Skip to content

nerves-networking/vintage_net_wireguard

Repository files navigation

VintageNetWireguard

Experimental

An attempt to support Wireguard VPN peer connections on Nerves devices. See https://wireguard.com for more info

Configuration

Wireguard needs to configure an interface and peer connections for that interface. Below is a list of the expected configuration parameters which are referenced from wg(8) and wg-quick(8):

Interface

Key wg name Required? Description
:private_key PrivateKey X base64 private key for the interface registered with the server
:addresses Address X list of IP addresses for the connection to use (CIDR supported)
:listen_port ListenPort port for the connection. Randomly assigned if empty or 0
:fwmark FwMark 32-bit fwmark for outgoing packets
:dns DNS list of DNS IP's
:peers [PEER] list of peer configs (see below)

Peer

Key wg name Required? Description
:public_key PublicKey X base64 public key
:endpoint Endpoint X endpoint to the wireguard server which the peer attempts to connect
:allowed_ips AllowedIps X list of IP addresses for allowed incoming packets and outgoing packets directed to. Defaults to ["0.0.0.0/0", "::0"]
:persistent_keepalive PersistentKeepalive optional integer seconds for sending an authenticated packet as a keepalive

Using Wireguard Config Files

Wireguard commonly uses *.conf configuration files to simplify the setup process and VintageNetWireguard provides a helper function to parse those config files into the expected format:

iex)> config = VintageNetWireguard.ConfigFile.parse("/path/to/wg0.conf")
iex)> VintageNet.configure("wg0", config)

Goals/Ideas

  • Setup wg* network interfaces
  • Notes/cookbook for setting up Wireguard server
    • fly.io
    • Another service?
  • Parse wireguard peer configs
  • Potentially support authentication via other routes (i.e. NervesKey)
  • Mechanism for registering a new peer with remote server
  • Prevent storing private keys on disc