Awesome

Big obnoxious message

This repository is now deprecated, future work will happen at https://github.com/WireGuard/wireguard-vyatta-ubnt.

vyatta-wireguard

This is a Vyatta module and pre-built binaries for the Ubiquiti EdgeRouter to support WireGuard.

Table of Contents

• Installation
• Upgrade
• Uninstallation
• Usage
• Routing
• Binaries
• Packaging
• Build from scratch

Installation

Download the latest release for your model and then install it via:

sudo dpkg -i wireguard-${BOARD}-${RELEASE}.deb

After you will have be able to create a wireguard interface (show interfaces).

Upgrade

Download the latest release for your model and then perform upgrade with:

configure
set interfaces wireguard wg0 route-allowed-ips false
commit
delete interfaces wireguard
commit
sudo rmmod wireguard
sudo dpkg -i /path/to/wireguard-${BOARD}-${RELEASE}.deb
sudo modprobe wireguard
load
commit
exit

This allows the upgrade without reboot.

Uninstallation

Private key

Determine if the private key is stored as a file by running show interfaces wireguard; if the private key line is a path then run the following command otherwise jump to Remove the configuration

sudo rm /config/auth/wg.key

Remove the configuration

configure

delete interfaces wireguard

commit
save
exit

Remove the package

sudo dpkg --remove wireguard

Usage

You can learn about how to actually use WireGuard on WireGuard.com. All of the concepts are explained in depth..

Here is a simple example of a configuration for vyatta/EdgeOS:

wg genkey | tee /config/auth/wg.key | wg pubkey >  wg.public

configure

set interfaces wireguard wg0 address 192.168.33.1/24
set interfaces wireguard wg0 listen-port 51820
set interfaces wireguard wg0 route-allowed-ips true

set interfaces wireguard wg0 peer GIPWDet2eswjz1JphYFb51sh6I+CwvzOoVyD7z7kZVc= endpoint example1.org:29922
set interfaces wireguard wg0 peer GIPWDet2eswjz1JphYFb51sh6I+CwvzOoVyD7z7kZVc= allowed-ips 192.168.33.101/32

set interfaces wireguard wg0 peer aBaxDzgsyDk58eax6lt3CLedDt6SlVHnDxLG2K5UdV4= endpoint example2.net:51820
set interfaces wireguard wg0 peer aBaxDzgsyDk58eax6lt3CLedDt6SlVHnDxLG2K5UdV4= allowed-ips 192.168.33.102/32
set interfaces wireguard wg0 peer aBaxDzgsyDk58eax6lt3CLedDt6SlVHnDxLG2K5UdV4= allowed-ips 192.168.33.103/32

set interfaces wireguard wg0 private-key /config/auth/wg.key

set firewall name WAN_LOCAL rule 20 action accept
set firewall name WAN_LOCAL rule 20 protocol udp
set firewall name WAN_LOCAL rule 20 description 'WireGuard'
set firewall name WAN_LOCAL rule 20 destination port 51820

commit
save
exit

The private-key and preshared-key fields can take the key value or a file path.

So if you prefer not to put the keys in the config file, then the private-key and preshared-key field can alternatively take a file path on the filesystem, such as /config/auth/.

Routing

Currenty there is no integration between the routing daemon and WireGuard which means allowed-ips for a peer will not be updated based upon dynamic routing updates.

If you are going to utilize a dynamic routing protocol over wireguard interfaces it is recommended to configure them with a single peer per interface, disable route-allowed-ips and either configure allowed-ips to 0.0.0.0/0 or all ip addresses which might ever be routed over the interface including any multicast addresses required by the routing protocol.

Binaries

This repository ships prebuilt binaries made from the WireGuard source code.

The binaries are statically linked against musl libc to mitigate potential issues with Ubiquiti EdgeOS's outdated glibc.

Packaging

1. Clone the repo git clone https://github.com/Lochnair/vyatta-wireguard
2. Get the WireGuard version number from Lochnair's build server's latest successfully build from build.lochnair.net/ (e.g. refs/tags/0.0.20181218)
3. Edit the verion number in debian/control to match the build server.
4. Run ./update_binaries.sh
5. Run make
6. Get the newly created deb files from the package folder.

Build from scratch

If you are buliding from scratch, please be sure to use -mabi=64 in your CFLAGS for compiling the userspace tools; otherwise there will be strange runtime errors.

Kernel Module

$ mkdir -p linux-src/linux-3.10
$ cd linux-src/linux-3.10
$ tar xf ../../source/kernel_*.tgz
$ cd ../..
$ tar xf source/cavm-executive_*.tgz
$ export KERNELDIR="$PWD/linux-src/linux-3.10/kernel"
$ cd OCTEON-SDK
$ . ./env-setup OCTEON_CN50XX --no-runtime-model --verbose
$ cd ..
$ export CROSS_COMPILE=mips64-octeon-linux-gnu-
$ export CC=mips64-octeon-linux-gnu-gcc
$ export ARCH=mips
$ make -C linux-src/linux-3.10/kernel -j$(nproc)
$ git clone https://git.zx2c4.com/WireGuard
$ make -C linux-src/linux-3.10/kernel M=$PWD/WireGuard/src modules -j$(nproc)
$ ls -l WireGuard/src/wireguard.ko

Userspace Tools

$ cd OCTEON-SDK
$ . ./env-setup OCTEON_CN50XX --no-runtime-model --verbose
$ cd ..
$ export CROSS_COMPILE=mips64-octeon-linux-gnu-
$ export CC=mips64-octeon-linux-gnu-gcc
$ export ARCH=mips
$ mkdir -p prefix
$ prefix="$PWD/prefix"
$ git clone git://git.musl-libc.org/musl
$ cd musl
$ CFLAGS=-mabi=64 ./configure --prefix="$prefix" --disable-shared
$ make -j$(nproc)
$ make install
$ cd ..
$ make -C linux-src/linux-3.10/kernel headers_install INSTALL_HDR_PATH="$prefix"
$ git clone git://git.netfilter.org/libmnl
$ cd libmnl
$ ./autogen.sh
$ CC="$prefix/bin/musl-gcc" CFLAGS=-mabi=64 ./configure --prefix="$prefix" --disable-shared --enable-static --host=x86_64-pc-linux-gnu
$ make -j$(nproc)
$ make install
$ cd ..
$ git clone https://git.zx2c4.com/WireGuard
$ CC="$prefix/bin/musl-gcc" make -C WireGuard/src/tools/ -j$(nproc)
$ ls -l WireGuard/src/tools/wg