WireGuard almost there

interpolgp · October 17, 2021 at 4:52 PM

Hey Team, I am very close to getting my persistent Wireguard VPN interface up and running on a libreelec 9.2.8 client.

Steps taken so far.

Block Connman from managing the wg interface
Use the wg setup rather than Connman
Use ip link, ip addr and wg setconf to configure the interface in the autostart.sh file

Below is the results of wg when kodi starts. I can ping and telnet the Wireguard Server

Code

LibreELEC:~ # wg
interface: wg0
  public key: (hidden, by me)
  private key: (hidden)
  listening port: 51820

peer: (hidden, by me)
  endpoint: 217.64.114.162:1443
  allowed ips: 0.0.0.0/1, 128.0.0.0/1
  latest handshake: 2 minutes, 11 seconds ago
  transfer: 736 B received, 3.09 KiB sent
  persistent keepalive: every 25 seconds

Display More

The route table

Code

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.0.1     0.0.0.0         UG    0      0        0 eth0
10.13.70.0      *               255.255.255.0   U     0      0        0 wg0
172.17.0.0      *               255.255.0.0     U     0      0        0 docker0
172.18.0.0      *               255.255.0.0     U     0      0        0 br-65330b1f8eae
192.168.0.0     *               255.255.255.0   U     0      0        0 eth0
192.168.0.1     *               255.255.255.255 UH    0      0        0 eth0

The issue I have is that my route tables look good but I am not sure how to route my traffic over the new wg0 interface. All traffic remains going across the default eth0.

Any ideas how this can be done? I tried "route add" but i dont seem to be able to specify all the details required.

Any comments or ideas would be greatly appreciated .

elonesna · October 17, 2021 at 6:05 PM

Sorry, I don't know what you're doing. Installing a WireGuard client is easy:

1.- Create a file /storage/.config/wireguard/WG-DDNS.config

Code

[provider_wireguard]
Type = WireGuard
Name = WG-DDNS
Host = <your-ddns-domain: luckyluke.duckdns.org>
WireGuard.Address = <your-wg-ip: 10.10.20.4/32>
WireGuard.PrivateKey = <your-wg-privatekey>
WireGuard.PublicKey = <wg-public-key-for-wg-network>
WireGuard.DNS = <dns-ip: 10.10.20.1>
WireGuard.AllowedIPs = <allowed-ips: 0.0.0.0/0>
WireGuard.EndpointPort = <wg-server-port: 51820>
WireGuard.PersistentKeepalive = <wg-parameter: 25>

Display More

2.- Start up the WireGuard client service

Code

systemctl start wireguard
connmanctl connect vpn_luckyluke_duckdns_org

3.- The output of the route command is similar to

Code

x96air1:~ # route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         *               0.0.0.0         U     0      0        0 wg0
10.10.10.0      *               255.255.255.0   U     0      0        0 ztc3quell2
10.10.20.0      *               255.255.255.0   U     0      0        0 wg0
172.17.0.0      *               255.255.0.0     U     0      0        0 docker0
192.168.1.0     *               255.255.255.0   U     0      0        0 wlan0
192.168.1.1     *               255.255.255.255 UH    0      0        0 wlan0

The default route is wg0.

interpolgp · October 17, 2021 at 6:20 PM

thanks @elonesna,

what version of libreelec are you using?

I notice your .conf file has some different syntax e.g. mine says"AllowedIPs" your says "WireGuard.AllowedIPs"

I'm stuck on libreelec 9.2.8 as one of my paid addons hasn't released a new version for kodi 19 yet

interpolgp · October 17, 2021 at 7:07 PM

Sorry I just found the wireguard.config.sample on my client is more like your version. I must be following a really old guide. Gonna give your way a go

interpolgp · October 17, 2021 at 7:58 PM

Yup your way works way better

"systemctl start wireguard" - doesn't work for me but

"connmanctl connect WG.Host.Address" brings up the connection

thanks so much

**chewitt** · October 18, 2021 at 3:47 AM

Code

cp /storage/.config/system.d/wireguard.service.sample /storage/.config/system.d/wireguard.service

^ then edit the wireguard.service file to call the connman service, and the tunnel is auto-started at startup.

interpolgp · October 18, 2021 at 6:16 PM

Quote from chewitt
Code
cp /storage/.config/system.d/wireguard.service.sample /storage/.config/system.d/wireguard.service
^ then edit the wireguard.service file to call the connman service, and the tunnel is auto-started at startup.

I'm happy to start it with autostart.sh script or to do it manually when I need it. Thanks for the help team!