Wireguard VPN Setup (Regular and Site to Site)

WireGuard for remote RDP/Port Forwarding

Client Config

[Interface]
PrivateKey = 
Address = 192.168.0.2/24

[Peer]
PublicKey = 
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1
Endpoint = 10.0.17.111:51820
PersistentKeepalive = 21
Notes: The Routing Lines in this file, are configured to route RDP traffic on 3389 to the MGMT system at 172.16.200.11. Also change the port used if not default

Server Config

[Interface]
PrivateKey = 
Address = 192.168.0.1/24
ListenPort = 51820
PreUp = sysctl -w net.ipv4.ip_forward=1
PreUp = iptables -t nat -A PREROUTING -p tcp -d 192.168.0.1 --dport 3389 -j DNAT --to-destination 172.16.200.11:3389
PreUp = iptables -t nat -A POSTROUTING -o ens160 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o ens160 -j MASQUERADE
PostDown = iptables -t nat -D PREROUTING -p tcp -d 192.168.0.1 --dport 3389 -j DNAT --to-destination 172.16.200.11:3389

[Peer]
PublicKey = 
AllowedIPs = 192.168.0.2/32
PersistentKeepalive = 21
Notes: Change the Public address, and the port used here, in the [Peer] section

Command List for installation:

apt install wireguard cd /etc/wireguard

1. Generate server keys, and change permissions for extra security

wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod go= /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

2. Generate client keys

wg genkey | sudo tee /etc/wireguard/clientprivate.key
sudo cat /etc/wireguard/clientprivate.key | wg pubkey | sudo tee /etc/wireguard/clientpublic.key

3. Restart, Enable, and check the status of the wg0 interface, with systemctl

systemctl enable wg-quick@wg0.service
systemctl restart wg-quick@wg0.service
systemctl status wg-quick@wg0.service

The Client Public key, is to be used in the [Peer] section of the server configuration

The Client Private key is in the [Interface] section of the client configuration

The Server Public key, is to be used in the [Peer] section of the Client configuration

The Server Private Key is to be used in the [Interface] section of the Server Configuration

Site to site with port forwarding

One of the good features of Wireguard is it is a P2P protocol so there are only a few tweaks necessary to allow port forwarding which can be used to have services forwarded from a VPS, thus bypassing the inability to port forward, lack of a static public ipv4 address, or if you are behind CGNAT

Server Config Example with routing rules

PrivateKey = <key>
ListenPort = 55107
Address = 10.1.0.1/24

PostUp = iptables -t nat -A PREROUTING -p tcp -i eth0 --match multiport --dports 25565,25566 -j DNAT --to-destination LOCALIP
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source PUBLICIP

PostDown = iptables -t nat -D PREROUTING -p tcp -i eth0 --match multiport --dports 25565,25566 -j DNAT --to-destination LOCALIP
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j SNAT --to-source PUBLICIP

[Peer]
PublicKey = <key>
AllowedIPs = 10.1.0.2/32

Client config Example with routing rules

[Interface]
PrivateKey = <key>
Address = 10.1.0.2/24

PostUp = iptables -t nat -A PREROUTING -p tcp --dport 25565 -j DNAT --to-destination SERVICEIP:25565; iptables -t nat -A POSTROUTING -p tcp --dport 25565 -j MASQUERADE
PostDown = iptables -t nat -D PREROUTING -p tcp --dport 25565 -j DNAT --to-destination SERVICEIP:25565; iptables -t nat -D POSTROUTING -p tcp --dport 25565 -j MASQUERADE

PostUp = iptables -t nat -A PREROUTING -p tcp --dport 25566 -j DNAT --to-destination SERVICEIP:25566; iptables -t nat -A POSTROUTING -p tcp --dport 25566 -j MASQUERADE
PostDown = iptables -t nat -D PREROUTING -p tcp --dport 25566 -j DNAT --to-destination SERVICEIP:25566; iptables -t nat -D POSTROUTING -p tcp --dport 25566 -j MASQUERADE

[Peer]
PublicKey = <key>
AllowedIPs = 0.0.0.0/0
Endpoint = PUBLICIP:55107
PersistentKeepalive = 25