Install WireGuard VPN Server on OpenBSD 7.0
WireGuard VPN is a free, open-source virtual private network (VPN) solution that implements modern cryptography to secure network connections. It is lightweight, fast, and easy to deploy since it uses public-key exchanges to create a VPN connection.
In this article, you install WireGuard VPN Server on OpenBSD 7.0 and configure a client connection to the server. Private addresses, 10.0.0.1/32, 10.0.0.2/32 are used as WireGuard server and client addresses, respectively. You can formulate a custom IP class for the VPN network.
Prerequisites
- Deploy an OpenBSD Server
- SSH and Login as root
Install WireGuard VPN Server.
Install Nano.
Configure WireGuard Server
First, allow forwarding on your server interfaces with the following commands:
Output:
Add the entries to /etc/sysctl.conf.
Next, create the WireGuard configuration files directory.
Generate Keys
Change to the WireGuard configuration files directory, and set up the wg0.conf file that contains all server configurations.
Generate a new private key.
Then, generate a new public key.
Now, create the configuration file.
View, and copy the private and public keys.
Output: (Your values should be different)
Now, open and edit the configuration file using a text editor of your choice.
Paste the following contents. Replace Server Private Key with the private key generated earlier. As well, enter your client IP (local for the VPN network) in the Allowed IPS = section, or simply enter 0.0.0.0/0, ::/0 to allow connections from all addresses.
Save and close the file.
Next, open and edit the firewall configuration file at /etc/pf.conf.
Paste the following contents to allow connections and NAT traffic from the WireGuard interface.
Save and close the file.
Restart the firewall.
Additionally, create a new hostname file for the WireGuard interface.
Paste the following contents:
Now, activate the WireGuard interface.
Run ifconfig to confirm if a new wg0 interface is created.
Your output should be similar to:
Use wg to view the current WireGuard server status.
Your output should be similar to:
Optional: Configure WireGuard Client
Depending on your setup, you can configure the WireGuard client on another OpenBSD server or your local machine running Windows, macOS, Linux. For purposes of this article, set up WireGuard client on another OpenBSD and test the connection.
Repeat all the above WireGuard server configuration steps and only change values in the wg0.conf file. Also, assign a different local IP Address 10.0.0.2/32 in your hostname.wg0 file.
Generate client keys.
Edit the WireGuard configuration file.
Paste the following contents:
Enter the generated client private key, then enter the server public key copied earlier. In the EndPoint = section, enter your OpenBSD public IP Address.
Edit the hostname.wg0 file.
Paste the following code:
Save and close the file.
Activate the Interface.
Edit your firewall configuration file.
Paste the following rules:
Save and close the file.
Restart Firewall.
To add new clients on the server, simply repeat the above processes, and include a new [peer] section for every client.
Test your WireGuard VPN Server
Your WireGuard VPN Server is up and forwarding packets on your OpenBSD server. Depending on your client computer (whether another server or local computer), test your VPN by pinging your server.
On the server machine, run wg to view the connection details.
Your output should be similar to:
Traffic from the client machine is indicated as transfer: received.
Conclusion
You have successfully set up WireGuard VPN server on OpenBSD, all connected clients will have Internet access through the server. Note that the 10.0.0.0/32 addresses are not provided by Vultr, but rather created for the VPN network. To learn more about WireGuard VPN, consider viewing the official documentation.
0 Comments
Be the first to comment and share your perspective with the community.