used.

#2. You play the game Tetris for 24 hours. Wireguard will now show less than 1% of the total battery that was used. Because Tetris used the other 99,9%.

I do this fairly often with an Algo vpn. Sometimes the initial connection setup suffers, but there can be a gain from adblocking if you use PiHole.

I’ve had to turn it off a few times when some apps do geo-ip lookup and give me errors about not knowing whether I’m in the US. Otherwise the main drawback is battery usage.

Yeah I should have mentioned above but one of the reasons I want to do this is for pihole on the go. How much more battery usage would you estimate your setup causes?

This question gets asked a lot. Someone did a test and determined that always-on VPN (OpenVPN or Wireguard) on an iPhone consumes an extra 1% battery life compared to not using a VPN. Google may help find a source.

Depends on how you want to use it.

If you want all your network traffic to go via your home network instead of normally over the internet, you will experience degraded network performance and it'll mostly depend on how fast your home network is & how far it is network-topologically from your phone.

I do this (with OpenVPN / Android, but same idea) and the main factor that limits my own performance is the poor upload speeds of my residential cable subscription. For many residential services, you're looking at asymmetrical up/down speeds, and they usually advertise the higher download number only.

This is normally fine since you most people download way more than they upload and don't run servers in their homes, but when you route everything through your home, you may be limited by upload speeds.

I do this. Wireguard's iOS app with connect on demand is great. I get very close to the full speed of my home connection.

I have beeen looking at setting up a vpn to be able to hook up my pc to the office network. I don't know a whole lot about it but I ended up trying out Softether for the job just this weekend. It's a free and opensource project from the University of Tsukuba, Japan. It promises that it can achieve speeds far higher than Openvpn. It was really just a click next, next type setup both on client and server which was the reason I went for it over openvpn which seemed more complicated and would require me to handle DNS stuff etc. I was impressed that I was able to get it up and run a desktop application designed for a local network with a minimal increase in lagginess. I'd value the opinions of people more knowledgeable than I who may have tried it.

It looks like softether is just a management GUI / framework that handles a bunch of different underlying VPN products/standards? The README says the following are supported "SSL-VPN, OpenVPN, IPsec, L2TP, MS-SSTP, L2TPv3 and EtherIP by the single SoftEther VPN Server program." Looking at the documentation for client setup it looks like you just setup an IPSEC client.

I believe SoftEther has its own userspace implementation of all of these protocols + NAT.

Certainly not an expert but I switched from openvpn to softether for personal use back in 2015-16 out of curiosity, saw substantially lower latency. I see openvpn as the samba of vpn servers. Huge hassle to configure for performance, so much history that searching when you have issues is difficult.

Glad to hear of someone using it for a while and who's impressed with it. I've only used it a very little bit but I was very impressed, I think I'm going to dive into it deeper now.

Would a Pi4 be able to handle being both a VPN and a pihole, or should these be two separate boxes?

I run both on my Pi4 and still have plenty of resources to spare.

I run mine as both a OpenHAB and as PiHole server. I dont see why not. Of course a VPN might be slightly more involved. I am thinking of splitting it up and doing a VPN with PiHole though so I can get access to my internal network to manage OpenHAB remotely. I want my OpenHAB Pi to be stand alone.

I have the original Pi 3. It handles both of these tasks just fine and with throughput to spare.

I run both, along with docker on a Pi Zero and there's still some RAM to spare.

Been using the Pi1 for a couple years now with OpenVPN and Pihole, never had problems (though the only one using the VPN is me, at any time), so I'd say the Pi4 should be more than capable :-)

Yes.

Being a VPN and a DNS server are both extremely light weight tasks that use (mostly) orthogonal resources (VPN = IO, DNS ~ fairly small IO and CPU).

I'm running both on a Pi 2 (without a heat sink).

Yep! This is how I started out (I run it one a VPS now so I'm not tied to my home network) and it works fine. The only limit you're likely to run into is your blocklists filling RAM. I have a 5M+ long blocklist and it won't fit into 1GB, so you might want to spec up a little bit in that area, depending on how block-happy you are.

I set my Pi4 up with wireguard+pihole recently. I think pihole does nothing 99.99% of the time, so I can’t speak to how performance is in worst case scenarios, but wireguard seems fine. I get about 25 Mbps up/down (speedtest.net with a single client, so assume it’s 25 Mbps aggregate. Not a lot for hefty file transfers but comfy enough for VNC to multiple hosts. The big win is in decreased latency. I don’t have good quantifications of this beyond speedtest.net run from my work. 5 ms with no VPN. 82 ms using my router’s OpenVPN. 24 ms using Pi4 wireguard. These were just single runs so the strong law of small numbers may apply. I know iperf is more scientific, but I wanted a quick, empirical full internet test. My home internet is 550 Mbps down / 36 Mbps up.

Full data (iPhone 11 client at work):

No VPN: 145 / 139 / 5

Router OpenVPN: 25 / 6 / 82

pi4 wireguard: 24 / 27 / 24

The hit you are taking seems larger than it should be. Have you tried different speedtest severs?

Is your no vpn sample still on the same home network? Or are you comparing your mobile data or another network to your home network (through vpn)

If the former is true, that seems like quite a significant penalty to pay for using wg.

All three runs were on work wifi. There is some bottleneck in between my work and apartment since my apartment connection is 550 / 36. It isn’t a test of raw wireguard performance, but rather a realistic best case scenario for full internet tunneling on the go.

Could you recommend something that would have 2x NVME for the home internet part?

RK3399 based boards are interesting but there is only 1x NVME on the Rockpi4 NVME extender.

The Nvidia Jetson nano extenders use USB3, which is not acceptable for the usecase

I have been using ZeroTier(https://www.zerotier.com/) much simpler solution to setup.

Doesn't sound like it's Open Source to me.

"A commercial license is only needed if you want to offer a paid network management service or embed it into a proprietary device or app."

I would stay away from software that wants to restrict how you use it.

From their site:

> commercial license is only needed if you want to offer a paid network management service or embed it into a proprietary device or app.

A cursory look suggests that it's open source, with restrictions that they clearly list on their site here[0]. I get your point, but I personally don't mind if a business open sources their software and allows free use of it for non commercial cases.

[0] https://www.zerotier.com/pricing/

That's not open source. They make the source available but open source does not restrict what you can do with it other than sometimes requiring that you share the source for your binaries.

Open source just means you have or can get access to the source. FOSS Free open source software also gives you the rights to use the source.

Thats RMS's fringe definition of OS but the widely accepted OSI definition is that open source software does not restrict your rights to commercial use.

FOSS implies restrictions on the developer in the service of end-user freedom, eg. copyleft and anti-tivoization.

Open source implies nearly unlimited rights for the developer, like BSD, MIT, or Apache.

With these idiosyncratic restrictions (noncommercial, research only, do no evil, etc) we typically say “disclosed source.”

>Open source implies nearly unlimited rights for the developer, like BSD, MIT, or Apache.

Wrong: the GPL for example is defined as open-source by the Open Source Initiative (source: https://opensource.org/licenses) -- a fact that has not changed since the coining of the term "open source" over 20 years ago.

> FOSS implies restrictions on the developer in the service of end-user freedom

No it doesn't. You're thinking of copyleft licenses. FOSS is not synonymous with copyleft; many FOSS licenses (recognized as such by RMS and the FSF) are not copyleft.

Whoa, you’re right. I definitely remember reading a tirade against permissive licenses that I thought was FSF’s position, but I see they do explicitly recognize permissive licenses as Free Software.

>Open source just means you have or can get access to the source.

No, that is "source-code available". "Open source" was defined over 20 years ago by this document and that is still how most software people still use the term: https://opensource.org/osd

RMS wrote about free software and open source (which is different):

https://www.gnu.org/philosophy/open-source-misses-the-point....

RMS has basically single handedly tried to push "Open source can be proprietary, only free software is good" Every other orgs definition has had Open source mean the actual license is open.

"Free software" is also an absolutely awful term because for 99.9% of the population "free" means it didn't cost them any money. This will never change no matter how hard RMS tries because its a very common and understood word.

According to RMS, in the link posted above:

> The terms “free software” and “open source” stand for almost the same range of programs.

and he definitely doesn't claim that open source is proprietary.

Open source and the developer's choice of license that let you do or not do something are two separate matters.

They aren't. The open source definition requires allowing commercial use https://opensource.org/osd

Many closed source programs and libraries allow the users to see and modify the source code for their own use but that doesn't make them open source.

Their library version is GPL-3.0, so I'd say while everything might not be open source, some of their utilities are: https://github.com/zerotier/libzt

> Doesn't sound like it's Open Source to me

Your parent's comment didn't even mention the open source issue here. Stop harassing startups with open source products just because you make 6 figure merely doing nothing all year.

You could also use https://tailscale.com which has, subjectively, a much nicer UI and iOS integration.

What's the throughput like on a Raspberry Pi?

I was only able to get ~60mbps with OpenVPN through a hard wired Raspberry Pi 3 connected to Google Fiber, due to limitations of its bus.

The 4 is supposed to be actual gigabit, but I have not yet tried it out to confirm.

I'm trying to set it up on a RPI4 as an 802.11ac wireless router, to verify this. If it manages 100mbps+ then it'll be a cheap replacement for my current router.

Are you keeping a write-up of your progress anywhere? Would love to see how this turns out.

Not yet; but that's a good idea. Thanks for the nudge :)

are you using OpenWRT or something else?

Starting with Ubuntu for now, and hostapd.

Which bus limits to 60mbps? The USB limitation shouldn't be anywhere near that low.

The USB bus on those is shared with all devices

True. It does depend what else you are doing with the pi. Something like a USB hard drive could account for that poor performance, especially if you were upload from/downloading to it.

I don't know, but you get the extra limitation of USB2 being half duplex. USB2 is something like 480mbps. Add half duplex limitations and just general overhead compared to theoretical max. I can see how some network protocols become limited to 60mbps.

Raspberry Pi 3 can do at least 250 Mbps. Perhaps it's limited by something else, like crypto or your actual connection?

Not the original Pi 3B, you're thinking of the 3B+. https://magpi.raspberrypi.org/articles/raspberry-pi-3-specs-...

OpenVPN is extremely slow, same setup with wireguard is guaranteed to be much faster.

I just ran iperf from my Pi4 to my Ubuntu VM in the same LAN five minutes ago. 850 Mbps symmetric with no VPN.

I get 940 Mbps for two devices on the same switch.

I’ve been using a pi3 for about a year as a full time VPN on my cell phone and laptops.

3 is only 100mbit eth, but I’ve had almost no issues with it. Connects fast, no problem streaming HD video or cloning huge git repos. Maybe when I get home today I’ll take some measurements.... But my biggest issue is the trash Powerline Ethernet between my router and rest of my network.

I have issues with my wireless signal just crapping out from out of nowhere from time to time. Usually in specific spots in my home. I setup a repeater (thinking a mesh network might be the better choice, but this was a much cheaper temporary solution) but it still sometimes happens. The ethernet is fine on the other hand.

I run OpenHAB and Pi-Hole all on a RPi3 on ethernet, no issues so far.

Here is someone's benchmark from reddit: https://www.reddit.com/r/WireGuard/comments/eeafds/wireguard... (tl;dr "Avg: 829 Mbps")

That's for a Raspberry Pi 4, which should have a pretty drastic performance difference from the Raspberry Pi 3 mentioned in the article since only one of those has proper gigabit Ethernet.

It does seem pretty good though. I'm having trouble getting past 25 Mb/s in, 100 Mb/s out on my Edgerouter X.

Rpi 3b has proper gigabit Ethernet though.

Edit: 3B+. My bad.

It doesn't.

Edit: It doesn't.

The 3B+ does though, IIRC (w/ PoE support too)

It doesn't. The ethernet is connected to a USB 2.0 bus. Yes the link trains at 1 gbps, but it's limited by the slow bus.

"faster (300 mbps) Ethernet"[1]

[1]: https://www.adafruit.com/product/3775

It's basically a 1 Gbps PHY connected to 480 Mbps USB 2.0, so it's 240 Mbps Ethernet.

Sure but that article was about using it on a LTE connection and the GP was asking about Pi in general. In the articles setup it's going to be bottlenecked on the cellular network anyway.

(The Pi 3 also is 4 years old now and you wouldn't want to buy it today)

For anyone who wants to operate it in a broader scale: https://github.com/liv-io/ansible-roles-centos/tree/master/w...

Does WireGuard require a kernel module or a specific kernel? (I saw a day or two ago it was in linus' tree). Can I run WireGuard on a digitalocean droplet?

https://www.digitalocean.com/community/tutorials/how-to-crea...

I have really good experience with rasPI first generation and WG running on openWrt. OpenWrt is perfect lightweight OS for this task.

Edge Router X looks interesting. Is there a Raspberry now that offers Dual Gigabit Internet Ports (2XGBit)?

Ironically this looks considerably simpler than trying to get wireguard working on my OpenWRT router (and with much less collateral damage should I mess up).

I might give this a try!

WireGuard on OpenWRT isn't too different or difficult.

The luci-app-wireguard package is a bit quirky at times though.

You'll run into cpu bottlenecks with some of the lower end hardware though.

I've been running a WireGuard VPN on my OpenWrt router for quite a while with no issues whatsoever. Rock solid since I set it up, only has a 4 or 5 peers, but it's been excellent and I highly suggest it versus adding yet another single purpose device.

Not sure why the RPi is so lauded for this and Pi-Hole (which is just a fancy DNS blocklist) when OpenWrt is just as simple and powerful for both (and more) tasks.

My main issue with doing this with OpenWRT is that it is loaded with abstractions. Network, interfaces, firewall zones, bridged zones, etc. When they all work, it's nice and almost magical.

But when setting up new custom zones from scratch (like this VPN subnet/zone), I never feel quite as home as I do with the traditional Linux command-line and iptables.

Basically OpenWRTs abstractions don't map cleanly to the underlying Linux-primitives I know fairly well. The impedance mismatch there is what make me consider the RPi-based solution more preferable, because I understand how and why it works.

I think there's some issues in the config. First of all, at least one of the CIDRs is wrong ("Address = 10.200.200.2/24"). Also by setting AllowedIPs to to 10.200.200.0/24 in the client, only traffic to that subnet will actually go through the VPN, not all traffic.

Isn't there also some missing host/RPI system so that the 10.200.200.0/24 can route to the public internet?

If someone has an example of a full VPN configuration I'd love to see them so I can try it out.

> First of all, at least one of the CIDRs is wrong ("Address = 10.200.200.2/24"). Also by setting AllowedIPs to to 10.200.200.0/24 in the client, only traffic to that subnet will actually go through the VPN, not all traffic.

Not sure what your issue is with the address line.

As for the AllowedIPs, that's intentional. From the first lines of the article:

> An Linux Laptop that should use the VPN only accessing network services that are exposed to the VPN

VPNs aren't just for routing your public traffic through some trusted host.

Is 10.200.200.2/24 a valid cidr? Does the system just ignore the trailing 2 and assume it’s a 0?

10.200.200.2/24 is a shorthand form (a.k.a. "CIDR notation") of saying IP address 10.200.200.2 with a 24-bit subnet mask (255.255.255.0).

Are there any commercial products available for this or Pi-holes?

Yes, I'm also waiting for a lightweight Wireguard/pi-hole appliance.

I've thought about trying to build a commercial pi-hole product. Anyone else?

I've also thought about this. But basically it will be re-packaging a modern linux kernel, giving some support w/ key management and packaging it in a nice case.

I think there is definitely a market for it.

I feel like a Wireguard-only VPN company might be viable and a hardware product would be a good side product

The VPN gives you monthly recurring revenue versus the one-time hardware revenue. Maybe a subscription that includes an up-to-date DNS blacklist for the pi-hole?

Reply on news.ycombinator.com