WireGuard is a fast and secure VPN protocol that uses state-of-the-art cryptography. It is designed to be easy to implement and manage, and has a minimal attack surface. Its simplicity and efficiency make it well-suited for use in mobile devices and large-scale deployments.
Note: Before making any major changes on your EdgeOS router, always make a backup.Refer to the official documentation on how to perform one.
Step 1. Installation
Note: The following installation guide was verified working on EdgeOS v2.0.9-hotfix.4 as of Feb 2023.
Verify your EdgeOS version
| |
Download Wireguard
Head over to WireGuard’s EdgeOS releases and look for the release that matches your platform/version.
On the ER-X, use curl to download the .deb file
| |
Install with dpkg
| |
Output Log
| |
If there is no space available
If additional storage space is needed, you can safely delete the backup system image (not the currently running firmware).
| |
You can check if wireguard is installed by running:
| |
Output log:
| |
Step 2. Key Creation
Confirm working directory
| |
Generate Server Keys
Create folder for your server keysYou can create it in the /config directory to preserve your files during upgrades, and to make it easier during backups.
| |
Create a folder wireguard, then create another folder for server_keys
| |
Generate a key pair for the Wireguard server
| |
Note your public and private key for the next configuration steps.
| |
Generate Client Keys
Move to wireguard directory.
| |
Create folder wg_clients
| |
Create folder for client01
| |
Generate client keys.
| |
Note your public and private key for the next configuration steps.
| |
Example output:
| |
Step 3. wg0 Interface Configuration
Enter configure mode
| |
Set the location of the server’s private-key, previously generated
| |
Create the Gateway IP for the VPN and the subnetThis subnet can be any private IP range, though make sure to check for conflicts
| |
Create entries in the route table for the VPN subnet
| |
Set the UDP port for WG (that peers will use)WireGuard default port is 51820, but can be changed to any port
| |
Save
| |
Step 4. Adding peers to the wg0 Interface
Adding Client 01
Note: make sure you are in configure mode.
| |
| |
| |
Adding Additional Clients
When adding additional peers, repeat the steps above, make sure to update allowed-ips and description for the new clients.
| |
| |
| |
Save
| |
Step 5. Create firewall rules for WireGuard
Create an accept rule in WAN_LOCAL to accept all incoming UDP connections from port 51820 (or any port of your choice).
| |
Save
| |
Once this is done, your wg0 interface and firewall configuration should look something like this.
| |
Step 6. Constructing the Config on the peer side
Config File (.conf)
Create a file on the peer, with the file extension as .conf
The peer side needs a few pieces of information to create the tunnel:
- The server’s public key
- The server’s endpoint (public IP address, or DNS record)
- The peer’s
private key - The peer’s IP address in the VPN subnet (the allowed IPs value set on the server)
Therefore, the previously generated client01 private-key and the server-public-key, should be copied to the peer device.
The configuration should look something like the one below:
Example Client 01
| |
Example Client 02
| |
Once the .conf file is created, you can import that into the peer/device of your choice.
To bring up your tunnel, you can use the wg-quick command.
| |
Run wg show on your peer to verify you are connected to the endpoint.
| |
Step 7. Save WireGuard Keys and Configuration Files
Once the above configuration is made, you can easily save the config by running a backup from the Edgerouter’s GUI.
- Navigate to the System tab in the bottom-left of the GUI to download the backup configuration archive.
System > Configuration Management & Device Maintenance > Back Up Config
Download the backup config file by clicking on the Download button.
The EdgeRouter will prompt you to save the archive on your computer.
You can then extract this file on your local machine, and in the /config directory, you’ll find the wireguard public and private keys you generated earlier.
Warning, the following script is not guaranteed to work, you may need to modify it according to your specific platform/version. Use at your own risk.
Determine shell with echo $SHELL
| |
EdgeOS comes with vi, you can use that to create the script.
| |
NOTE: Make sure to modify your $SHELL in case it differs, for EdgeOS, it will usually be #!/bin/vbash
Paste the following:
| |
Make executable
| |
Run
| |
Sources:
