ditatompel/insights
1
0
Fork 0
mirror of https://github.com/ditatompel/insights.git synced 2025-01-08 03:12:06 +07:00
Code Issues Projects Releases Packages Wiki Activity

feat: Remove fiver link

Browse source
This commit is contained in:
Cristian Ditaputratama 2024-10-13 21:55:11 +07:00
parent aa252122c3
commit bcaa2b89ad
Signed by: ditatompel
GPG key ID: 31D3D06D77950979
4 changed files with 235 additions and 222 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

90
content/tutorials/configure-wireguard-vpn-clients/index.id.md
View file

@ -1,6 +1,7 @@
--- ---
title: "Mengkonfigurasi WireGuard VPN Client" title: "Mengkonfigurasi WireGuard VPN Client"
description: "Informasi mengenai cara mengimport konfigurasi VPN WireGuard Anda ke Android, iOS, MacOS, Windows dan Linux." description: "Informasi mengenai cara mengimport konfigurasi VPN WireGuard Anda ke Android, iOS, MacOS, Windows dan Linux."
summary: "Artikel ini berisi informasi mengenai cara untuk mengimport konfigurasi WireGuard VPN Anda ke Android, iOS/iPhone, MacOS, Windows dan Linux."
# linkTitle: # linkTitle:
date: 2023-06-06T23:51:13+07:00 date: 2023-06-06T23:51:13+07:00
lastmod: lastmod:
@ -13,17 +14,17 @@ nav_weight: 1000
# name: toggles # name: toggles
# color: '#e24d0e' # color: '#e24d0e'
series: series:
- WireGuard VPN - WireGuard VPN
categories: categories:
- Privasi - Privasi
- Networking - Networking
tags: tags:
- WireGuard - WireGuard
- iPhone - iPhone
- Android - Android
- Linux - Linux
- Windows - Windows
- MacOS - MacOS
images: images:
# menu: # menu:
# main: # main:
@ -34,13 +35,8 @@ images:
# name: book # name: book
# color: '#e24d0e' # color: '#e24d0e'
authors: authors:
- ditatompel - ditatompel
- vie - vie
---
Artikel ini berisi informasi mengenai cara untuk **mengimport** konfigurasi **WireGuard VPN** Anda ke **Android**, **iOS/iPhone**, **MacOS**, **Windows** dan **Linux**.
<!--more-->
--- ---
Artikel ini adalah bagian dari [seri **WireGuard VPN**](https://insights.ditatompel.com/id/series/wireguard-vpn/). Jika Anda belum membaca artikel sebelumnya dari seri ini, Anda mungkin akan tertarik untuk membaca [Cara Setup **VPN Server WireGuard** Sendiri]({{< ref "/tutorials/how-to-setup-your-own-wireguard-vpn-server/index.id.md" >}}) atau [Menginstall WireGuard-UI untuk Mengatur WireGuard Server Anda]({{< ref "/tutorials/installing-wireguard-ui-to-manage-your-wireguard-vpn-server/index.id.md" >}}). Artikel ini adalah bagian dari [seri **WireGuard VPN**](https://insights.ditatompel.com/id/series/wireguard-vpn/). Jika Anda belum membaca artikel sebelumnya dari seri ini, Anda mungkin akan tertarik untuk membaca [Cara Setup **VPN Server WireGuard** Sendiri]({{< ref "/tutorials/how-to-setup-your-own-wireguard-vpn-server/index.id.md" >}}) atau [Menginstall WireGuard-UI untuk Mengatur WireGuard Server Anda]({{< ref "/tutorials/installing-wireguard-ui-to-manage-your-wireguard-vpn-server/index.id.md" >}}).
@ -51,7 +47,8 @@ Untuk Windows, MacOS, Android, dan iOS, yang perlu anda lakukan adalah mengimpor
Meskipun cara mensettingnya cukup mudah, saya akan tetap menuliskan langkah-langkah untuk menginstall atau mengimport konfigurasi WireGuard disini untuk keperluan dokumentasi pribadi. Meskipun cara mensettingnya cukup mudah, saya akan tetap menuliskan langkah-langkah untuk menginstall atau mengimport konfigurasi WireGuard disini untuk keperluan dokumentasi pribadi.
Konfigurasi WireGuard yang diberikan oleh penyedia layanan VPN atau Sistem Administrator Anda sebenarnya hanyalah sebuah *text* file saja, biasanya akan terlihat seperti berikut: Konfigurasi WireGuard yang diberikan oleh penyedia layanan VPN atau Sistem Administrator Anda sebenarnya hanyalah sebuah _text_ file saja, biasanya akan terlihat seperti berikut:
```plain ```plain
[Interface] [Interface]
Address = 10.10.88.5/32 Address = 10.10.88.5/32
@ -66,61 +63,72 @@ AllowedIPs = 0.0.0.0/0
Endpoint = xx.xx.xx0.246:51822 Endpoint = xx.xx.xx0.246:51822
PersistentKeepalive = 15 PersistentKeepalive = 15
``` ```
> _Bagian alamat IP dari `[Peer] Endpoint` diatas dihapus untuk alasan privasi dan keamanan._ > _Bagian alamat IP dari `[Peer] Endpoint` diatas dihapus untuk alasan privasi dan keamanan._
## iPhone / iOS ## iPhone / iOS
Download [official WireGuard client untuk iOS dari App Store](https://apps.apple.com/us/app/wireguard/id1441195209?ls=1), pastikan bahwa aplikasi berasal dari **"[WireGuard Development Team](https://apps.apple.com/us/developer/wireguard-development-team/id1441195208)"**. Download [official WireGuard client untuk iOS dari App Store](https://apps.apple.com/us/app/wireguard/id1441195209?ls=1), pastikan bahwa aplikasi berasal dari **"[WireGuard Development Team](https://apps.apple.com/us/developer/wireguard-development-team/id1441195208)"**.
Kemudian Anda dapat mengimport konfigurasi dengan menekan tombol <kbd>+</kbd> yang terletak di sisi layar kanan atas dari aplikasi WireGuard. Kemudian Anda dapat mengimport konfigurasi dengan menekan tombol <kbd>+</kbd> yang terletak di sisi layar kanan atas dari aplikasi WireGuard.
### Menggunakan QR Code ### Menggunakan QR Code
1. Jika penyedia layanan VPN Anda memberikan gambar **QR Code** untuk konfigurasi WireGuardnya, pilih **"Create from QR code"** kemudian *scan* gambar **QR Code** yang diberikan tersebut.
2. Ketika diminta untuk memasukan **name of the scanned tunnel** ([*contoh gambar*](wg-ios1.png)), isi saja dengan apapun yang bisa Anda ingat dengan mudah. *Hindari menggunakan karakter selain `-` dan `[a-z]`*. Profile koneksi VPN baru yang baru saja Anda tambahkan akan muncul di aplikasi WireGuard Anda. 1. Jika penyedia layanan VPN Anda memberikan gambar **QR Code** untuk konfigurasi WireGuardnya, pilih **"Create from QR code"** kemudian _scan_ gambar **QR Code** yang diberikan tersebut.
2. Ketika diminta untuk memasukan **name of the scanned tunnel** ([_contoh gambar_](wg-ios1.png)), isi saja dengan apapun yang bisa Anda ingat dengan mudah. _Hindari menggunakan karakter selain `-` dan `[a-z]`_. Profile koneksi VPN baru yang baru saja Anda tambahkan akan muncul di aplikasi WireGuard Anda.
### Menggunakan import file atau archive ### Menggunakan import file atau archive
1. Untuk mengimport konfigurasi dari file `.conf`, Anda perlu mendownload terlebih dahulu konfigurasi tersebut ke perangkat Anda. 1. Untuk mengimport konfigurasi dari file `.conf`, Anda perlu mendownload terlebih dahulu konfigurasi tersebut ke perangkat Anda.
2. Setelah konfigurasi tersebut terdownload ke perangkat Anda, pilih **"Create from file or archive"** dan import konfigurasi WireGuard Anda. 2. Setelah konfigurasi tersebut terdownload ke perangkat Anda, pilih **"Create from file or archive"** dan import konfigurasi WireGuard Anda.
_Ingat, hindari menggunakan karakter selain `-` dan `[a-z]` untuk **interface** **"name"**_. _Ingat, hindari menggunakan karakter selain `-` dan `[a-z]` untuk **interface** **"name"**_.
Setelah konfigurasi berhasil diimport, cukup tap tombol **"_switch_ Active"** pada profile VPN ke **on** untuk mengkatifkan koneksi VPN [[*contoh gambar connected VPN WireGuard yang aktif di iOS*](wg-ios2.png)]. Setelah konfigurasi berhasil diimport, cukup tap tombol **"_switch_ Active"** pada profile VPN ke **on** untuk mengkatifkan koneksi VPN [[_contoh gambar connected VPN WireGuard yang aktif di iOS_](wg-ios2.png)].
## Android ## Android
Download [official WireGuard client untuk Android dari Play Store](https://play.google.com/store/apps/details?id=com.wireguard.android),pastikan bahwa aplikasi berasal dari **"[WireGuard Development Team](https://play.google.com/store/apps/developer?id=WireGuard+Development+Team)"**. Download [official WireGuard client untuk Android dari Play Store](https://play.google.com/store/apps/details?id=com.wireguard.android),pastikan bahwa aplikasi berasal dari **"[WireGuard Development Team](https://play.google.com/store/apps/developer?id=WireGuard+Development+Team)"**.
Anda dapat mengimport konfigurasi dengan menekan tombol <kbd>+</kbd> yang terletak di sisi layar kanan bawah dari aplikasi WireGuard. Anda dapat mengimport konfigurasi dengan menekan tombol <kbd>+</kbd> yang terletak di sisi layar kanan bawah dari aplikasi WireGuard.
### Menggunakan QR Code ### Menggunakan QR Code
1. Jika penyedia layanan VPN Anda memberikan gambar **QR Code** untuk konfigurasi WireGuardnya, pilih **"Scan from QR code"** kemudian *scan* gambar **QR Code** yang diberikan tersebut.
2. Ketika diminta untuk memasukan **Tunnel Name** ([*contoh gambar*](wg-android1.png)), isi saja dengan apapun yang bisa Anda ingat dengan mudah. *Hindari menggunakan karakter selain `-` dan `[a-z]`*. Profile koneksi VPN baru yang baru saja Anda tambahkan akan muncul di aplikasi WireGuard Anda. 1. Jika penyedia layanan VPN Anda memberikan gambar **QR Code** untuk konfigurasi WireGuardnya, pilih **"Scan from QR code"** kemudian _scan_ gambar **QR Code** yang diberikan tersebut.
2. Ketika diminta untuk memasukan **Tunnel Name** ([_contoh gambar_](wg-android1.png)), isi saja dengan apapun yang bisa Anda ingat dengan mudah. _Hindari menggunakan karakter selain `-` dan `[a-z]`_. Profile koneksi VPN baru yang baru saja Anda tambahkan akan muncul di aplikasi WireGuard Anda.
### Menggunakan import file atau archive ### Menggunakan import file atau archive
1. Untuk mengimport konfigurasi dari file `.conf`, Anda perlu mendownload terlebih dahulu konfigurasi tersebut ke perangkat Anda. 1. Untuk mengimport konfigurasi dari file `.conf`, Anda perlu mendownload terlebih dahulu konfigurasi tersebut ke perangkat Anda.
2. Setelah konfigurasi tersebut terdownload ke perangkat Anda, pilih **"Import from file or archive"** dan import konfigurasi WireGuard Anda. 2. Setelah konfigurasi tersebut terdownload ke perangkat Anda, pilih **"Import from file or archive"** dan import konfigurasi WireGuard Anda.
_Ingat, hindari menggunakan karakter selain `-` dan `[a-z]` untuk **interface** **"name"**_. _Ingat, hindari menggunakan karakter selain `-` dan `[a-z]` untuk **interface** **"name"**_.
Setelah konfigurasi berhasil diimport, cukup tap tombol **"_switch_ Active"** pada profile VPN ke **on** untuk mengkatifkan koneksi VPN [[*contoh gambar connected VPN WireGuard yang aktif di Android*](wg-android2.png)]. Setelah konfigurasi berhasil diimport, cukup tap tombol **"_switch_ Active"** pada profile VPN ke **on** untuk mengkatifkan koneksi VPN [[_contoh gambar connected VPN WireGuard yang aktif di Android_](wg-android2.png)].
## Windows dan MacOS ## Windows dan MacOS
Saya meletakan Windows dan MacOS di sesi yang sama karena mengimport konfigurasi WireGuard untuk sistem operasi Windows dan MacOS cukup mirip. Setelah aplikasi [official WireGuard](https://www.wireguard.com/install/) terinstall: Saya meletakan Windows dan MacOS di sesi yang sama karena mengimport konfigurasi WireGuard untuk sistem operasi Windows dan MacOS cukup mirip. Setelah aplikasi [official WireGuard](https://www.wireguard.com/install/) terinstall:
1. Klik tombol "**Add Tunnel**" (atau pada *icon dropdown*-nya) dan "**Import tunnel(s) from file...**", kemudian pilih file konfigurasi WireGuard Anda. 1. Klik tombol "**Add Tunnel**" (atau pada _icon dropdown_-nya) dan "**Import tunnel(s) from file...**", kemudian pilih file konfigurasi WireGuard Anda.
2. Setelah berhasil melakukan konesi VPN WireGuard, coba lakukan pengecekan alamat IP publik Anda. Jika semua konfigurasi benar, maka IP VPN server Anda yang seharusnya tampil saat pengecekan, bukan IP dari ISP Anda. 2. Setelah berhasil melakukan konesi VPN WireGuard, coba lakukan pengecekan alamat IP publik Anda. Jika semua konfigurasi benar, maka IP VPN server Anda yang seharusnya tampil saat pengecekan, bukan IP dari ISP Anda.
![Koneksi VPN WireGuard di Windows](wg-windows-connected.png#center) ![Koneksi VPN WireGuard di Windows](wg-windows-connected.png#center)
## Linux ## Linux
Untuk pengguna Linux, Anda perlu menginstall *package* `wireguard` ke sistem Anda. Cari tahu [bagaimana cara menginstall WireGuard dari situs resmi WireGuard](https://www.wireguard.com/install/) atau dari halaman dokumentasi *distro* yang Anda gunakan.
Untuk pengguna Linux, Anda perlu menginstall _package_ `wireguard` ke sistem Anda. Cari tahu [bagaimana cara menginstall WireGuard dari situs resmi WireGuard](https://www.wireguard.com/install/) atau dari halaman dokumentasi _distro_ yang Anda gunakan.
### Menggunakan wg-quick ### Menggunakan wg-quick
Cara paling mudah dan paling *simple* untuk menggunakan WireGuard adalah dengan menggunakan `wg-quick` yang tersedia setelah Anda menginstall *package* `wireguard`. Letakkan file konfigurasi WireGuard dari penyedia layanan VPN Anda ke `/etc/wireguard` dan lakukan koneksi ke VPN server menggunakan perintah berikut:
Cara paling mudah dan paling _simple_ untuk menggunakan WireGuard adalah dengan menggunakan `wg-quick` yang tersedia setelah Anda menginstall _package_ `wireguard`. Letakkan file konfigurasi WireGuard dari penyedia layanan VPN Anda ke `/etc/wireguard` dan lakukan koneksi ke VPN server menggunakan perintah berikut:
```shell ```shell
sudo systemctl start wg-quick@<interface-name>.service. sudo systemctl start wg-quick@<interface-name>.service.
``` ```
Ubah `<interface-name>` diatas dengan nama file (tanpa ekstensi `.conf`) dari konfigurasi WireGuard yang diberikan oleh penyedia layanan VPN Anda. Ubah `<interface-name>` diatas dengan nama file (tanpa ekstensi `.conf`) dari konfigurasi WireGuard yang diberikan oleh penyedia layanan VPN Anda.
Sebagai contoh, jika Anda mengubah nama file `wg0.conf` ke `wg-do1.conf` yang berada di folder `/etc/wireguard`, Anda bisa melakukan koneksi ke VPN server menggunakan perintah `sudo systemctl start wg-quick@wg-do1.service`. Sebagai contoh, jika Anda mengubah nama file `wg0.conf` ke `wg-do1.conf` yang berada di folder `/etc/wireguard`, Anda bisa melakukan koneksi ke VPN server menggunakan perintah `sudo systemctl start wg-quick@wg-do1.service`.
Cobalah melakukan pengecekan koneksi WireGuard dengan mengecek alamat IP publik Anda dari browser atau terminal (`curl ifconfig.me`). Jika alamat IP yang terdeteksi masih alamat IP dari ISP yang Anda gunakan, perintah pertama untuk melakukan *troubleshot* adalah `sudo wg show` atau `sudo systemctl status wg-quick@wg-do1.service`. Cobalah melakukan pengecekan koneksi WireGuard dengan mengecek alamat IP publik Anda dari browser atau terminal (`curl ifconfig.me`). Jika alamat IP yang terdeteksi masih alamat IP dari ISP yang Anda gunakan, perintah pertama untuk melakukan _troubleshot_ adalah `sudo wg show` atau `sudo systemctl status wg-quick@wg-do1.service`.
> _**Catatan 1**: Secara default, `wg-quick` menggunalan `resolvconf` untuk memasukan entri **DNS** baru. Hal ini akan menimbulkan masalah dengan **network manager** dan **DHCP client** yang tidak menggunakan `resolvconf`, karena mereka akan menulis ulang entri DNS di `/etc/resolv.conf` (yang akan menghapus DNS server yang telah ditambahkan oleh perintah `wg-quick`)._ > _**Catatan 1**: Secara default, `wg-quick` menggunalan `resolvconf` untuk memasukan entri **DNS** baru. Hal ini akan menimbulkan masalah dengan **network manager** dan **DHCP client** yang tidak menggunakan `resolvconf`, karena mereka akan menulis ulang entri DNS di `/etc/resolv.conf` (yang akan menghapus DNS server yang telah ditambahkan oleh perintah `wg-quick`)._
> _Solusinya adalah dengan menggunakan software network manager yang mensupport `resolvconf`._ > _Solusinya adalah dengan menggunakan software network manager yang mensupport `resolvconf`._
@ -128,25 +136,30 @@ Cobalah melakukan pengecekan koneksi WireGuard dengan mengecek alamat IP publik
> _**Catatan 2**: Pengguna `systemd-resolved` harus memastikan bahwa `systemd-resolvconf` terinstall dan berjalan dengan baik._ > _**Catatan 2**: Pengguna `systemd-resolved` harus memastikan bahwa `systemd-resolvconf` terinstall dan berjalan dengan baik._
### Mengunakan NetworkManager ### Mengunakan NetworkManager
**NetworkManager** pada *bleeding-edge* atau *rolling release distro* seperti **Arch Linux** sudah mensupport WireGuard VPN secara *native*.
**NetworkManager** pada _bleeding-edge_ atau _rolling release distro_ seperti **Arch Linux** sudah mensupport WireGuard VPN secara _native_.
#### Menggunakan NetworkManager TUI & GUI #### Menggunakan NetworkManager TUI & GUI
![NetworkManager tui](wg-nmtui.png#center) ![NetworkManager tui](wg-nmtui.png#center)
Anda dapat dengan mudah mengkonfigurasi koneksi WireGuard dan *peers*-nya menggunakan **NetworkManager TUI** atau **GUI**. Pada contoh ini, saya akan menggunakan **NetworkManager GUI**. Anda dapat dengan mudah mengkonfigurasi koneksi WireGuard dan _peers_-nya menggunakan **NetworkManager TUI** atau **GUI**. Pada contoh ini, saya akan menggunakan **NetworkManager GUI**.
1. Buka **NetworkManager** GUI, klik <kbd>+</kbd> untuk menambahkan koneksi. 1. Buka **NetworkManager** GUI, klik <kbd>+</kbd> untuk menambahkan koneksi.
2. Pilih "**Import a saved VPN configuration**" import konfigurasi WireGuard Anda. 2. Pilih "**Import a saved VPN configuration**" import konfigurasi WireGuard Anda.
3. Kemudian, Anda dapat mengubah "**Connection name**" dan "**Interface name**" ke apapun yang bisa Anda ingat dengan mudah. Tapi, **Hindari menggunakan karakter selain `-` dan `[a-z]`** untuk "**Interface name**". Koneksi tidak akan berjalan jika Anda menggunakan karakter spesial seperi *spasi*. 3. Kemudian, Anda dapat mengubah "**Connection name**" dan "**Interface name**" ke apapun yang bisa Anda ingat dengan mudah. Tapi, **Hindari menggunakan karakter selain `-` dan `[a-z]`** untuk "**Interface name**". Koneksi tidak akan berjalan jika Anda menggunakan karakter spesial seperi _spasi_.
![NetworkManager gui](wg-nmgui.png#center) ![NetworkManager gui](wg-nmgui.png#center)
#### Menggunakan nmcli #### Menggunakan nmcli
`nmcli` dapat mengimport konfigurasi `wg-quick`. Sebagai contoh, untuk mengimport konfigurasi WireGuard dari `/etc/wireguard/t420.conf`: `nmcli` dapat mengimport konfigurasi `wg-quick`. Sebagai contoh, untuk mengimport konfigurasi WireGuard dari `/etc/wireguard/t420.conf`:
```shell ```shell
nmcli connection import type wireguard file /etc/wireguard/t420.conf nmcli connection import type wireguard file /etc/wireguard/t420.conf
``` ```
Meskipun `nmcli` dapat membuat profil koneksi WireGuard, tetapi ia tidak mendukung konfigurasi untuk *peer*. Berikut ini adalah contoh konfigurasi WireGuard melalui format `.nmconnection` file yang ada pada folder `/etc/NetworkManager/system-connections/` untuk *multiple peers* dan *custom routing*: Meskipun `nmcli` dapat membuat profil koneksi WireGuard, tetapi ia tidak mendukung konfigurasi untuk _peer_. Berikut ini adalah contoh konfigurasi WireGuard melalui format `.nmconnection` file yang ada pada folder `/etc/NetworkManager/system-connections/` untuk _multiple peers_ dan _custom routing_:
```plain ```plain
[connection] [connection]
@ -179,12 +192,11 @@ method=manual
addr-gen-mode=stable-privacy addr-gen-mode=stable-privacy
method=ignore method=ignore
``` ```
![nmcli wireguard connection example](wg-nmcli.png#center) ![nmcli wireguard connection example](wg-nmcli.png#center)
## Catatan ## Catatan
- Anda tidak dapat melakukan koneksi ke VPN server yang sama dari 2 perangkat atau lebih dengan **key** yang sama. **Setiap perangkat HARUS memiliki _key_ yang unik**.
- Untuk beberapa sistem operasi seperti Windoes, jika Anda tidak dapat mengimport konfigurasi WireGuard Anda ke aplikasi WireGuard, pastikan bahwa file konfigurasi Anda berekstensi `.conf`.
### Catatan Tambahan - Anda tidak dapat melakukan koneksi ke VPN server yang sama dari 2 perangkat atau lebih dengan **key** yang sama. **Setiap perangkat HARUS memiliki _key_ yang unik**.
- Jika Anda tertarik untuk [memiliki **VPN Server WireGuard** Sendiri]({{< ref "/tutorials/how-to-setup-your-own-wireguard-vpn-server/index.id.md" >}}) tetapi mengalami kesulitan atau keterbatasan secara teknis, saya dapat membantu Anda untuk melakukannya dengan imbalan sedikit uang. (_Saya juga menerima **Monero XMR** sebagai **imbalan** jika Anda tidak memiliki mata uang Rupiah_). - Untuk beberapa sistem operasi seperti Windoes, jika Anda tidak dapat mengimport konfigurasi WireGuard Anda ke aplikasi WireGuard, pastikan bahwa file konfigurasi Anda berekstensi `.conf`.
- Untuk dapat menghubungi saya, silahkan kunjungi [https://www.ditatompel.com/pages/contact](https://www.ditatompel.com/pages/contact).

95
content/tutorials/configure-wireguard-vpn-clients/index.md
View file

@ -1,6 +1,7 @@
--- ---
title: "Configure WireGuard VPN Clients" title: "Configure WireGuard VPN Clients"
description: "Information about how to import your WireGuard VPN config to your Android, iOS, MacOS, Windows and Linux machine." description: "Information about how to import your WireGuard VPN config to your Android, iOS, MacOS, Windows and Linux machine."
summary: "This article contains information about how to import your WireGuard VPN config to your Android, iOS/iPhone, macOS, Windows and Linux machine."
# linkTitle: # linkTitle:
date: 2023-06-06T23:51:13+07:00 date: 2023-06-06T23:51:13+07:00
lastmod: lastmod:
@ -8,49 +9,33 @@ draft: false
noindex: false noindex: false
# comments: false # comments: false
nav_weight: 1000 nav_weight: 1000
# nav_icon:
# vendor: bootstrap
# name: toggles
# color: '#e24d0e'
series: series:
- WireGuard VPN - WireGuard VPN
categories: categories:
- Privacy - Privacy
- Networking - Networking
tags: tags:
- WireGuard - WireGuard
- iPhone - iPhone
- Android - Android
- Linux - Linux
- Windows - Windows
- MacOS - MacOS
images: images:
# menu:
# main:
# weight: 100
# params:
# icon:
# vendor: bs
# name: book
# color: '#e24d0e'
authors: authors:
- ditatompel - ditatompel
---
This article contains information about how to **import** your **WireGuard VPN** config to your **Android**, **iOS/iPhone**, **macOS**, **Windows** and **Linux** machine.
<!--more-->
--- ---
This article is part of [**WireGuard VPN** series](https://insights.ditatompel.com/en/series/wireguard-vpn/). If you haven't read the previous series, you might be interested to [set up your own **WireGuard VPN server** using cheap ~$6 VPS]({{< ref "/tutorials/how-to-setup-your-own-wireguard-vpn-server/index.md" >}}) or [installing **WireGuard-UI** to manage your **WireGuard VPN server**]({{< ref "/tutorials/installing-wireguard-ui-to-manage-your-wireguard-vpn-server/index.md" >}}). This article is part of [**WireGuard VPN** series](https://insights.ditatompel.com/en/series/wireguard-vpn/). If you haven't read the previous series, you might be interested to [set up your own **WireGuard VPN server** using cheap ~$6 VPS]({{< ref "/tutorials/how-to-setup-your-own-wireguard-vpn-server/index.md" >}}) or [installing **WireGuard-UI** to manage your **WireGuard VPN server**]({{< ref "/tutorials/installing-wireguard-ui-to-manage-your-wireguard-vpn-server/index.md" >}}).
[WireGuard](https://www.wireguard.com/) was initially released for the **Linux kernel**, it is now *cross-platform* (**Windows**, **macOS**, **BSD**, **iOS**, and **Android**). When you buy a **WireGuard VPN** from *VPN providers*, you will usually receive a configuration file (some providers also give you **QR Code** image). This configuration file is all you need. [WireGuard](https://www.wireguard.com/) was initially released for the **Linux kernel**, it is now _cross-platform_ (**Windows**, **macOS**, **BSD**, **iOS**, and **Android**). When you buy a **WireGuard VPN** from _VPN providers_, you will usually receive a configuration file (some providers also give you **QR Code** image). This configuration file is all you need.
For Windows, macOS, Android, and iOS, all you have to do is import the configuration file into the [official WireGuard application](https://www.wireguard.com/install/). For Linux who use `wg-quick` tool even simpler, you just have to copy the configuration file to the `/etc/wireguard` folder. For Windows, macOS, Android, and iOS, all you have to do is import the configuration file into the [official WireGuard application](https://www.wireguard.com/install/). For Linux who use `wg-quick` tool even simpler, you just have to copy the configuration file to the `/etc/wireguard` folder.
Even though the setup method is quite easy, I still want to write the steps on how to install or import the WireGuard configuration file here. Even though the setup method is quite easy, I still want to write the steps on how to install or import the WireGuard configuration file here.
The WireGuard configuration file given by *VPN provider* (or your **Sysadmins**) is just a text file, will usually look like this: The WireGuard configuration file given by _VPN provider_ (or your **Sysadmins**) is just a text file, will usually look like this:
```plain ```plain
[Interface] [Interface]
Address = 10.10.88.5/32 Address = 10.10.88.5/32
@ -65,56 +50,67 @@ AllowedIPs = 0.0.0.0/0
Endpoint = xx.xx.xx0.246:51822 Endpoint = xx.xx.xx0.246:51822
PersistentKeepalive = 15 PersistentKeepalive = 15
``` ```
> _Parts of IP address from `[Peer] Endpoint` above removed for privacy and security reason._ > _Parts of IP address from `[Peer] Endpoint` above removed for privacy and security reason._
## iPhone / iOS ## iPhone / iOS
Download [official WireGuard client for iOS from App Store](https://apps.apple.com/us/app/wireguard/id1441195209?ls=1), make sure that the app comes from **"[WireGuard Development Team](https://apps.apple.com/us/developer/wireguard-development-team/id1441195208)"**. Download [official WireGuard client for iOS from App Store](https://apps.apple.com/us/app/wireguard/id1441195209?ls=1), make sure that the app comes from **"[WireGuard Development Team](https://apps.apple.com/us/developer/wireguard-development-team/id1441195208)"**.
You can import configuration file by pressing <kbd>+</kbd> button from the top right of the app. You can import configuration file by pressing <kbd>+</kbd> button from the top right of the app.
### Using QR Code ### Using QR Code
1. If your VPN provider gives you **QR Code** image for your configuration, choose **"Create from QR code"** and scan your WireGuard configuration QR Code. 1. If your VPN provider gives you **QR Code** image for your configuration, choose **"Create from QR code"** and scan your WireGuard configuration QR Code.
2. When promoted to enter **name of the scanned tunnel** ([*example image*](wg-ios1.png)), fill with anything you can easily remember. *Avoid using character other than `-` and `[a-z]`*. Your new VPN connection profile will be added to your WireGuard app. 2. When promoted to enter **name of the scanned tunnel** ([_example image_](wg-ios1.png)), fill with anything you can easily remember. _Avoid using character other than `-` and `[a-z]`_. Your new VPN connection profile will be added to your WireGuard app.
### Using import file or archive ### Using import file or archive
1. To import configuration from `.conf` file, you need to download the configuration file to your device. 1. To import configuration from `.conf` file, you need to download the configuration file to your device.
2. After configuration file is downloaded to your device, select **"Create from file or archive"** and pick file of your WireGuard configuration file. 2. After configuration file is downloaded to your device, select **"Create from file or archive"** and pick file of your WireGuard configuration file.
_Remember to avoid using character other than `-` and `[a-z]` for the interface **"name"**_. _Remember to avoid using character other than `-` and `[a-z]` for the interface **"name"**_.
After your configuration was imported, simply tap **"Active" toggle button** of your desired VPN profile to **on** to connect [[*example image of connected WireGuard VPN in iOS app*](wg-ios2.png)]. After your configuration was imported, simply tap **"Active" toggle button** of your desired VPN profile to **on** to connect [[_example image of connected WireGuard VPN in iOS app_](wg-ios2.png)].
## Android ## Android
Download [official WireGuard client for Android from Play Store](https://play.google.com/store/apps/details?id=com.wireguard.android), make sure that the app comes from **"[WireGuard Development Team](https://play.google.com/store/apps/developer?id=WireGuard+Development+Team)"**. Download [official WireGuard client for Android from Play Store](https://play.google.com/store/apps/details?id=com.wireguard.android), make sure that the app comes from **"[WireGuard Development Team](https://play.google.com/store/apps/developer?id=WireGuard+Development+Team)"**.
You can import configuration file by pressing <kbd>+</kbd> button from the bottom right of the app. You can import configuration file by pressing <kbd>+</kbd> button from the bottom right of the app.
### Using QR Code ### Using QR Code
1. If your *VPN provider* gives you **QR Code** image for your configuration, choose **"Scan from QR code"** and scan your WireGuard configuration QR Code.
2. When promoted to enter **Tunnel Name** ([*example image*](wg-android1.png)), fill with anything you can easily remember. _Avoid using character other than `-` and `[a-z]`_. Your new VPN connection profile will be added to your WireGuard app. 1. If your _VPN provider_ gives you **QR Code** image for your configuration, choose **"Scan from QR code"** and scan your WireGuard configuration QR Code.
2. When promoted to enter **Tunnel Name** ([_example image_](wg-android1.png)), fill with anything you can easily remember. _Avoid using character other than `-` and `[a-z]`_. Your new VPN connection profile will be added to your WireGuard app.
### Using import file or archive ### Using import file or archive
1. To import configuration from `.conf` file, you need to download the configuration file to your device. 1. To import configuration from `.conf` file, you need to download the configuration file to your device.
2. After configuration file is downloaded to your device, select **"Import from file or archive"** and pick file of your WireGuard configuration file. 2. After configuration file is downloaded to your device, select **"Import from file or archive"** and pick file of your WireGuard configuration file.
_Remember to avoid using character other than `-` and `[a-z]` for the interface **"name"**_. _Remember to avoid using character other than `-` and `[a-z]` for the interface **"name"**_.
After your configuration was imported, simply tap **"Active" toggle button** of your desired VPN profile to **on** to connect [[*example image of connected WireGuard VPN in Android app*](wg-android2.png)]. After your configuration was imported, simply tap **"Active" toggle button** of your desired VPN profile to **on** to connect [[_example image of connected WireGuard VPN in Android app_](wg-android2.png)].
## Windows and macOS ## Windows and macOS
I'll put Windows and macOS in the same section because importing WireGuard config on those OSes is pretty similar. After [official WireGuard application](https://www.wireguard.com/install/) for your OS is installed: I'll put Windows and macOS in the same section because importing WireGuard config on those OSes is pretty similar. After [official WireGuard application](https://www.wireguard.com/install/) for your OS is installed:
1. Click "**Add Tunnel**" button (or it's dropdown icon) and "**Import tunnel(s) from file…**", then pick file of your WireGuard configuration file. 1. Click "**Add Tunnel**" button (or it's dropdown icon) and "**Import tunnel(s) from file…**", then pick file of your WireGuard configuration file.
2. After connected to your VPN profile, try to check your IP address. Your VPN server should appear as your public IP, not your ISP IP address. 2. After connected to your VPN profile, try to check your IP address. Your VPN server should appear as your public IP, not your ISP IP address.
![WireGuard VPN connected on Windows](wg-windows-connected.png#center) ![WireGuard VPN connected on Windows](wg-windows-connected.png#center)
## Linux ## Linux
For Linux users, you need to install `wireguard` *package* to your system. Find how to install WireGuard package from [official WireGuard](https://www.wireguard.com/install/) site or your *distribution* documentation page.
For Linux users, you need to install `wireguard` _package_ to your system. Find how to install WireGuard package from [official WireGuard](https://www.wireguard.com/install/) site or your _distribution_ documentation page.
### Using wg-quick ### Using wg-quick
The easiest and simplest way to use WireGuard is using `wg-quick` tool that comes from `wireguard` *package*. Put your WireGuard configuration file from your VPN provider to `/etc/wireguard` and start WireGuard connection with:
The easiest and simplest way to use WireGuard is using `wg-quick` tool that comes from `wireguard` _package_. Put your WireGuard configuration file from your VPN provider to `/etc/wireguard` and start WireGuard connection with:
```shell ```shell
sudo systemctl start wg-quick@<interface-name>.service. sudo systemctl start wg-quick@<interface-name>.service.
``` ```
Replace `<interface-name>` above with filename (without the `.conf` extension) of WireGuard config given by your VPN provider. Replace `<interface-name>` above with filename (without the `.conf` extension) of WireGuard config given by your VPN provider.
For example, If you rename the `wg0.conf` to `wg-do1.conf` in your `/etc/wireguard` directory, you can connect to that VPN network using `sudo systemctl start wg-quick@wg-do1.service`. For example, If you rename the `wg0.conf` to `wg-do1.conf` in your `/etc/wireguard` directory, you can connect to that VPN network using `sudo systemctl start wg-quick@wg-do1.service`.
@ -128,25 +124,31 @@ Try to check your WireGuard connection by check your public IP from your browser
### Using NetworkManager ### Using NetworkManager
**NetworkManager** on *bleeding-edge* *distros* such as **Arch Linux** has native support for setting up WireGuard interface. **NetworkManager** on _bleeding-edge_ _distros_ such as **Arch Linux** has native support for setting up WireGuard interface.
#### Using NetworkManager TUI & GUI #### Using NetworkManager TUI & GUI
![NetworkManager tui](wg-nmtui.png#center) ![NetworkManager tui](wg-nmtui.png#center)
You can easily configure WireGuard connection and *peers* using **NetworkManager TUI** or **GUI**. In this example, I'll use **NetworkManager GUI**. You can easily configure WireGuard connection and _peers_ using **NetworkManager TUI** or **GUI**. In this example, I'll use **NetworkManager GUI**.
1. Open your **NetworkManager** GUI, click <kbd>+</kbd> to add new connection. 1. Open your **NetworkManager** GUI, click <kbd>+</kbd> to add new connection.
2. Choose "**Import a saved VPN configuration**" and pick file of your WireGuard configuration file. 2. Choose "**Import a saved VPN configuration**" and pick file of your WireGuard configuration file.
3. Then, you can change "**Connection name**" and "**Interface name**" to anything you can easily remember. But, **avoid using character other than** `-` and `[a-z]` for "**Interface name**". It won't work if you use special character like *spaces*. 3. Then, you can change "**Connection name**" and "**Interface name**" to anything you can easily remember. But, **avoid using character other than** `-` and `[a-z]` for "**Interface name**". It won't work if you use special character like _spaces_.
![NetworkManager gui](wg-nmgui.png#center) ![NetworkManager gui](wg-nmgui.png#center)
#### Using nmcli #### Using nmcli
`nmcli` can import a `wg-quick` configuration file. For example, to import WireGuard configuration from `/etc/wireguard/t420.conf`: `nmcli` can import a `wg-quick` configuration file. For example, to import WireGuard configuration from `/etc/wireguard/t420.conf`:
```shell ```shell
nmcli connection import type wireguard file /etc/wireguard/t420.conf nmcli connection import type wireguard file /etc/wireguard/t420.conf
``` ```
Even though `nmcli` can create a WireGuard connection profile, but it does not support configuring peers. Even though `nmcli` can create a WireGuard connection profile, but it does not support configuring peers.
The following examples configure WireGuard via the keyfile format `.nmconnection` files under `/etc/NetworkManager/system-connections/` for multiple peers and specific routes: The following examples configure WireGuard via the keyfile format `.nmconnection` files under `/etc/NetworkManager/system-connections/` for multiple peers and specific routes:
```plain ```plain
[connection] [connection]
id=WG-<redacted> id=WG-<redacted>
@ -178,12 +180,11 @@ method=manual
addr-gen-mode=stable-privacy addr-gen-mode=stable-privacy
method=ignore method=ignore
``` ```
![nmcli WireGuard connection example](wg-nmcli.png#center) ![nmcli WireGuard connection example](wg-nmcli.png#center)
## Notes ## Notes
- You can't connect to the same VPN server from 2 or more different devices with same key. **You every device MUST have its own unique key**.
- For some operating system such as Windows, if you can't import your WireGuard configuration file from your WireGuard app, make sure that your WireGuard configuration file is ended with `.conf`.
### Additional Notes - You can't connect to the same VPN server from 2 or more different devices with same key. **You every device MUST have its own unique key**.
- If you interested to [set up your own **WireGuard VPN server** using cheap ~$6 VPS]({{< ref "/tutorials/how-to-setup-your-own-wireguard-vpn-server/index.md" >}}), but have some technical difficulties; I can help you to set that up for small amount of **IDR** (_I accept **Monero XMR** for **credits** if you don't have Indonesia Rupiah_). - For some operating system such as Windows, if you can't import your WireGuard configuration file from your WireGuard app, make sure that your WireGuard configuration file is ended with `.conf`.
- To find out how to contact me, please visit [https://www.ditatompel.com/pages/contact](https://www.ditatompel.com/pages/contact).

85
content/tutorials/how-to-setup-your-own-wireguard-vpn-server/index.id.md
View file

@ -1,6 +1,7 @@
--- ---
title: "Cara Setup VPN Server WireGuard Sendiri" title: "Cara Setup VPN Server WireGuard Sendiri"
description: "Tutorial cara bagaimana men-setup server VPN WireGuard sendiri menggunakan VPS server seharga 6 dolar" description: "Tutorial cara bagaimana men-setup server VPN WireGuard sendiri menggunakan VPS server seharga 6 dolar"
summary: "Cukup menggunakan VPS seharga _6 dolar_ per bulan, Anda bisa memiliki VPN server sendiri menggunakan WireGuard VPN."
# linkTitle: # linkTitle:
date: 2023-06-05T19:04:57+07:00 date: 2023-06-05T19:04:57+07:00
lastmod: lastmod:
@ -10,50 +11,31 @@ featured: false
pinned: true pinned: true
# comments: false # comments: false
nav_weight: 1000 nav_weight: 1000
# nav_icon:
# vendor: bootstrap
# name: toggles
# color: '#e24d0e'
series: series:
- WireGuard VPN - WireGuard VPN
categories: categories:
- Privasi - Privasi
- SysAdmin - SysAdmin
- Networking - Networking
- Self-Hosted - Self-Hosted
tags: tags:
- VPN - VPN
- WireGuard - WireGuard
images: images:
# menu:
# main:
# weight: 100
# params:
# icon:
# vendor: bs
# name: book
# color: '#e24d0e'
authors: authors:
- ditatompel - ditatompel
- vie - vie
--- ---
Cukup menggunakan VPS seharga _6 dolar_ per bulan, Anda bisa memiliki **VPN** server sendiri menggunakan **WireGuard VPN**. Ikuti caranya di artikel berikut ini untuk menginstall, dan mensetting VPS **Ubuntu 22.04** menjadi **VPN server** Anda. Cukup menggunakan VPS seharga _6 dolar_ per bulan, Anda bisa memiliki **VPN** server sendiri menggunakan **WireGuard VPN**. Ikuti caranya di artikel berikut ini untuk menginstall, dan mensetting VPS **Ubuntu 22.04** menjadi **VPN server** Anda.
## <!--more-->
Setelah [beberapa seri artikel tentang **VPN IPsec**](https://insights.ditatompel.com/en/series/ipsec-vpn/) (dalam bahasa Inggris), hari ini saya ingin berbagi bagaimana cara mensetting [**WireGuard VPN**](https://www.wireguard.com/) sebagai server VPN. Jika dibandingkan dengan [L2TP/xAuth](https://insights.ditatompel.com/en/tutorials/ipsec-l2tp-xauth-ikev2-vpn-server-auto-setup/) dan [IKEv2 VPN](https://insights.ditatompel.com/en/tutorials/set-up-ikev2-vpn-server-and-clients/) (artikel saya sebelumnya tentang **IPsec VPN** dalam bahasa Inggris), dari sisi performa, **WireGuard VPN jauh lebih unggul** karena menggunakan **UDP** dan bukan **TCP**. Setelah [beberapa seri artikel tentang **VPN IPsec**](https://insights.ditatompel.com/en/series/ipsec-vpn/) (dalam bahasa Inggris), hari ini saya ingin berbagi bagaimana cara mensetting [**WireGuard VPN**](https://www.wireguard.com/) sebagai server VPN. Jika dibandingkan dengan [L2TP/xAuth](https://insights.ditatompel.com/en/tutorials/ipsec-l2tp-xauth-ikev2-vpn-server-auto-setup/) dan [IKEv2 VPN](https://insights.ditatompel.com/en/tutorials/set-up-ikev2-vpn-server-and-clients/) (artikel saya sebelumnya tentang **IPsec VPN** dalam bahasa Inggris), dari sisi performa, **WireGuard VPN jauh lebih unggul** karena menggunakan **UDP** dan bukan **TCP**.
{{< bs/alert info >}}
{{< bs/alert-heading "TLDR;" >}}
Jika Anda memiliki kesulitan teknis untuk melakukan setup VPN server WireGuard sendiri, {{< bs/alert-link "saya dapat membantu Anda untuk melakukannya" "https://www.fiverr.com/s/4vzPGR" >}} dengan imbalan sedikit uang.
{{< /bs/alert >}}
## Prasyarat ## Prasyarat
- Sebuah **VPS** dengan alamat IP publik. - Sebuah **VPS** dengan alamat IP publik.
- Nyaman dan terbiasa dengan Linux _command-line_. - Nyaman dan terbiasa dengan Linux _command-line_.
- Pengetahuan dasar _subnetting_ di **IPv4** (_jujur saja, sayya tidak begitu familiar dengan subnetting di IPv6, jadi artikel ini hanya untuk IPv4_). - Pengetahuan dasar _subnetting_ di **IPv4** (_jujur saja, sayya tidak begitu familiar dengan subnetting di IPv6, jadi artikel ini hanya untuk IPv4_).
Untuk pemilihan _cloud provider_ mana yang akan Anda gunakan, itu terserah Anda. Di artikel ini, saya akan mengguakan **Droplet** di [**DigitalOcean**](https://m.do.co/c/42d4ba96cc94) (_referral link_) untuk VPN server saya. (Anda bisa mendapatkan kredit sebesar 200 dolar yang valid untuk 60 hari secara cuma-cuma dengan menggunakan _link_ referensi saya). Untuk pemilihan _cloud provider_ mana yang akan Anda gunakan, itu terserah Anda. Di artikel ini, saya akan mengguakan **Droplet** di [**DigitalOcean**](https://m.do.co/c/42d4ba96cc94) (_referral link_) untuk VPN server saya. (Anda bisa mendapatkan kredit sebesar 200 dolar yang valid untuk 60 hari secara cuma-cuma dengan menggunakan _link_ referensi saya).
@ -124,9 +106,9 @@ _Public key_ tersebut akan kita butuhkan untuk mengkonfigurasi koneksi WireGuard
Sebelum mengkonfigurasi server WireGuard Anda, Anda perlu memilih / menentukan _private network IP range_ untuk koneksi WireGuard yang akan Anda gunakan. Anda harus menggunakan [private network IP ranges](https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses) yang **valid**. Contoh: Sebelum mengkonfigurasi server WireGuard Anda, Anda perlu memilih / menentukan _private network IP range_ untuk koneksi WireGuard yang akan Anda gunakan. Anda harus menggunakan [private network IP ranges](https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses) yang **valid**. Contoh:
- Antara `10.0.0.0` - `10.255.255.255` (`10.0.0.0/8`) - Antara `10.0.0.0` - `10.255.255.255` (`10.0.0.0/8`)
- Antara `172.16.0.0` - `172.31.255.255` (`172.16.0.0/12`) - Antara `172.16.0.0` - `172.31.255.255` (`172.16.0.0/12`)
- Antara `192.168.0.0` - `192.168.255.255` (`192.168.0.0/16`) - Antara `192.168.0.0` - `192.168.255.255` (`192.168.0.0/16`)
> _Tips: Hindari menggunakan IP range yang sudah Anda gunakan dan IP range yang sering digunakan oleh sebuah aplikasi. Misalnya: Bawaan installasi Docker menggunakan network `172.17.0.0/16`. Jika Anda menggunakan Docker, Anda harus menggunakan IP range lain untuk jaringan WireGuard Anda supaya tidak terjadi bentrok._ > _Tips: Hindari menggunakan IP range yang sudah Anda gunakan dan IP range yang sering digunakan oleh sebuah aplikasi. Misalnya: Bawaan installasi Docker menggunakan network `172.17.0.0/16`. Jika Anda menggunakan Docker, Anda harus menggunakan IP range lain untuk jaringan WireGuard Anda supaya tidak terjadi bentrok._
@ -136,11 +118,11 @@ Anda juga perlu menentukan _port_ berapa (**UDP**) yang akan digunakan oleh Wire
Sekarang, kita sudah memiliki semua informasi dasar yang kita butuhkan supaya server WireGuard dapat dijalankan: Sekarang, kita sudah memiliki semua informasi dasar yang kita butuhkan supaya server WireGuard dapat dijalankan:
- Server Public IP: `xxx.xx.xx0.246` - Server Public IP: `xxx.xx.xx0.246`
- Server Private key: `uO0GDXBc+ZH5QsLmf+qRyCtFmUV1coadJvQp8iM0mEg=` - Server Private key: `uO0GDXBc+ZH5QsLmf+qRyCtFmUV1coadJvQp8iM0mEg=`
- Server Public Key: `7c023YtKepRPNNKfGsP5f2H2VtfPvVptn8Hn6jjmaz8=` - Server Public Key: `7c023YtKepRPNNKfGsP5f2H2VtfPvVptn8Hn6jjmaz8=`
- Server Listen Port: `UDP` port `51822` - Server Listen Port: `UDP` port `51822`
- WireGuard Network: `10.10.88.0/24` - WireGuard Network: `10.10.88.0/24`
Buat file dengan nama `wg0.conf` untuk konfigurasi WireGuard anda di folder `/etc/wireguard` dan isi dengan contoh konfigurasi berikut ini: Buat file dengan nama `wg0.conf` untuk konfigurasi WireGuard anda di folder `/etc/wireguard` dan isi dengan contoh konfigurasi berikut ini:
@ -317,11 +299,11 @@ Sebelum mengkonfigurasi WireGuard _peer_ (_client_), Anda perlu memilih / menent
Sekarang, kita sudah memiliki semua informasi dasar yang kita butuhkan supaya untuk konfigurasi WireGuard _peer_: Sekarang, kita sudah memiliki semua informasi dasar yang kita butuhkan supaya untuk konfigurasi WireGuard _peer_:
- Server Public IP: `xxx.xx.xx0.246` - Server Public IP: `xxx.xx.xx0.246`
- Server Public Key: `7c023YtKepRPNNKfGsP5f2H2VtfPvVptn8Hn6jjmaz8=` - Server Public Key: `7c023YtKepRPNNKfGsP5f2H2VtfPvVptn8Hn6jjmaz8=`
- Server Listen Port: `UDP` port `51822` - Server Listen Port: `UDP` port `51822`
- WireGuard Network: `10.10.88.0/24` - WireGuard Network: `10.10.88.0/24`
- Client IP address: `10.10.88.2/24` - Client IP address: `10.10.88.2/24`
Buat file dengan nama `wg-do1.conf` untuk konfigurasi WireGuard Anda di folder `/etc/wireguard` dan isi dengan contoh konfigurasi berikut ini: Buat file dengan nama `wg-do1.conf` untuk konfigurasi WireGuard Anda di folder `/etc/wireguard` dan isi dengan contoh konfigurasi berikut ini:
@ -344,11 +326,11 @@ Ubah `<YOUR_PEER_PRIVATE_KEY>`, `<YOUR_PEER_IP_ADDRESS>`, `<YOUR_SERVER_PUBLIC_K
Catatan: Catatan:
- `AllowedIPs` = `0.0.0.0/0` artinya semua lalu-lintas jaringan akan melalui _peer_ tersebut (dalam hal ini, server WireGuard kita). - `AllowedIPs` = `0.0.0.0/0` artinya semua lalu-lintas jaringan akan melalui _peer_ tersebut (dalam hal ini, server WireGuard kita).
Anda bisa menentukan / memilih _routing_ menuju IP/_network_ tertentu supaya melewati _peer_ tertentu (Jika Anda terkoneksi ke banyak _peer_ / server). Anda bisa menentukan / memilih _routing_ menuju IP/_network_ tertentu supaya melewati _peer_ tertentu (Jika Anda terkoneksi ke banyak _peer_ / server).
Sebagai contoh, jika Anda hanya ingin mengarahkan lalu-lintas jaringan menuju IP 1.0.0.1 dan 8.8.4.4 melalui _peer_ tertentu dan menggunakan konesi internet dari ISP Anda sebagai _default route_-nya, Anda bisa menghapus `0.0.0.0/0` dan menambahkan `1.0.0.1/32,8.8.4.4/32` (dipisahkan dengan tanda koma) untuk nilai dari `AllowedIPs`. Sebagai contoh, jika Anda hanya ingin mengarahkan lalu-lintas jaringan menuju IP 1.0.0.1 dan 8.8.4.4 melalui _peer_ tertentu dan menggunakan konesi internet dari ISP Anda sebagai _default route_-nya, Anda bisa menghapus `0.0.0.0/0` dan menambahkan `1.0.0.1/32,8.8.4.4/32` (dipisahkan dengan tanda koma) untuk nilai dari `AllowedIPs`.
- `PersistentKeepalive` = `15` : Berapa detik sekali _peer_ mengirimkan _ping_ ke server, supaya server dapat mencapai / berkomunikasi dengan peer yang berada dibalik **NAT**/firewall. - `PersistentKeepalive` = `15` : Berapa detik sekali _peer_ mengirimkan _ping_ ke server, supaya server dapat mencapai / berkomunikasi dengan peer yang berada dibalik **NAT**/firewall.
- `DNS` Anda juga dapat menentukan DNS server yang ingin Anda gunakan dengan menentukan alamat IP DNS server pada konfigurasi `DNS`. - `DNS` Anda juga dapat menentukan DNS server yang ingin Anda gunakan dengan menentukan alamat IP DNS server pada konfigurasi `DNS`.
#### Menambahkan _Peers Public Key_ ke WireGuard Server #### Menambahkan _Peers Public Key_ ke WireGuard Server
@ -406,8 +388,3 @@ WireGuard adalah protokol VPN favorit saya. Performanya cepat dan lebih hemat _r
Ketika dikombinasikan dengan **Nginx** sebagai _reverse proxy_, Anda bahkan bisa mengekspose / server HTTP di jaringan lokal Anda yang berada dibalik **NAT**/_firewall_ ke internet. Ketika dikombinasikan dengan **Nginx** sebagai _reverse proxy_, Anda bahkan bisa mengekspose / server HTTP di jaringan lokal Anda yang berada dibalik **NAT**/_firewall_ ke internet.
Akan tetapi, melakukan _maintenance_ pada jaringan WireGuard yang besar bisa sangat kompleks dan susah dilakukan. Namun, ada _software_ yang dapat membantu Anda untuk membantu mengatur hal itu, salah satu contohnya adalah [Netmaker](https://www.netmaker.io/). Akan tetapi, melakukan _maintenance_ pada jaringan WireGuard yang besar bisa sangat kompleks dan susah dilakukan. Namun, ada _software_ yang dapat membantu Anda untuk membantu mengatur hal itu, salah satu contohnya adalah [Netmaker](https://www.netmaker.io/).
### Catatan Tambahan
- Jika Anda memiliki kesulitan teknis untuk melakukan _setup_ VPN server WireGuard sendiri, [saya dapat membantu Anda untuk melakukannya](https://www.fiverr.com/s/4vzPGR) dengan imbalan sedikit uang.
- Untuk dapat menghubungi saya, silahkan kunjungi [https://www.ditatompel.com/about](https://www.ditatompel.com/about).

167
content/tutorials/how-to-setup-your-own-wireguard-vpn-server/index.md
View file

@ -1,6 +1,7 @@
--- ---
title: "How to Setup Your Own WireGuard VPN Server" title: "How to Setup Your Own WireGuard VPN Server"
description: "How to manually setup your own WireGuard VPN server using ~$6 VPS" description: "How to manually setup your own WireGuard VPN server using ~$6 VPS"
summary: "This article will guide you to setting up your own WireGuard VPN server using Ubuntu 22.04 server on a cheap ~$6 VPS and use it as your internet gateway."
# linkTitle: # linkTitle:
date: 2023-06-05T19:04:57+07:00 date: 2023-06-05T19:04:57+07:00
lastmod: lastmod:
@ -9,71 +10,52 @@ noindex: false
featured: true featured: true
# comments: false # comments: false
nav_weight: 1000 nav_weight: 1000
# nav_icon:
# vendor: bootstrap
# name: toggles
# color: '#e24d0e'
series: series:
- WireGuard VPN - WireGuard VPN
categories: categories:
- Privacy - Privacy
- SysAdmin - SysAdmin
- Networking - Networking
- Self-Hosted - Self-Hosted
tags: tags:
- VPN - VPN
- WireGuard - WireGuard
images: images:
# menu:
# main:
# weight: 100
# params:
# icon:
# vendor: bs
# name: book
# color: '#e24d0e'
authors: authors:
- ditatompel - ditatompel
--- ---
This article will guide you to setting up your own **WireGuard VPN** server using **Ubuntu 22.04** server on a **cheap ~$6 VPS** and use it as your internet gateway. After [series of my IPsec VPN article](https://insights.ditatompel.com/en/series/ipsec-vpn/). Today, I want to share how to set up [**WireGuard VPN**](https://www.wireguard.com/) server. Because **WireGuard** use **UDP** instead of **TCP**, it's _extremely fast_ compared to [L2TP/xAuth]({{< ref "/tutorials/ipsec-l2tp-xauth-ikev2-vpn-server-auto-setup/index.md" >}}) and [IKEv2 VPN]({{< ref "/tutorials/set-up-ikev2-vpn-server-and-clients/index.md" >}}) (my previous **IPsec VPN** articles).
<!--more-->
---
After [series of my IPsec VPN article](https://insights.ditatompel.com/en/series/ipsec-vpn/). Today, I want to share how to set up [**WireGuard VPN**](https://www.wireguard.com/) server. Because **WireGuard** use **UDP** instead of **TCP**, it's *extremely fast* compared to [L2TP/xAuth]({{< ref "/tutorials/ipsec-l2tp-xauth-ikev2-vpn-server-auto-setup/index.md" >}}) and [IKEv2 VPN]({{< ref "/tutorials/set-up-ikev2-vpn-server-and-clients/index.md" >}}) (my previous **IPsec VPN** articles).
{{< bs/alert info >}}
{{< bs/alert-heading "TLDR;" >}}
If you have some technical difficulties setting up your own WireGuard server, {{< bs/alert-link "I can help you to setup WireGuard VPN server" "https://www.fiverr.com/s/4vzPGR" >}} for small amount of money.
{{< /bs/alert >}}
## Prerequisites ## Prerequisites
- A **VPS** with Public IP address.
- Comfortable with Linux *command-line*.
- Basic knowledge of _**IPv4** subnetting_ (_to be honest, I'm not familiar with IPv6 subnetting, so this article is for **IPv4** only_).
It doesn't matter which *cloud provider* you choose. In this article, I will use [**DigitalOcean**](https://m.do.co/c/42d4ba96cc94) (*referral link*) **Droplet** for my **WireGuard VPN server** (You can get your **free $200** in credit over 60 days by registering using my *referral code*). - A **VPS** with Public IP address.
- Comfortable with Linux _command-line_.
- Basic knowledge of _**IPv4** subnetting_ (_to be honest, I'm not familiar with IPv6 subnetting, so this article is for **IPv4** only_).
It doesn't matter which _cloud provider_ you choose. In this article, I will use [**DigitalOcean**](https://m.do.co/c/42d4ba96cc94) (_referral link_) **Droplet** for my **WireGuard VPN server** (You can get your **free $200** in credit over 60 days by registering using my _referral code_).
> _**NOTE**: You should know that **cloud providers usually charge extra amount of `$` for every GB of overuse bandwidth**. So, know your needs and your limits!_ > _**NOTE**: You should know that **cloud providers usually charge extra amount of `$` for every GB of overuse bandwidth**. So, know your needs and your limits!_
> _VPS server I use for this article will be destroyed when this article is published._ > _VPS server I use for this article will be destroyed when this article is published._
## Deploying your new VPS (DigitalOcean Droplet, optional) ## Deploying your new VPS (DigitalOcean Droplet, optional)
> _If you already have your own VPS running, you can skip this step and go to next step: "[Set up your WireGuard Server](#set-up-your-wireguard-server)"._ > _If you already have your own VPS running, you can skip this step and go to next step: "[Set up your WireGuard Server](#set-up-your-wireguard-server)"._
1. Go to your project and **Create new Droplet**. 1. Go to your project and **Create new Droplet**.
2. Choose **droplet region closest to you** to avoid any potential network latency. In this example, I'll pick **Frankfurt** datacenter. 2. Choose **droplet region closest to you** to avoid any potential network latency. In this example, I'll pick **Frankfurt** datacenter.
3. Select your **Droplet OS**, for this article, I'll use **Ubuntu** `22.04 LTS`. 3. Select your **Droplet OS**, for this article, I'll use **Ubuntu** `22.04 LTS`.
4. Select your **Droplet size**. I'll start with basic, **1 CPU** with **1GB of RAM** and **1TB network transfer** ($6/month). 4. Select your **Droplet size**. I'll start with basic, **1 CPU** with **1GB of RAM** and **1TB network transfer** ($6/month).
Adapt the VPS size to fit with your need to avoid extra charge of overuse bandwidth (1TB monthly transfer is enough for me). Adapt the VPS size to fit with your need to avoid extra charge of overuse bandwidth (1TB monthly transfer is enough for me).
![DigitalOcean VPS size](do1.png#center) ![DigitalOcean VPS size](do1.png#center)
5. Set up your preferred *authentication method*, I **prefer using SSH public and private key** rather than *password auth*. 5. Set up your preferred _authentication method_, I **prefer using SSH public and private key** rather than _password auth_.
6. Set any other options as *default*. _I'm sure you **don't need backup and managed database options** for this setup_. 6. Set any other options as _default_. _I'm sure you **don't need backup and managed database options** for this setup_.
> _**WireGuard** did **NOT need high disk I/O, so NVMe disk is NOT necessary**._ > _**WireGuard** did **NOT need high disk I/O, so NVMe disk is NOT necessary**._
## Set up your WireGuard Server ## Set up your WireGuard Server
> _**IMPORTANT NOTE**: Since I'm not familiar with **IPv6** subnetting, I'll only use **IPv4**._ > _**IMPORTANT NOTE**: Since I'm not familiar with **IPv6** subnetting, I'll only use **IPv4**._
Once your VPS ready and running, it's recommended to update your OS first using `apt update && apt upgrade` command and `reboot` your VPS. Once your VPS ready and running, it's recommended to update your OS first using `apt update && apt upgrade` command and `reboot` your VPS.
@ -87,47 +69,59 @@ Install WireGuard using `sudo apt install wireguard` command. Once WireGuard is
> _Tips: You can create **vanity** public key address for **WireGuard** using tool like [warner/wireguard-vanity-address](https://github.com/warner/wireguard-vanity-address)._ > _Tips: You can create **vanity** public key address for **WireGuard** using tool like [warner/wireguard-vanity-address](https://github.com/warner/wireguard-vanity-address)._
#### Generate Private Key #### Generate Private Key
You can use `wg genkey` command to generate your private key. Place your private key to somewhere save, for example: `/etc/wireguard/do_private.key`. You can use `wg genkey` command to generate your private key. Place your private key to somewhere save, for example: `/etc/wireguard/do_private.key`.
```shell ```shell
wg genkey | sudo tee /etc/wireguard/do_private.key wg genkey | sudo tee /etc/wireguard/do_private.key
``` ```
Write down the output, we'll need that later to generate our WireGuard Server public key. Example of my WireGuard server private key: Write down the output, we'll need that later to generate our WireGuard Server public key. Example of my WireGuard server private key:
``` ```
uO0GDXBc+ZH5QsLmf+qRyCtFmUV1coadJvQp8iM0mEg= uO0GDXBc+ZH5QsLmf+qRyCtFmUV1coadJvQp8iM0mEg=
``` ```
Change `/etc/wireguard/do_private.key` file permission with `sudo chmod 600 /etc/wireguard/do_private.key`. Change `/etc/wireguard/do_private.key` file permission with `sudo chmod 600 /etc/wireguard/do_private.key`.
#### Generate Public Key #### Generate Public Key
Now, generate server public key from previously generated private key: Now, generate server public key from previously generated private key:
```shell ```shell
sudo cat /etc/wireguard/do_private.key | wg pubkey | sudo tee /etc/wireguard/do_public.key sudo cat /etc/wireguard/do_private.key | wg pubkey | sudo tee /etc/wireguard/do_public.key
``` ```
Write down the output, we'll need that later to configure WireGuard connection for *peers* (clients). Example of my WireGuard server public key:
Write down the output, we'll need that later to configure WireGuard connection for _peers_ (clients). Example of my WireGuard server public key:
``` ```
7c023YtKepRPNNKfGsP5f2H2VtfPvVptn8Hn6jjmaz8= 7c023YtKepRPNNKfGsP5f2H2VtfPvVptn8Hn6jjmaz8=
``` ```
### Configuring WireGuard Server ### Configuring WireGuard Server
Before configuring your **WireGuard** server, you need to **decide your private network IP range for your WireGuard** connection (*tunnel* interface). You should choose valid [private network IP ranges](https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses). For example:
- Between `10.0.0.0` - `10.255.255.255` (`10.0.0.0/8`) Before configuring your **WireGuard** server, you need to **decide your private network IP range for your WireGuard** connection (_tunnel_ interface). You should choose valid [private network IP ranges](https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses). For example:
- Between `172.16.0.0` - `172.31.255.255` (`172.16.0.0/12`)
- Between `192.168.0.0` - `192.168.255.255` (`192.168.0.0/16`) - Between `10.0.0.0` - `10.255.255.255` (`10.0.0.0/8`)
- Between `172.16.0.0` - `172.31.255.255` (`172.16.0.0/12`)
- Between `192.168.0.0` - `192.168.255.255` (`192.168.0.0/16`)
> _Tips: Avoid using your current used private IP ranges and commonly used private IP range. For example: Docker uses `172.17.0.0/16` IP range by default. If you use Docker, you must use another IP range for your WireGuard IP range to avoid conflict._ > _Tips: Avoid using your current used private IP ranges and commonly used private IP range. For example: Docker uses `172.17.0.0/16` IP range by default. If you use Docker, you must use another IP range for your WireGuard IP range to avoid conflict._
In this article, I only use **IPv4** and use `10.10.88.0/24` for my WireGuard network. In this article, I only use **IPv4** and use `10.10.88.0/24` for my WireGuard network.
You'll also need to decide which **UDP** port WireGuard should listen to. Many *network appliance* out there (such as **Netgate**, **QNAP**, etc.) set **UDP** port **51280** as their default WireGuard listen port. But, in this article, I'll use `UDP` port `51822`. You'll also need to decide which **UDP** port WireGuard should listen to. Many _network appliance_ out there (such as **Netgate**, **QNAP**, etc.) set **UDP** port **51280** as their default WireGuard listen port. But, in this article, I'll use `UDP` port `51822`.
Now, we have all (basic) required information for WireGuard server to run: Now, we have all (basic) required information for WireGuard server to run:
- Server Public IP: `xxx.xx.xx0.246`
- Server Private key: `uO0GDXBc+ZH5QsLmf+qRyCtFmUV1coadJvQp8iM0mEg=` - Server Public IP: `xxx.xx.xx0.246`
- Server Public Key: `7c023YtKepRPNNKfGsP5f2H2VtfPvVptn8Hn6jjmaz8=` - Server Private key: `uO0GDXBc+ZH5QsLmf+qRyCtFmUV1coadJvQp8iM0mEg=`
- Server Listen Port: `UDP` port `51822` - Server Public Key: `7c023YtKepRPNNKfGsP5f2H2VtfPvVptn8Hn6jjmaz8=`
- WireGuard Network: `10.10.88.0/24` - Server Listen Port: `UDP` port `51822`
- WireGuard Network: `10.10.88.0/24`
Create file named `wg0.conf` for your WireGuard configuration under `/etc/wireguard` directory and fill with this example configuration: Create file named `wg0.conf` for your WireGuard configuration under `/etc/wireguard` directory and fill with this example configuration:
```plain ```plain
# /etc/wireguard/wg0.conf # /etc/wireguard/wg0.conf
@ -137,14 +131,17 @@ Address = <YOUR_SERVER_WG_IP_ADDRESS> # This example: 10.10.88.1/24
ListenPort = <SERVER_UDP_LISTEN_PORT> # This example: 51822 ListenPort = <SERVER_UDP_LISTEN_PORT> # This example: 51822
SaveConfig = true SaveConfig = true
``` ```
> _**Note**: From the configuration above, notice that I pick `10.10.88.1` as my server IP address for WireGuard network._ > _**Note**: From the configuration above, notice that I pick `10.10.88.1` as my server IP address for WireGuard network._
Replace `<YOUR_SERVER_PRIVATE_KEY>`, `<YOUR_SERVER_IP_ADDRESS>`, `<SERVER_UDP_LISTEN_PORT>` with your preferred configuration. Replace `<YOUR_SERVER_PRIVATE_KEY>`, `<YOUR_SERVER_IP_ADDRESS>`, `<SERVER_UDP_LISTEN_PORT>` with your preferred configuration.
#### Allowing IP forward #### Allowing IP forward
In this article, we'll allow this WireGuard server as our default *gateway* for *peers* (clients), so any outgoing network traffic (except to your **LAN/WLAN** network) can go through this WireGuard server. If you use WireGuard as *peer-to-peer* connection, you don't need to do this.
In this article, we'll allow this WireGuard server as our default _gateway_ for _peers_ (clients), so any outgoing network traffic (except to your **LAN/WLAN** network) can go through this WireGuard server. If you use WireGuard as _peer-to-peer_ connection, you don't need to do this.
Edit `/etc/sysctl.conf` and add `net.ipv4.ip_forward=1` to the end of the file, then run `sudo sysctl -p` to load the new `/etc/sysctl.conf` values. Edit `/etc/sysctl.conf` and add `net.ipv4.ip_forward=1` to the end of the file, then run `sudo sysctl -p` to load the new `/etc/sysctl.conf` values.
```shell ```shell
sudo sysctl -p sudo sysctl -p
``` ```
@ -152,29 +149,35 @@ sudo sysctl -p
After that, you need to add firewall rules to allow peers (clients) to connect to server and routed properly. After that, you need to add firewall rules to allow peers (clients) to connect to server and routed properly.
#### Setting up Firewall #### Setting up Firewall
By default, Ubuntu system use comes with **UFW** to manage system firewall. You need to **add WireGuard listen port to firewall allow list**. By default, Ubuntu system use comes with **UFW** to manage system firewall. You need to **add WireGuard listen port to firewall allow list**.
```shell ```shell
sudo ufw allow OpenSSH sudo ufw allow OpenSSH
sudo ufw allow proto udp to any port 51822 sudo ufw allow proto udp to any port 51822
``` ```
> _Note that I also add **OpenSSH** to allow list to avoid losing connection to SSH if you didn't configure / activate it before._ > _Note that I also add **OpenSSH** to allow list to avoid losing connection to SSH if you didn't configure / activate it before._
Replace `51822` to your configured **WireGuard listen port**. Replace `51822` to your configured **WireGuard listen port**.
Enable / restart your `ufw` service using: Enable / restart your `ufw` service using:
```shell ```shell
ufw enable # to enable firewall, or ufw enable # to enable firewall, or
ufw reload # to reload firewall ufw reload # to reload firewall
``` ```
Next, you need to know which network interface used by your server as its *default route*. You can use `ip route list default` to see that. Example output of my `ip route list default` command: Next, you need to know which network interface used by your server as its _default route_. You can use `ip route list default` to see that. Example output of my `ip route list default` command:
```plain ```plain
default via 164.90.160.1 dev eth0 proto static default via 164.90.160.1 dev eth0 proto static
``` ```
Write down the word after `dev` output, that's your default network interface. We will need that information later. In this example, my default network interface is `eth0`. Write down the word after `dev` output, that's your default network interface. We will need that information later. In this example, my default network interface is `eth0`.
Now add this following configuration to your `/etc/wireguard/wg0.conf` under `[Interface]` section: Now add this following configuration to your `/etc/wireguard/wg0.conf` under `[Interface]` section:
```plain ```plain
PostUp = ufw route allow in on wg0 out on eth0 PostUp = ufw route allow in on wg0 out on eth0
PostUp = iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE PostUp = iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
@ -185,6 +188,7 @@ PreDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
Replace `eth0` from above configuration with your server default network interface. Replace `eth0` from above configuration with your server default network interface.
Your `/etc/wireguard/wg0.conf` should look like this: Your `/etc/wireguard/wg0.conf` should look like this:
```plain ```plain
# /etc/wireguard/wg0.conf # /etc/wireguard/wg0.conf
@ -201,6 +205,7 @@ PreDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
``` ```
Now our WireGuard server is ready. Try to start your WireGuard server using `wg-quick` (via `systemd`): Now our WireGuard server is ready. Try to start your WireGuard server using `wg-quick` (via `systemd`):
```shell ```shell
sudo systemctl start wg-quick@wg0.service sudo systemctl start wg-quick@wg0.service
``` ```
@ -239,49 +244,62 @@ Jun 05 14:52:31 fra1-do1 systemd[1]: Finished WireGuard via wg-quick(8) for wg0.
To automatically start WireGuard service when the system start, you can execute `sudo systemctl enable wg-quick@wg0.service` command. To automatically start WireGuard service when the system start, you can execute `sudo systemctl enable wg-quick@wg0.service` command.
## Setup WireGuard Peer (*client*) ## Setup WireGuard Peer (_client_)
In this section, I'll use Linux machine using `wg-quick` via `systemd` as an example to connect to our configured WireGuard server. For other method such as connecting using **NetworkManager** GUI, Different OS and mobile devices, you can read my next article: "[Configure WireGuard VPN Clients]({{< ref "/tutorials/configure-wireguard-vpn-clients/index.md" >}})". In this section, I'll use Linux machine using `wg-quick` via `systemd` as an example to connect to our configured WireGuard server. For other method such as connecting using **NetworkManager** GUI, Different OS and mobile devices, you can read my next article: "[Configure WireGuard VPN Clients]({{< ref "/tutorials/configure-wireguard-vpn-clients/index.md" >}})".
Configuring WireGuard peer (client) on Linux using `systemd` is almost the same as setting up WireGuard server. The different is you didn't need to configure firewall and IP forward for peers. All you need to do is install WireGuard, create private and public key, configure DNS server you want to use, add start the service. Configuring WireGuard peer (client) on Linux using `systemd` is almost the same as setting up WireGuard server. The different is you didn't need to configure firewall and IP forward for peers. All you need to do is install WireGuard, create private and public key, configure DNS server you want to use, add start the service.
### Generating Private and Public Key Pairs (Client Side) ### Generating Private and Public Key Pairs (Client Side)
If you already have your own WireGuard key pairs, you can use that keys, skip this step and go to the next step: "[Configuring WireGuard Peer (client)](#configuring-wireguard-peer-client)". If you already have your own WireGuard key pairs, you can use that keys, skip this step and go to the next step: "[Configuring WireGuard Peer (client)](#configuring-wireguard-peer-client)".
> _Tips: You can create **vanity** public key address for **WireGuard** using tool like [warner/wireguard-vanity-address](https://github.com/warner/wireguard-vanity-address)._ > _Tips: You can create **vanity** public key address for **WireGuard** using tool like [warner/wireguard-vanity-address](https://github.com/warner/wireguard-vanity-address)._
#### Generate Peer Private key #### Generate Peer Private key
You can use `wg genkey` command to generate your private key. Place your private key to somewhere save, for example: `/etc/wireguard/do_private.key`. You can use `wg genkey` command to generate your private key. Place your private key to somewhere save, for example: `/etc/wireguard/do_private.key`.
```shell ```shell
wg genkey | sudo tee /etc/wireguard/do_private.key wg genkey | sudo tee /etc/wireguard/do_private.key
``` ```
Write down the output, we'll need that later to generate WireGuard peer public Key. Example of my WireGuard peer public key: Write down the output, we'll need that later to generate WireGuard peer public Key. Example of my WireGuard peer public key:
``` ```
WApLrVqFvXMbvsn+62DxfQCY8rsFqmHCEFAabAeA5WY= WApLrVqFvXMbvsn+62DxfQCY8rsFqmHCEFAabAeA5WY=
``` ```
Change `/etc/wireguard/do_private.key` file permission with `sudo chmod 600 /etc/wireguard/do_private.key`. Change `/etc/wireguard/do_private.key` file permission with `sudo chmod 600 /etc/wireguard/do_private.key`.
#### Generate Peer Public Key #### Generate Peer Public Key
Generate peer public key from previously generated peer private key: Generate peer public key from previously generated peer private key:
```shell ```shell
sudo cat /etc/wireguard/do_private.key | wg pubkey | sudo tee /etc/wireguard/do_public.key sudo cat /etc/wireguard/do_private.key | wg pubkey | sudo tee /etc/wireguard/do_public.key
``` ```
Write down the output, we'll need that public key later to be added to our WireGuard server. Example of my WireGuard peer public key: Write down the output, we'll need that public key later to be added to our WireGuard server. Example of my WireGuard peer public key:
``` ```
6gnV+QU7jG7BzwWrBbqiYpKQDGePYQunebkmvmFrxSk= 6gnV+QU7jG7BzwWrBbqiYpKQDGePYQunebkmvmFrxSk=
``` ```
### Configuring WireGuard Peer (client) ### Configuring WireGuard Peer (client)
Before configuring your **WireGuard** peer (client), you need to **decide your WireGuard private IP address for your peer** connection (*tunnel* interface). You should use unused IP address for peer(s) from your WireGuard network IP range. In this article, `10.10.88.1/24` already used by my WireGuard server, so I can't use that IP for peer(s). I'll use `10.10.88.2/24` (or `10.10.88.2/32`) instead.
Before configuring your **WireGuard** peer (client), you need to **decide your WireGuard private IP address for your peer** connection (_tunnel_ interface). You should use unused IP address for peer(s) from your WireGuard network IP range. In this article, `10.10.88.1/24` already used by my WireGuard server, so I can't use that IP for peer(s). I'll use `10.10.88.2/24` (or `10.10.88.2/32`) instead.
Now, we have all (basic) required information for WireGuard peer (client) to run: Now, we have all (basic) required information for WireGuard peer (client) to run:
- Server Public IP: `xxx.xx.xx0.246`
- Server Public Key: `7c023YtKepRPNNKfGsP5f2H2VtfPvVptn8Hn6jjmaz8=` - Server Public IP: `xxx.xx.xx0.246`
- Server Listen Port: `UDP` port `51822` - Server Public Key: `7c023YtKepRPNNKfGsP5f2H2VtfPvVptn8Hn6jjmaz8=`
- WireGuard Network: `10.10.88.0/24` - Server Listen Port: `UDP` port `51822`
- Client IP address: `10.10.88.2/24` - WireGuard Network: `10.10.88.0/24`
- Client IP address: `10.10.88.2/24`
Create file named `wg-do1.conf` for your WireGuard configuration under `/etc/wireguard` directory and fill with this configuration example: Create file named `wg-do1.conf` for your WireGuard configuration under `/etc/wireguard` directory and fill with this configuration example:
```plain ```plain
# /etc/wireguard/wg-do1.conf # /etc/wireguard/wg-do1.conf
@ -300,41 +318,49 @@ PersistentKeepalive = 15
Replace `<YOUR_PEER_PRIVATE_KEY>`, `<YOUR_PEER_IP_ADDRESS>`, `<YOUR_SERVER_PUBLIC_KEY>`, `<YOUR_SERVER_PUBLIC_IP_ADDRESS>`, and `<SERVER_UDP_LISTEN_PORT>` with yours. Replace `<YOUR_PEER_PRIVATE_KEY>`, `<YOUR_PEER_IP_ADDRESS>`, `<YOUR_SERVER_PUBLIC_KEY>`, `<YOUR_SERVER_PUBLIC_IP_ADDRESS>`, and `<SERVER_UDP_LISTEN_PORT>` with yours.
Note: Note:
- `AllowedIPs` = `0.0.0.0/0` means all traffic will go through that peer (in this case, our WireGuard server).
You can specify / selective routing specific IP to specific peer (if you connected to multiple peers / servers).
For example, if you only want to route traffic to IP 1.0.0.1 and 8.8.4.4 using specific peer and use your current internet connection as default route, you can remove `0.0.0.0/0` and add `1.0.0.1/32,8.8.4.4/32` (separated by comma) to `AllowedIPs` value.
- `PersistentKeepalive` = `15` : How many seconds for peer send *ping* to the server regularly, so the server can reach the peer sitting behind **NAT**/firewall.
- `DNS` You can also specify DNS servers you want to use in your `DNS` configuration value.
- `AllowedIPs` = `0.0.0.0/0` means all traffic will go through that peer (in this case, our WireGuard server).
You can specify / selective routing specific IP to specific peer (if you connected to multiple peers / servers).
For example, if you only want to route traffic to IP 1.0.0.1 and 8.8.4.4 using specific peer and use your current internet connection as default route, you can remove `0.0.0.0/0` and add `1.0.0.1/32,8.8.4.4/32` (separated by comma) to `AllowedIPs` value.
- `PersistentKeepalive` = `15` : How many seconds for peer send _ping_ to the server regularly, so the server can reach the peer sitting behind **NAT**/firewall.
- `DNS` You can also specify DNS servers you want to use in your `DNS` configuration value.
#### Adding Peers Public Key to WireGuard Server #### Adding Peers Public Key to WireGuard Server
you need to add every peers public key to WireGuard server configuration. This need to be done to allow peers connect to our WireGuard server. There are 2 ways to do this, depending on your server configuration. you need to add every peers public key to WireGuard server configuration. This need to be done to allow peers connect to our WireGuard server. There are 2 ways to do this, depending on your server configuration.
If you're following this tutorial with `SaveConfig = true` in the server config, you can add *peer public key* by issuing this command (in WireGuard Server): If you're following this tutorial with `SaveConfig = true` in the server config, you can add _peer public key_ by issuing this command (in WireGuard Server):
```shell ```shell
wg set wg0 peer 6gnV+QU7jG7BzwWrBbqiYpKQDGePYQunebkmvmFrxSk= allowed-ips 10.10.88.2 wg set wg0 peer 6gnV+QU7jG7BzwWrBbqiYpKQDGePYQunebkmvmFrxSk= allowed-ips 10.10.88.2
``` ```
Replace `wg0` with your WireGuard server *interface*, `6gnV+QU7jG7BzwWrBbqiYpKQDGePYQunebkmvmFrxSk=` with your peer public key, and `10.10.88.2` with the IP address of that will be used by that peer.
Replace `wg0` with your WireGuard server _interface_, `6gnV+QU7jG7BzwWrBbqiYpKQDGePYQunebkmvmFrxSk=` with your peer public key, and `10.10.88.2` with the IP address of that will be used by that peer.
If your WireGuard server configuration doesn't contain `SaveConfig = true` config, all you need to do is add peers information to your WireGuard server config (`/etc/wireguard/wg0.conf`). For Example: If your WireGuard server configuration doesn't contain `SaveConfig = true` config, all you need to do is add peers information to your WireGuard server config (`/etc/wireguard/wg0.conf`). For Example:
```plain ```plain
[Peer] [Peer]
PublicKey = 6gnV+QU7jG7BzwWrBbqiYpKQDGePYQunebkmvmFrxSk= PublicKey = 6gnV+QU7jG7BzwWrBbqiYpKQDGePYQunebkmvmFrxSk=
AllowedIPs = 10.10.88.2/32 AllowedIPs = 10.10.88.2/32
``` ```
Replace `6gnV+QU7jG7BzwWrBbqiYpKQDGePYQunebkmvmFrxSk=` with your peer public key, and `10.10.88.2` with the IP address of that will be used by that peer. Replace `6gnV+QU7jG7BzwWrBbqiYpKQDGePYQunebkmvmFrxSk=` with your peer public key, and `10.10.88.2` with the IP address of that will be used by that peer.
Don't forget to restart WireGuard service every time you change `/etc/wireguard/wg0.conf` file. Don't forget to restart WireGuard service every time you change `/etc/wireguard/wg0.conf` file.
```shell ```shell
sudo systemctl restart wg-quick@wg0.service sudo systemctl restart wg-quick@wg0.service
``` ```
### Connecting to Server ### Connecting to Server
Now, our peer (client) configuration is complete. You can try to connect your device to your WireGuard server using `systemd` service. Now, our peer (client) configuration is complete. You can try to connect your device to your WireGuard server using `systemd` service.
```shell ```shell
sudo systemctl start wg-quick@wg-do1.service sudo systemctl start wg-quick@wg-do1.service
``` ```
> _**Note 1**: `wg-do1` above is taken from your configuration file under `/etc/wireguard` directory (but without `.conf` file extension). If your configuration file is named `vpn-wireguard.conf`, you can start that configuration using `systemctl start wg-quick@vpn-wireguard.service`._ > _**Note 1**: `wg-do1` above is taken from your configuration file under `/etc/wireguard` directory (but without `.conf` file extension). If your configuration file is named `vpn-wireguard.conf`, you can start that configuration using `systemctl start wg-quick@vpn-wireguard.service`._
> _**Note 2**: By default `wg-quick` uses `resolvconf` to register new DNS entries. This will cause issues with network managers and DHCP clients that do not use `resolvconf`, as they will overwrite `/etc/resolv.conf` thus removing the DNS servers added by `wg-quick`._ > _**Note 2**: By default `wg-quick` uses `resolvconf` to register new DNS entries. This will cause issues with network managers and DHCP clients that do not use `resolvconf`, as they will overwrite `/etc/resolv.conf` thus removing the DNS servers added by `wg-quick`._
@ -349,12 +375,9 @@ To verify your configurations is properly configured, try to check your public I
![What is my IP](wg-vpn-do-ip.png#center) ![What is my IP](wg-vpn-do-ip.png#center)
## Conclusion ## Conclusion
WireGuard is my favorite VPN protocol. It's fast and less resource usage compared with other VPN protocols. It's highly configurable and works with multiple environments. Furthermore, it can be used for *peer-to-peer* connection, *client-server* connection, or creating secure *mesh network*.
When combined with **Nginx** as *reverse proxy*, you can even expose your local HTTP server (and almost any services) sitting behind **NAT**/firewall to the internet. WireGuard is my favorite VPN protocol. It's fast and less resource usage compared with other VPN protocols. It's highly configurable and works with multiple environments. Furthermore, it can be used for _peer-to-peer_ connection, _client-server_ connection, or creating secure _mesh network_.
When combined with **Nginx** as _reverse proxy_, you can even expose your local HTTP server (and almost any services) sitting behind **NAT**/firewall to the internet.
Anyway, managing large scale of WireGuard network can be very difficult. But, there are a tool to help you to manage large scale WireGuard networks, such as [Netmaker](https://www.netmaker.io/). Anyway, managing large scale of WireGuard network can be very difficult. But, there are a tool to help you to manage large scale WireGuard networks, such as [Netmaker](https://www.netmaker.io/).
### Additional Notes
- If you have some technical difficulties setting up your own WireGuard server, [I can help you to setup WireGuard VPN server](https://www.fiverr.com/s/4vzPGR) for small amount of money.
- To find out how to contact me, please visit [https://www.ditatompel.com/about](https://www.ditatompel.com/about).