Back in 2018, ozaki-r@ wrote an in-kernel implementation of WireGuard
<https://www.wireguard.com/> for NetBSD -- a point-to-point roaming-
capable virtual private network tunnel with modern cryptography.
Today I imported Ozaki-san's WireGuard code into NetBSD proper.
Here's an example of how to use it, taken from the new wg(4) man page.
You'll need to build a kernel config with `pseudo-device wg' in it --
it's not in any GENERIC kernels yet, and there's no loadable module
yet. (Both of these will change -- also, you can try it without any
kernel changes using the wg-userspace(8) tool which runs in userland
with a rump server and tun(4); see the man page for details.)
Typical network topology:
wm0 = 1.2.3.4 bge0 = 4.3.2.1
Stationary server: Roaming client:
+---------+ +---------+
| A | | B |
|---------| |---------|
| [wm0]-------------internet--------[bge0] |
| [wg0] port 1234 - - - (tunnel) - - - - - - [wg0] |
| 10.0.1.0 | 10.0.1.1 |
| | | | |
+--[wm1]--+ +-----------------+ +---------+
| | VPN 10.0.1.0/24 |
| +-----------------+
+-----------------+
| LAN 10.0.0.0/24 |
+-----------------+
Generate key pairs on A and B:
A# wg-keygen > /etc/wireguard/wg0
A# wg-keygen --pub < /etc/wireguard/wg0 > /etc/wireguard/wg0.pub
A# cat /etc/wireguard/wg0.pub
N+B4Nelg+4ysvbLW3qenxIwrJVE9MdjMyqrIisH7V0Y=
B# wg-keygen > /etc/wireguard/wg0
B# wg-keygen --pub < /etc/wireguard/wg0 > /etc/wireguard/wg0.pub
B# cat /etc/wireguard/wg0.pub
X7EGm3T3IfodBcyilkaC89j0SH3XD6+/pwvp7Dgp5SU=
Configure A to listen on port 1234 and allow connections from B to
appear in the 10.0.1.0/24 subnet:
A# ifconfig wg0 create 10.0.1.0/24
A# wgconfig wg0 set private-key /etc/wireguard/wg0
A# wgconfig wg0 set listen-port 1234
A# wgconfig wg0 add peer B \
X7EGm3T3IfodBcyilkaC89j0SH3XD6+/pwvp7Dgp5SU= \
--allowed-ips=10.0.1.1/32
A# ifconfig wg0 up
A# ifconfig wg0
wg0: flags=0x51<UP,POINTOPOINT,RUNNING> mtu 1420
inet 10.0.1.0/24 -> flags 0
Configure B to connect to A at 1.2.3.4 on port 1234 and the packets
can begin to flow:
B# ifconfig wg0 create 10.0.1.1/24
B# wgconfig wg0 set private-key /etc/wireguard/wg0
B# wgconfig wg0 add peer A \
N+B4Nelg+4ysvbLW3qenxIwrJVE9MdjMyqrIisH7V0Y= \
--allowed-ips=10.0.1.0/32 \
--endpoint=1.2.3.4:1234
B# ifconfig wg0 up
B# ifconfig wg0
wg0: flags=0x51<UP,POINTOPOINT,RUNNING> mtu 1420
inet 10.0.1.1/24 -> flags 0
B# ping -n 10.0.1.0
PING 10.0.1.0 (10.0.1.0): 56 data bytes
64 bytes from 10.0.1.0: icmp_seq=0 ttl=255 time=2.721110 ms
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.3