Qubes-Community-Content/docs/wireguard/README.md

Using WireGuard as VPN in QubesOS

Based on https://www.scaleway.com/en/docs/installing-wireguard-vpn-linux/

To use this guide you need VPS to use as VPN server.

Use Debian 10 on both server and client.

On both server and client

In Qubes, do the following steps in TemplateVM (debian-10).

If needed, enable buster-backports:

$ echo 'deb http://deb.debian.org/debian buster-backports main' | sudo tee /etc/apt/sources.list.d/buster-backports.list
$ sudo apt-get update

If needed, install kernel headers:

$ sudo apt-get install linux-headers-amd64

Install WireGuard:

$ sudo apt-get install wireguard resolvconf

Make sure kernel module was installed:

$ sudo modprobe wireguard
$ echo $?
0

In Qubes, shutdown debian-10 TemplateVM and do the following steps in ProxyVM sys-wireguard based on debian-10. On the server, continue in the same terminal.

Generating Public and Private Keys

# mkdir -p /etc/wireguard/keys
# cd /etc/wireguard/keys
# umask 077
# wg genkey | tee privatekey | wg pubkey > publickey

On server

Create the file /etc/wireguard/wg0.conf with the following content:

[Interface]
PrivateKey = <private key of the server>
Address = 192.168.66.1/32
ListenPort = <random port for server>
PostUp = sysctl -w net.ipv4.ip_forward=1; iptables -A FORWARD -i %i -o %i -j DROP; iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -o %i -j DROP; iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <public key of the client>
AllowedIPs = 192.168.66.2/32

<add more clients if needed>

Run:

$ sudo wg-quick up wg0

You can also enable the start of WireGuard on server at boot time with the following command:

$ sudo systemctl enable wg-quick@wg0.service

On client

Create the file /home/user/wg0.conf with the following content:

[Interface]
PrivateKey = <private key of the client>
Address = 192.168.66.2/32
DNS = 1.1.1.1
PostUp = iptables -t nat -I PREROUTING 1 -p udp -m udp --dport 53 -j DNAT --to-destination 1.1.1.1; iptables -t nat -I POSTROUTING 3 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

[Peer]
PublicKey = <public key of the client>
Endpoint = <public ip of server>:<public port of server>
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Run:

$ sudo wg-quick up /home/user/wg0.conf

It should work at this point.

Add the following to /rw/config/rc.local:

wg-quick up /home/user/wg0.conf

Then chmod +x /rw/config/rc.local

Then go to Qubes firewall settings and limit outgoing connections to UDP <public ip of server>:<public port of server>. Then do to dom0 console and use qvm-firewall command to remove unneeded exceptions for ICMP and DNS:

$ qvm-firewall sys-wireguard
... 4 rules, including unwanted DNS and ICMP rules ...
$ qvm-firewall sys-wireguard del --rule-no 1
$ qvm-firewall sys-wireguard del --rule-no 1
$ qvm-firewall sys-wireguard
... 2 rules ...

Make sure it now has only the server rule and then DROP.

On Android/iOS

You can use wireguard on Android or iOS devices.

Android: https://play.google.com/store/apps/details?id=com.wireguard.android&hl=fr

iOS: https://apps.apple.com/us/app/wireguard/id1441195209?ls=1

In the app, select Create from scratch and configure it the same way you did in sys-wireguard. The form has the same fields as the file.