Wireguard - Revision history http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&action=history Revision history for this page on the wiki en MediaWiki 1.10.1 Thu, 28 Mar 2024 13:21:28 GMT Kernel-panic69: (add note regarding current documentation) http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&diff=56803&oldid=prev <p>(add note regarding current documentation)</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 22:07, 4 February 2024</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[VPN]] -&gt; '''[[Wireguard]]'''&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">[[VPN]] -&gt; '''[[Wireguard]]'''&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">'''NOTE: The most updated WireGuard documentation is currently in the forum: [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397 WireGuard guides and documentation]''' </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">__TOC__</td><td> </td><td style="background: #eee; font-size: smaller;">__TOC__</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> </table> Sun, 04 Feb 2024 22:07:35 GMT Kernel-panic69 http://wiki.dd-wrt.com/wiki/index.php/Talk:Wireguard Jeremywh7: add new split-out forum guide links http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&diff=55617&oldid=prev <p>add new split-out forum guide links</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 16:47, 13 May 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 29:</strong></td> <td colspan="2" align="left"><strong>Line 29:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">The &quot;Quick Response&quot; Code is a two-dimensional barcode with larger encoded data capacity and high fault tolerance. Since build 38581 in February 2019, a client config can be imported using a QR Code. The advantage of this approach is that there is no need to transfer sensitive information via potentially compromised data channels.</td><td> </td><td style="background: #eee; font-size: smaller;">The &quot;Quick Response&quot; Code is a two-dimensional barcode with larger encoded data capacity and high fault tolerance. Since build 38581 in February 2019, a client config can be imported using a QR Code. The advantage of this approach is that there is no need to transfer sensitive information via potentially compromised data channels.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==Setup <del style="color: red; font-weight: bold; text-decoration: none;">Instructions</del>==</td><td>+</td><td style="background: #cfc; font-size: smaller;">==<ins style="color: red; font-weight: bold; text-decoration: none;">Install and </ins>Setup <ins style="color: red; font-weight: bold; text-decoration: none;">Guides</ins>==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">The <del style="color: red; font-weight: bold; text-decoration: none;">Wireguard </del>[https://www.wireguard.com/install/ installation/downloads] page has software and instructions per OS.</td><td>+</td><td style="background: #cfc; font-size: smaller;">The <ins style="color: red; font-weight: bold; text-decoration: none;">WireGuard </ins>[https://www.wireguard.com/install/ installation/downloads] page has software and instructions per OS.<ins style="color: red; font-weight: bold; text-decoration: none;">&lt;br&gt;</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*For the latest updated information and additional scripts see the </del>[https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322206 <del style="color: red; font-weight: bold; text-decoration: none;">Wireguard </del>setup <del style="color: red; font-weight: bold; text-decoration: none;">guide</del>]:</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">&lt;u&gt;WireGuard Forum Guides&lt;/u&gt;:</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*</del>*Setup DDWRT router as a Wireguard server</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>[https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322206 <ins style="color: red; font-weight: bold; text-decoration: none;">Server </ins>setup] <ins style="color: red; font-weight: bold; text-decoration: none;"> [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624 Client setup] [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787 Advanced setup]</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*</del>*Client devices setup</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">'''These forum guides have the latest updated information and additional scripts such as</ins>:<ins style="color: red; font-weight: bold; text-decoration: none;">'''</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*</del>*Setup DDWRT router as a Wireguard client</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Setup DDWRT router as a Wireguard server</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*</del>*Policy Based Routing for Wireguard</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Client devices setup</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*</del>*Wireguard PBR Kill Script</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Setup DDWRT router as a Wireguard client</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*</del>*Info regarding changes for CVE-2019-14899 ([https://svn.dd-wrt.com/ticket/6928 ticket 6928])</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Policy Based Routing for Wireguard</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Wireguard PBR Kill Script</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Info regarding changes for CVE-2019-14899 ([https://svn.dd-wrt.com/ticket/6928 ticket 6928])</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">==Setup Instructions==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">'''Create the Wireguard tunnel:'''&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">'''Create the Wireguard tunnel:'''&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">DD-WRT ''Basic'' -&gt; ''Tunnels'' tab: enable the ''Tunnel'' then select ''WireGuard'' for ''Protocol Type''.</td><td> </td><td style="background: #eee; font-size: smaller;">DD-WRT ''Basic'' -&gt; ''Tunnels'' tab: enable the ''Tunnel'' then select ''WireGuard'' for ''Protocol Type''.</td></tr> </table> Wed, 13 May 2020 16:47:46 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:Wireguard Jeremywh7: /* Linux config import */ connman release update http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&diff=55419&oldid=prev <p><span class="autocomment">Linux config import -</span> connman release update</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 03:39, 19 February 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 60:</strong></td> <td colspan="2" align="left"><strong>Line 60:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Linux config import====</td><td> </td><td style="background: #eee; font-size: smaller;">====Linux config import====</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Review the Wireguard install page, distribution wiki (e.g. for [https://wiki.archlinux.org/index.php/WireGuard Arch]) and/or forums for more details.</td><td> </td><td style="background: #eee; font-size: smaller;">Review the Wireguard install page, distribution wiki (e.g. for [https://wiki.archlinux.org/index.php/WireGuard Arch]) and/or forums for more details.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Manager: systemd-networkd 237, networkmanager 1.16, connman <del style="color: red; font-weight: bold; text-decoration: none;">(git since 18 Jan 2020)</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">*Manager: systemd-networkd 237, networkmanager 1.16, connman <ins style="color: red; font-weight: bold; text-decoration: none;">1.38</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Graphical QR Code decoder e.g. [https://launchpad.net/qr-tools '''qtqr'''] </td><td> </td><td style="background: #eee; font-size: smaller;">*Graphical QR Code decoder e.g. [https://launchpad.net/qr-tools '''qtqr'''] </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Screenshot tool e.g. [https://flameshot.js.org/#/ '''flameshot''']</td><td> </td><td style="background: #eee; font-size: smaller;">*Screenshot tool e.g. [https://flameshot.js.org/#/ '''flameshot''']</td></tr> </table> Wed, 19 Feb 2020 03:39:37 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:Wireguard Jeremywh7: Linux 5.6 upstream and minor cleanup http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&diff=55384&oldid=prev <p>Linux 5.6 upstream and minor cleanup</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 20:56, 6 February 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 18:</strong></td> <td colspan="2" align="left"><strong>Line 18:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*UDP only</td><td> </td><td style="background: #eee; font-size: smaller;">*UDP only</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*SSH authenticated keys</td><td> </td><td style="background: #eee; font-size: smaller;">*SSH authenticated keys</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Executes <del style="color: red; font-weight: bold; text-decoration: none;">within the Linux </del>kernel</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Executes <ins style="color: red; font-weight: bold; text-decoration: none;">in-</ins>kernel <ins style="color: red; font-weight: bold; text-decoration: none;">(and is upstream since Linux 5.6)</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Static routing</td><td> </td><td style="background: #eee; font-size: smaller;">*Static routing</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==How it works==</td><td> </td><td style="background: #eee; font-size: smaller;">==How it works==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[https://www.wireguard.com/quickstart/ Quick Start]<del style="color: red; font-weight: bold; text-decoration: none;">&lt;br&gt;</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">[https://www.wireguard.com/quickstart/ Quick Start]<ins style="color: red; font-weight: bold; text-decoration: none;">, </ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/#conceptual-overview Conceptual Overview]&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/#conceptual-overview Conceptual Overview]&lt;br&gt;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==Why WireGuard + DD-WRT tunnel?==</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">This tutorial shows the basics of securely creating a tunnel from a client device to DD-WRT. Before proceeding, verify a working reset button and configuration backup in case of problems.</td><td> </td><td style="background: #eee; font-size: smaller;">This tutorial shows the basics of securely creating a tunnel from a client device to DD-WRT. Before proceeding, verify a working reset button and configuration backup in case of problems.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 32:</strong></td> <td colspan="2" align="left"><strong>Line 30:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Setup Instructions==</td><td> </td><td style="background: #eee; font-size: smaller;">==Setup Instructions==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">The Wireguard installation/downloads page has software and instructions per OS.</td><td>+</td><td style="background: #cfc; font-size: smaller;">The Wireguard <ins style="color: red; font-weight: bold; text-decoration: none;">[https://www.wireguard.com/install/ </ins>installation/downloads<ins style="color: red; font-weight: bold; text-decoration: none;">] </ins>page has software and instructions per OS.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*For the latest updated information and additional scripts see the [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322206 Wireguard setup guide]:</td><td> </td><td style="background: #eee; font-size: smaller;">*For the latest updated information and additional scripts see the [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322206 Wireguard setup guide]:</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">**Setup DDWRT router as a Wireguard server</td><td> </td><td style="background: #eee; font-size: smaller;">**Setup DDWRT router as a Wireguard server</td></tr> <tr><td colspan="2" align="left"><strong>Line 61:</strong></td> <td colspan="2" align="left"><strong>Line 59:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Linux config import====</td><td> </td><td style="background: #eee; font-size: smaller;">====Linux config import====</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">systemd-networkd 237, networkmanager 1.16, <del style="color: red; font-weight: bold; text-decoration: none;">and </del>connman (git since 18 Jan 2020) <del style="color: red; font-weight: bold; text-decoration: none;">support Wireguard and preshared key.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Review the Wireguard install page, distribution wiki (e.g. for [https://wiki.archlinux.org/index.php/WireGuard Arch]) and/or forums for more details.</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">* Graphical QR Code decoder e.g. [https://launchpad.net/qr-tools '''qtqr'''] </td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Manager: </ins>systemd-networkd 237, networkmanager 1.16, connman (git since 18 Jan 2020)</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">* Screenshot tool e.g. [https://flameshot.js.org/#/ '''flameshot''']</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Graphical QR Code decoder e.g. [https://launchpad.net/qr-tools '''qtqr'''] </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;">*Screenshot tool e.g. [https://flameshot.js.org/#/ '''flameshot''']</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Review the </del>Wireguard <del style="color: red; font-weight: bold; text-decoration: none;">[https://www.wireguard.com/install/ install] page, Linux distribution wiki (e.g. for [https://wiki.archlinux.org/index.php/WireGuard Arch]) </del>and<del style="color: red; font-weight: bold; text-decoration: none;">/or forums for more specific details</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Using a network manager with </ins>Wireguard and <ins style="color: red; font-weight: bold; text-decoration: none;">preshared key support is optional but much easier</ins>.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Go to ''Tunnels'' to generate then capture and save a QR Code screenshot </td><td> </td><td style="background: #eee; font-size: smaller;">*Go to ''Tunnels'' to generate then capture and save a QR Code screenshot </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Open the QR Code decoder and add the png file to decode</td><td> </td><td style="background: #eee; font-size: smaller;">*Open the QR Code decoder and add the png file to decode</td></tr> </table> Thu, 06 Feb 2020 20:56:50 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:Wireguard Jeremywh7: update for r42067 http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&diff=55361&oldid=prev <p>update for r42067</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 23:37, 21 January 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 29:</strong></td> <td colspan="2" align="left"><strong>Line 29:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==What is a QR Code?==</td><td> </td><td style="background: #eee; font-size: smaller;">==What is a QR Code?==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Since build 38581 in February 2019, a client config can be imported using <del style="color: red; font-weight: bold; text-decoration: none;">&quot;Quick Response&quot; code</del>. The advantage of this approach is that there is no need to transfer sensitive information via potentially <del style="color: red; font-weight: bold; text-decoration: none;">be </del>compromised data channels<del style="color: red; font-weight: bold; text-decoration: none;">. The QR Code is a two-dimensional barcode with larger encoded data capacity and high fault tolerance</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">The &quot;Quick Response&quot; Code is a two-dimensional barcode with larger encoded data capacity and high fault tolerance. </ins>Since build 38581 in February 2019, a client config can be imported using <ins style="color: red; font-weight: bold; text-decoration: none;">a QR Code</ins>. The advantage of this approach is that there is no need to transfer sensitive information via potentially compromised data channels.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Setup Instructions==</td><td> </td><td style="background: #eee; font-size: smaller;">==Setup Instructions==</td></tr> <tr><td colspan="2" align="left"><strong>Line 43:</strong></td> <td colspan="2" align="left"><strong>Line 43:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">'''Create the Wireguard tunnel:'''&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">'''Create the Wireguard tunnel:'''&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">DD-WRT ''Basic'' -&gt; ''Tunnels'' tab: enable the ''Tunnel'' then select ''WireGuard'' for ''Protocol Type''.</td><td> </td><td style="background: #eee; font-size: smaller;">DD-WRT ''Basic'' -&gt; ''Tunnels'' tab: enable the ''Tunnel'' then select ''WireGuard'' for ''Protocol Type''.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*''Generate Key'' and enter the oet1 interface IP <del style="color: red; font-weight: bold; text-decoration: none;">(</del>must be a <del style="color: red; font-weight: bold; text-decoration: none;">separate </del>network outside the local LAN range<del style="color: red; font-weight: bold; text-decoration: none;">)</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">*''Generate Key'' and enter the <ins style="color: red; font-weight: bold; text-decoration: none;">''</ins>oet1<ins style="color: red; font-weight: bold; text-decoration: none;">'' </ins>interface IP<ins style="color: red; font-weight: bold; text-decoration: none;">: &lt;font color=red&gt;</ins>must be a network outside the local LAN range<ins style="color: red; font-weight: bold; text-decoration: none;">&lt;/font&gt;</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*E.g. if the router LAN IP is 192.168.2.1, for the oet1 IP address use 10.10.0.1.</td><td> </td><td style="background: #eee; font-size: smaller;">*E.g. if the router LAN IP is 192.168.2.1, for the oet1 IP address use 10.10.0.1.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 50:</strong></td> <td colspan="2" align="left"><strong>Line 50:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">'''Masquerade the tunnel:'''&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">'''Masquerade the tunnel:'''&lt;br&gt;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Wireguard <del style="color: red; font-weight: bold; text-decoration: none;">cannot bridge, so </del>must <del style="color: red; font-weight: bold; text-decoration: none;">use </del>Forwarding and NAT. Go to ''Networking'', unbridge the oet1 interface, and enable Masquerade / NAT to have internet on <del style="color: red; font-weight: bold; text-decoration: none;">other side of </del>the tunnel. Click ''Apply''.</td><td>+</td><td style="background: #cfc; font-size: smaller;">Wireguard must <ins style="color: red; font-weight: bold; text-decoration: none;">be unbridged, using </ins>Forwarding and NAT. Go to ''Networking'', unbridge the oet1 interface <ins style="color: red; font-weight: bold; text-decoration: none;">(automatic since r42067)</ins>, and enable Masquerade / NAT to have internet on the tunnel. Click ''Apply''.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Note for Access Point mode====</td><td> </td><td style="background: #eee; font-size: smaller;">====Note for Access Point mode====</td></tr> <tr><td colspan="2" align="left"><strong>Line 57:</strong></td> <td colspan="2" align="left"><strong>Line 57:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Android/iOS config import====</td><td> </td><td style="background: #eee; font-size: smaller;">====Android/iOS config import====</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Android: [https://play.google.com/store/apps/details?id=com.wireguard.android Google Play Store], iOS: [https://itunes.apple.com/us/app/wireguard/id1441195209 Apple Store (12.0 or later)]</td><td>+</td><td style="background: #cfc; font-size: smaller;">Android: [https://play.google.com/store/apps/details?id=com.wireguard.android Google Play Store], iOS: [https://itunes.apple.com/us/app/wireguard/id1441195209 Apple Store (12.0 or later)]<ins style="color: red; font-weight: bold; text-decoration: none;">&lt;br&gt;</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">WireGuard app: press &quot;+&quot; in the lower right corner, select &quot;Create from QR code&quot;, <del style="color: red; font-weight: bold; text-decoration: none;">and </del>scan from DD-WRT peer<del style="color: red; font-weight: bold; text-decoration: none;">.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">WireGuard app: press &quot;+&quot; in the lower right corner, select &quot;Create from QR code&quot;, scan from DD-WRT peer, <ins style="color: red; font-weight: bold; text-decoration: none;">then </ins>the app will prompt to name the tunnel. Public IP can be checked [http://whatismyip.akamai.com/advanced here].</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">After the config file transfers</del>, the app will prompt to name the tunnel. Public IP can be checked [http://whatismyip.akamai.com/advanced here].</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Linux config import====</td><td> </td><td style="background: #eee; font-size: smaller;">====Linux config import====</td></tr> </table> Tue, 21 Jan 2020 23:37:55 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:Wireguard Jeremywh7: /* Resolving local hostnames in the tunnel */ typo http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&diff=55356&oldid=prev <p><span class="autocomment">Resolving local hostnames in the tunnel -</span> typo</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 00:42, 21 January 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 131:</strong></td> <td colspan="2" align="left"><strong>Line 131:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Resolving local hostnames in the tunnel====</td><td> </td><td style="background: #eee; font-size: smaller;">====Resolving local hostnames in the tunnel====</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">DD-WRT GUI ''Services'' -&gt; DNSMasq section: enable &quot;Local DNS&quot; and disable &quot;No DNS Rebind&quot;, go to ''Tunnels'' to enter local DNS IP (e.g. 192.168.1.1) for Peer Tunnel DNS (repeat for every peer). Since Wireguard cannot be bridged, the wireguard interface or it's local IP needs specified in dnsmasq as an additional binding interface / listener (interface=oet1). There is also an nvram parameter &quot;dnsmasq_addif&quot; to specify custom additional interfaces (''nvram set dnsmasq_addif=oet1'').</td><td> </td><td style="background: #eee; font-size: smaller;">DD-WRT GUI ''Services'' -&gt; DNSMasq section: enable &quot;Local DNS&quot; and disable &quot;No DNS Rebind&quot;, go to ''Tunnels'' to enter local DNS IP (e.g. 192.168.1.1) for Peer Tunnel DNS (repeat for every peer). Since Wireguard cannot be bridged, the wireguard interface or it's local IP needs specified in dnsmasq as an additional binding interface / listener (interface=oet1). There is also an nvram parameter &quot;dnsmasq_addif&quot; to specify custom additional interfaces (''nvram set dnsmasq_addif=oet1'').</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*The easiest way is to simply add a DHCP interface at ''Setup'' -&gt; ''Networking''<del style="color: red; font-weight: bold; text-decoration: none;">'. Since </del>the client is not requesting any IP nothing special will happen. DHCP is present and reachable, but unused.</td><td>+</td><td style="background: #cfc; font-size: smaller;">*The easiest way is to simply add a DHCP interface at ''Setup'' -&gt; ''Networking'' <ins style="color: red; font-weight: bold; text-decoration: none;">since </ins>the client is not requesting any IP<ins style="color: red; font-weight: bold; text-decoration: none;">, </ins>nothing special will happen. DHCP is present and reachable, but unused.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Reference==</td><td> </td><td style="background: #eee; font-size: smaller;">==Reference==</td></tr> </table> Tue, 21 Jan 2020 00:42:11 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:Wireguard Jeremywh7: /* Resolving local hostnames in the tunnel */ http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&diff=55352&oldid=prev <p><span class="autocomment">Resolving local hostnames in the tunnel</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:47, 20 January 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 130:</strong></td> <td colspan="2" align="left"><strong>Line 130:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Resolving local hostnames in the tunnel====</td><td> </td><td style="background: #eee; font-size: smaller;">====Resolving local hostnames in the tunnel====</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">DD-WRT GUI ''Services'' -&gt; DNSMasq section: enable &quot;Local DNS&quot; and disable &quot;No DNS Rebind&quot;</td><td>+</td><td style="background: #cfc; font-size: smaller;">DD-WRT GUI ''Services'' -&gt; DNSMasq section: enable &quot;Local DNS&quot; and disable &quot;No DNS Rebind&quot;, <ins style="color: red; font-weight: bold; text-decoration: none;">go to ''Tunnels'' to </ins>enter local DNS <ins style="color: red; font-weight: bold; text-decoration: none;">IP </ins>(e.g. 192.168.1.1) <ins style="color: red; font-weight: bold; text-decoration: none;">for Peer Tunnel DNS (repeat </ins>for every peer<ins style="color: red; font-weight: bold; text-decoration: none;">)</ins>. Since Wireguard cannot be bridged, the wireguard interface or <ins style="color: red; font-weight: bold; text-decoration: none;">it's </ins>local IP needs specified in dnsmasq as <ins style="color: red; font-weight: bold; text-decoration: none;">an </ins>additional binding interface / listener (interface=oet1). There is also <ins style="color: red; font-weight: bold; text-decoration: none;">an </ins>nvram <ins style="color: red; font-weight: bold; text-decoration: none;">parameter </ins>&quot;dnsmasq_addif&quot; to specify custom additional interfaces (<ins style="color: red; font-weight: bold; text-decoration: none;">''</ins>nvram set dnsmasq_addif=oet1<ins style="color: red; font-weight: bold; text-decoration: none;">''</ins>).</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Then</del>, <del style="color: red; font-weight: bold; text-decoration: none;">on eop-tunnel.asp site for Peer Tunnel DNS field </del>enter <del style="color: red; font-weight: bold; text-decoration: none;">your router/</del>local DNS <del style="color: red; font-weight: bold; text-decoration: none;">ip </del>(e.g. 192.168.1.1)<del style="color: red; font-weight: bold; text-decoration: none;">. Repeat it </del>for every peer. Since Wireguard cannot be bridged, the wireguard interface or local IP <del style="color: red; font-weight: bold; text-decoration: none;">of the interface </del>needs specified in dnsmasq as additional binding interface / listener (interface=oet1). There is also <del style="color: red; font-weight: bold; text-decoration: none;">a </del>nvram <del style="color: red; font-weight: bold; text-decoration: none;">var </del>&quot;dnsmasq_addif&quot; <del style="color: red; font-weight: bold; text-decoration: none;">which allows you </del>to specify custom additional interfaces (nvram set dnsmasq_addif=oet1). <del style="color: red; font-weight: bold; text-decoration: none;">But, the </del>easiest way is to simply add a <del style="color: red; font-weight: bold; text-decoration: none;">dhcp </del>interface at <del style="color: red; font-weight: bold; text-decoration: none;">networking.asp (bottom of the page)</del>. Since the client is not requesting any IP nothing special will happen. DHCP is present and reachable, but unused.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*The </ins>easiest way is to simply add a <ins style="color: red; font-weight: bold; text-decoration: none;">DHCP </ins>interface at <ins style="color: red; font-weight: bold; text-decoration: none;">''Setup'' -&gt; ''Networking'''</ins>. Since the client is not requesting any IP nothing special will happen. DHCP is present and reachable, but unused.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Reference==</td><td> </td><td style="background: #eee; font-size: smaller;">==Reference==</td></tr> </table> Mon, 20 Jan 2020 18:47:32 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:Wireguard Jeremywh7 at 18:24, 20 January 2020 http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&diff=55351&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:24, 20 January 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 5:</strong></td> <td colspan="2" align="left"><strong>Line 5:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Image:benchmark.PNG|thumbnail|Why WireGuard?]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Image:benchmark.PNG|thumbnail|Why WireGuard?]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/ WireGuard®] is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN.</td><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/ WireGuard®] is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN.</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:oet1.PNG|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:QR-Code.PNG|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:Android.jpeg|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:Enable.jpeg|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:DecodeQRcode.PNG|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:Vpn.jpg|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:Blabla.png|thumbnail|Instructions]]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Some key points about Wireguard:</td><td> </td><td style="background: #eee; font-size: smaller;">Some key points about Wireguard:</td></tr> <tr><td colspan="2" align="left"><strong>Line 18:</strong></td> <td colspan="2" align="left"><strong>Line 26:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Why WireGuard + DD-WRT tunnel?==</td><td> </td><td style="background: #eee; font-size: smaller;">==Why WireGuard + DD-WRT tunnel?==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:oet1.PNG|600px|Instructions]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:QR-Code.PNG|200px|Instructions]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:Android.jpeg|thumbnail|Instructions]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:Enable.jpeg|thumbnail|Instructions]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:DecodeQRcode.PNG|thumbnail|Instructions]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:Vpn.jpg|thumbnail|Instructions]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:Blabla.png|thumbnail|Instructions]]</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">This tutorial shows the basics of securely creating a tunnel from a client device to DD-WRT. Before proceeding, verify a working reset button and configuration backup in case of problems.</td><td> </td><td style="background: #eee; font-size: smaller;">This tutorial shows the basics of securely creating a tunnel from a client device to DD-WRT. Before proceeding, verify a working reset button and configuration backup in case of problems.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==What is a QR Code?==</td><td> </td><td style="background: #eee; font-size: smaller;">==What is a QR Code?==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Starting since </del>build 38581 in February 2019, a client config can be imported using <del style="color: red; font-weight: bold; text-decoration: none;">QR Code</del>. The advantage of this approach is that there is no need to transfer sensitive information via potentially be compromised data channels. The QR Code is a two-dimensional barcode with larger data capacity and high fault tolerance<del style="color: red; font-weight: bold; text-decoration: none;">. &quot;QR&quot; stands for &quot;Quick Response&quot; which refers to the instant access to the information encoded in it</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Since </ins>build 38581 in February 2019, a client config can be imported using <ins style="color: red; font-weight: bold; text-decoration: none;">&quot;Quick Response&quot; code</ins>. The advantage of this approach is that there is no need to transfer sensitive information via potentially be compromised data channels. The QR Code is a two-dimensional barcode with larger <ins style="color: red; font-weight: bold; text-decoration: none;">encoded </ins>data capacity and high fault tolerance.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Setup Instructions==</td><td> </td><td style="background: #eee; font-size: smaller;">==Setup Instructions==</td></tr> <tr><td colspan="2" align="left"><strong>Line 62:</strong></td> <td colspan="2" align="left"><strong>Line 62:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Linux config import====</td><td> </td><td style="background: #eee; font-size: smaller;">====Linux config import====</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">systemd-networkd 237, networkmanager 1.16, and connman (git since 18 Jan 2020) support Wireguard and preshared key</td><td>+</td><td style="background: #cfc; font-size: smaller;">systemd-networkd 237, networkmanager 1.16, and connman (git since 18 Jan 2020) support Wireguard and preshared key<ins style="color: red; font-weight: bold; text-decoration: none;">.</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Graphical QR Code decoder e.g. [https://launchpad.net/qr-tools '''qtqr'''] </td><td> </td><td style="background: #eee; font-size: smaller;">* Graphical QR Code decoder e.g. [https://launchpad.net/qr-tools '''qtqr'''] </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Screenshot tool e.g. [https://flameshot.js.org/#/ '''flameshot''']</td><td> </td><td style="background: #eee; font-size: smaller;">* Screenshot tool e.g. [https://flameshot.js.org/#/ '''flameshot''']</td></tr> <tr><td colspan="2" align="left"><strong>Line 74:</strong></td> <td colspan="2" align="left"><strong>Line 74:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Windows config import====</td><td> </td><td style="background: #eee; font-size: smaller;">====Windows config import====</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Windows Wireguard client: [https://www.wireguard.com/install/ Windows .msi installer]&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">Windows Wireguard client: [https://www.wireguard.com/install/ Windows .msi installer]&lt;br&gt;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">Graphical QRCode decoder e.g. [https://www.codetwo.com/freeware/qr-code-desktop-reader/ CodeTwo QR Code Reader]</td><td>+</td><td style="background: #cfc; font-size: smaller;">Graphical QRCode decoder e.g. [https://www.codetwo.com/freeware/qr-code-desktop-reader/ CodeTwo QR Code Reader]<ins style="color: red; font-weight: bold; text-decoration: none;">&lt;br&gt;</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Options====</td><td> </td><td style="background: #eee; font-size: smaller;">====Options====</td></tr> </table> Mon, 20 Jan 2020 18:24:58 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:Wireguard Jeremywh7: update outdated links and info http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&diff=55350&oldid=prev <p>update outdated links and info</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 18:12, 20 January 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 1:</strong></td> <td colspan="2" align="left"><strong>Line 1:</strong></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[VPN]] -&gt; '''[[Wireguard]]''' <del style="color: red; font-weight: bold; text-decoration: none;">-&gt; [[The Easiest Tunnel Ever]]</del>&lt;br&gt;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[VPN]] -&gt; '''[[Wireguard]]'''&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">__TOC__</td><td> </td><td style="background: #eee; font-size: smaller;">__TOC__</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[[Image:benchmark.PNG|thumbnail|Why WireGuard?]]</td><td> </td><td style="background: #eee; font-size: smaller;">[[Image:benchmark.PNG|thumbnail|Why WireGuard?]]</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==Why WireGuard?==</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/ WireGuard®] is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN.</td><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/ WireGuard®] is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 18:</strong></td> <td colspan="2" align="left"><strong>Line 16:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/quickstart/ Quick Start]&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/quickstart/ Quick Start]&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/#conceptual-overview Conceptual Overview]&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/#conceptual-overview Conceptual Overview]&lt;br&gt;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">==Why WireGuard + DD-WRT tunnel?==</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:oet1.PNG|600px|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:QR-Code.PNG|200px|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:Android.jpeg|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:Enable.jpeg|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:DecodeQRcode.PNG|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:Vpn.jpg|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Image:Blabla.png|thumbnail|Instructions]]</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">This tutorial shows the basics of securely creating a tunnel from a client device to DD-WRT. Before proceeding, verify a working reset button and configuration backup in case of problems.</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">==What is a QR Code?==</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">Starting since build 38581 in February 2019, a client config can be imported using QR Code. The advantage of this approach is that there is no need to transfer sensitive information via potentially be compromised data channels. The QR Code is a two-dimensional barcode with larger data capacity and high fault tolerance. &quot;QR&quot; stands for &quot;Quick Response&quot; which refers to the instant access to the information encoded in it.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Setup Instructions==</td><td> </td><td style="background: #eee; font-size: smaller;">==Setup Instructions==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">'''See [[</del>The <del style="color: red; font-weight: bold; text-decoration: none;">Easiest Tunnel Ever]]</del>.<del style="color: red; font-weight: bold; text-decoration: none;">'''&lt;br&gt;</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">The <ins style="color: red; font-weight: bold; text-decoration: none;">Wireguard installation/downloads page has software and instructions per OS</ins>.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">For the latest updated information and additional scripts see the [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322206 Wireguard setup guide]<del style="color: red; font-weight: bold; text-decoration: none;">. This includes</del>:</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>For the latest updated information and additional scripts see the [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322206 Wireguard setup guide]:</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Setup DDWRT router as a Wireguard server</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>*Setup DDWRT router as a Wireguard server</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Client devices setup</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>*Client devices setup</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Setup DDWRT router as a Wireguard client</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>*Setup DDWRT router as a Wireguard client</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Policy Based Routing for Wireguard</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>*Policy Based Routing for Wireguard</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Wireguard PBR Kill Script</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>*Wireguard PBR Kill Script</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*Info regarding changes <del style="color: red; font-weight: bold; text-decoration: none;">stemming from </del>CVE-2019-14899 ([https://svn.dd-wrt.com/ticket/6928 ticket 6928])</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>*Info regarding changes <ins style="color: red; font-weight: bold; text-decoration: none;">for </ins>CVE-2019-14899 ([https://svn.dd-wrt.com/ticket/6928 ticket 6928])</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">====Persistent Keep Alive====</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">'''Create the Wireguard tunnel:'''&lt;br&gt;</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">This is seconds between keep alive messages, and is optional</del>. <del style="color: red; font-weight: bold; text-decoration: none;">Default is 0 </del>(<del style="color: red; font-weight: bold; text-decoration: none;">Disabled</del>). <del style="color: red; font-weight: bold; text-decoration: none;">The recommended value for NAT'd devices </del>is <del style="color: red; font-weight: bold; text-decoration: none;">25 seconds</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">DD-WRT ''Basic'' -&gt; ''Tunnels'' tab: enable the ''Tunnel'' then select ''WireGuard'' for ''Protocol Type''</ins>.</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*''Generate Key'' and enter the oet1 interface IP </ins>(<ins style="color: red; font-weight: bold; text-decoration: none;">must be a separate network outside the local LAN range</ins>)</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*E</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">g. if the router LAN IP </ins>is <ins style="color: red; font-weight: bold; text-decoration: none;">192.168.2.1, for the oet1 IP address use 10.10.0.1</ins>.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">====Allowed IPs====</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">'''Add Peers:'''&lt;br&gt;</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">This is required and represents </del>IP <del style="color: red; font-weight: bold; text-decoration: none;">addresses that this peer is allowed to use inside </del>the <del style="color: red; font-weight: bold; text-decoration: none;">tunnel</del>. <del style="color: red; font-weight: bold; text-decoration: none;">Usually the peer's tunnel IP addresses </del>and <del style="color: red; font-weight: bold; text-decoration: none;">the networks the peer routes through tunnel</del>. <del style="color: red; font-weight: bold; text-decoration: none;">Outgoing packets </del>will be <del style="color: red; font-weight: bold; text-decoration: none;">sent to </del>the <del style="color: red; font-weight: bold; text-decoration: none;">peer whose </del>''<del style="color: red; font-weight: bold; text-decoration: none;">Allowed IP</del>''<del style="color: red; font-weight: bold; text-decoration: none;">'s contain the destination address, and for multiple matches, the longest matching prefix is chosen. Incoming packets are only accepted if traffic </del>to <del style="color: red; font-weight: bold; text-decoration: none;">their source IP would be sent to the same peer. May be specified multiple times</del>.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">For simple configurations, just enter Peer Tunnel </ins>IP <ins style="color: red; font-weight: bold; text-decoration: none;">within </ins>the <ins style="color: red; font-weight: bold; text-decoration: none;">oet1 interface ip range (e.g. 10</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">10.0.2) </ins>and <ins style="color: red; font-weight: bold; text-decoration: none;">Peer Tunnel DNS (8</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">8.8.8). Peer Tunnel MTU </ins>will be <ins style="color: red; font-weight: bold; text-decoration: none;">calculated automatically (WAN mtu-40) but can then be edited. Click ''Save'' then </ins>the ''<ins style="color: red; font-weight: bold; text-decoration: none;">QR-Code</ins>'' <ins style="color: red; font-weight: bold; text-decoration: none;">button </ins>to <ins style="color: red; font-weight: bold; text-decoration: none;">generate it</ins>.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">====<del style="color: red; font-weight: bold; text-decoration: none;">Preshared Key</del>====</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">'''Masquerade the tunnel:'''&lt;br&gt;</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Wireguard cannot bridge, so must use Forwarding and NAT. Go to ''Networking'', unbridge the oet1 interface, and enable Masquerade / NAT to have internet on other side of the tunnel. Click ''Apply''.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">====<ins style="color: red; font-weight: bold; text-decoration: none;">Note for Access Point mode</ins>====</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Add the following firewall rule under Administration/Commands and save as firewall then reboot:</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">&lt;pre&gt;iptables -t nat -I POSTROUTING -o br0 -j SNAT --to $(nvram get lan_ipaddr)&lt;/pre&gt;</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">====Android/iOS config import====</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Android: [https://play.google.com/store/apps/details?id=com.wireguard.android Google Play Store], iOS: [https://itunes.apple.com/us/app/wireguard/id1441195209 Apple Store (12.0 or later)]</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">WireGuard app: press &quot;+&quot; in the lower right corner, select &quot;Create from QR code&quot;, and scan from DD-WRT peer.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">After the config file transfers, the app will prompt to name the tunnel. Public IP can be checked [http://whatismyip.akamai.com/advanced here].</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">====Linux config import====</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">systemd-networkd 237, networkmanager 1.16, and connman (git since 18 Jan 2020) support Wireguard and preshared key</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* Graphical QR Code decoder e.g. [https://launchpad.net/qr-tools '''qtqr'''] </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* Screenshot tool e.g. [https://flameshot.js.org/#/ '''flameshot''']</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Review the Wireguard [https://www.wireguard.com/install/ install] page, Linux distribution wiki (e.g. for [https://wiki.archlinux.org/index.php/WireGuard Arch]) and/or forums for more specific details.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Go to ''Tunnels'' to generate then capture and save a QR Code screenshot </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Open the QR Code decoder and add the png file to decode</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*You will be prompted with a decoded textual config file</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Use it to populate wireguard client config in the network manager</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">====Windows config import====</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Windows Wireguard client: [https://www.wireguard.com/install/ Windows .msi installer]&lt;br&gt;</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Graphical QRCode decoder e.g. [https://www.codetwo.com/freeware/qr-code-desktop-reader/ CodeTwo QR Code Reader]</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">====Options====</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">'''Persistent Keep Alive:''' This is seconds between keep alive messages, and is optional. Default is 0 (Disabled). The recommended value for NAT'd devices is 25 seconds.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">'''Allowed IPs:''' This is required and represents IP addresses that this peer is allowed to use inside the tunnel. Usually the peer's tunnel IP addresses and the networks the peer routes through tunnel. Outgoing packets will be sent to the peer whose ''Allowed IP''s contain the destination address, and for multiple matches, the longest matching prefix is chosen. Incoming packets are only accepted if traffic to their source IP would be sent to the same peer. May be specified multiple times.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">'''Preshared Key:'''</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">A base64 preshared key generated by wg genpsk. This is optional and may be omitted. This adds an additional layer of symmetric-key cryptography into the existing public-key cryptography, for post-quantum resistance.</td><td> </td><td style="background: #eee; font-size: smaller;">A base64 preshared key generated by wg genpsk. This is optional and may be omitted. This adds an additional layer of symmetric-key cryptography into the existing public-key cryptography, for post-quantum resistance.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 77:</strong></td> <td colspan="2" align="left"><strong>Line 123:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Dynamic WAN IP on router====</td><td> </td><td style="background: #eee; font-size: smaller;">====Dynamic WAN IP on router====</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">After importing configs from <del style="color: red; font-weight: bold; text-decoration: none;">ddwrt </del>to Android/iOS app <del style="color: red; font-weight: bold; text-decoration: none;">you can </del>edit <del style="color: red; font-weight: bold; text-decoration: none;">peer </del>section <del style="color: red; font-weight: bold; text-decoration: none;">(tap on pencil in upper right corner) - Endpoint</del>. <del style="color: red; font-weight: bold; text-decoration: none;">Enter something like this Endpoint = </del>my.ddns.address.com:51820<del style="color: red; font-weight: bold; text-decoration: none;">. This way you will be able to access your router even after reboot and changing IP.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">After importing configs from <ins style="color: red; font-weight: bold; text-decoration: none;">DD-WRT </ins>to Android/iOS app<ins style="color: red; font-weight: bold; text-decoration: none;">, </ins>edit <ins style="color: red; font-weight: bold; text-decoration: none;">the ''Endpoint'' in the ''Peer'' </ins>section <ins style="color: red; font-weight: bold; text-decoration: none;">e</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">g.:</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*</ins>my.ddns.address.com:51820</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Adding a second peer breaks the first====</td><td> </td><td style="background: #eee; font-size: smaller;">====Adding a second peer breaks the first====</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">You cannot use allowed </del>IPs of 0.0.0.0/0 for both peers<del style="color: red; font-weight: bold; text-decoration: none;">, </del>as it causes a collision. <del style="color: red; font-weight: bold; text-decoration: none;">What works are setting of </del>e.g. 10.10.0.2/32 and 10.10.0.3/32. The Allowed IP's feature is for crypto routing. The key is valid for the entire allowed IP space.</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Allowed </ins>IPs of 0.0.0.0/0 <ins style="color: red; font-weight: bold; text-decoration: none;">cannot be used </ins>for both peers as it causes a collision. <ins style="color: red; font-weight: bold; text-decoration: none;">Instead set separate peer IPs </ins>e.g. 10.10.0.2/32 and 10.10.0.3/32. The Allowed IP's feature is for crypto routing. The key is valid for the entire allowed IP space.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">====Resolving local hostnames <del style="color: red; font-weight: bold; text-decoration: none;">across wg </del>tunnel <del style="color: red; font-weight: bold; text-decoration: none;">with dnsmasq</del>====</td><td>+</td><td style="background: #cfc; font-size: smaller;">====Resolving local hostnames <ins style="color: red; font-weight: bold; text-decoration: none;">in the </ins>tunnel====</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">First of all you need to </del>enable &quot;Local DNS&quot; and disable &quot;No DNS Rebind&quot; <del style="color: red; font-weight: bold; text-decoration: none;">options on DNSMasq section of Services.asp site.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">DD-WRT GUI ''Services'' -&gt; DNSMasq section: </ins>enable &quot;Local DNS&quot; and disable &quot;No DNS Rebind&quot;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Then, on eop-tunnel.asp site for Peer Tunnel DNS field enter your router/local DNS ip (e.g. 192.168.1.1). Repeat it for every peer. Since Wireguard cannot be bridged, the wireguard interface or local IP of the interface needs specified in dnsmasq as additional binding interface / listener (interface=oet1). There is also a nvram var &quot;dnsmasq_addif&quot; which allows you to specify custom additional interfaces (nvram set dnsmasq_addif=oet1). But, the easiest way is to simply add a dhcp interface at networking.asp (bottom of the page). Since the client is not requesting any IP nothing special will happen. DHCP is present and reachable, but unused.</td><td> </td><td style="background: #eee; font-size: smaller;">Then, on eop-tunnel.asp site for Peer Tunnel DNS field enter your router/local DNS ip (e.g. 192.168.1.1). Repeat it for every peer. Since Wireguard cannot be bridged, the wireguard interface or local IP of the interface needs specified in dnsmasq as additional binding interface / listener (interface=oet1). There is also a nvram var &quot;dnsmasq_addif&quot; which allows you to specify custom additional interfaces (nvram set dnsmasq_addif=oet1). But, the easiest way is to simply add a dhcp interface at networking.asp (bottom of the page). Since the client is not requesting any IP nothing special will happen. DHCP is present and reachable, but unused.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Reference==</td><td> </td><td style="background: #eee; font-size: smaller;">==Reference==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[https://git.zx2c4.com/WireGuard/ Git Repository]&lt;br&gt;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">DD-WRT source: [https://svn.dd-wrt.com/log/src/router/wireguard Wireguard changesets]&lt;br&gt;</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">DD-WRT forum: [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=312522 Wireguard]&lt;br&gt;</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[https://git.zx2c4.com/WireGuard/ <ins style="color: red; font-weight: bold; text-decoration: none;">Wireguard </ins>Git Repository]&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[https://lists.zx2c4.com/mailman/listinfo/wireguard/ WireGuard Mailing Lists]&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">[https://lists.zx2c4.com/mailman/listinfo/wireguard/ WireGuard Mailing Lists]&lt;br&gt;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[https://svn.dd-wrt.com/log/src/router/wireguard DD-WRT Source Wireguard changesets]&lt;br&gt;</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">[https://github.com/wuruxu/wireguard-ddwrt Wireguard DD-WRT setup (<ins style="color: red; font-weight: bold; text-decoration: none;">by wuruxu on </ins>Github)]&lt;br&gt;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[https://github.com/wuruxu/wireguard-ddwrt Wireguard DD-WRT setup (Github)<del style="color: red; font-weight: bold; text-decoration: none;">]&lt;br&gt;</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Forum: [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=312522 Wireguard</del>]&lt;br&gt;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Category:Tunneling]]</td><td>+</td><td style="background: #cfc; font-size: smaller;">[[Category:Tunneling<ins style="color: red; font-weight: bold; text-decoration: none;">]][[Category:Basic tutorials</ins>]]</td></tr> </table> Mon, 20 Jan 2020 18:12:02 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:Wireguard Jeremywh7: organize better http://wiki.dd-wrt.com/wiki/index.php?title=Wireguard&diff=55349&oldid=prev <p>organize better</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 19:33, 17 January 2020</td> </tr> <tr><td colspan="2" align="left"><strong>Line 16:</strong></td> <td colspan="2" align="left"><strong>Line 16:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==How it works==</td><td> </td><td style="background: #eee; font-size: smaller;">==How it works==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[https://www.wireguard.com/quickstart/ Quick Start <del style="color: red; font-weight: bold; text-decoration: none;">(from the developer site)</del>]&lt;br&gt;</td><td>+</td><td style="background: #cfc; font-size: smaller;">[https://www.wireguard.com/quickstart/ Quick Start]&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/#conceptual-overview Conceptual Overview]&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">[https://www.wireguard.com/#conceptual-overview Conceptual Overview]&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 22:</strong></td> <td colspan="2" align="left"><strong>Line 22:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">'''See [[The Easiest Tunnel Ever]].'''&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">'''See [[The Easiest Tunnel Ever]].'''&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">For the latest updated information and additional scripts see the [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322206 Wireguard setup guide]. This includes:</td><td> </td><td style="background: #eee; font-size: smaller;">For the latest updated information and additional scripts see the [https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=322206 Wireguard setup guide]. This includes:</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*<del style="color: red; font-weight: bold; text-decoration: none;">Scripts for </del>setup DDWRT router as a Wireguard client</td><td>+</td><td style="background: #cfc; font-size: smaller;">*<ins style="color: red; font-weight: bold; text-decoration: none;">Setup DDWRT router as a Wireguard server</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Client devices </ins>setup</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Setup </ins>DDWRT router as a Wireguard client</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Policy Based Routing for Wireguard</td><td> </td><td style="background: #eee; font-size: smaller;">*Policy Based Routing for Wireguard</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Wireguard PBR Kill Script</td><td> </td><td style="background: #eee; font-size: smaller;">*Wireguard PBR Kill Script</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*Info regarding changes stemming from CVE-2019-14899 ([https://svn.dd-wrt.com/ticket/6928 ticket 6928])</td><td> </td><td style="background: #eee; font-size: smaller;">*Info regarding changes stemming from CVE-2019-14899 ([https://svn.dd-wrt.com/ticket/6928 ticket 6928])</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">SVN tickets:</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">====Persistent Keep Alive====</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*[http://svn</del>.<del style="color: red; font-weight: bold; text-decoration: none;">dd-wrt</del>.<del style="color: red; font-weight: bold; text-decoration: none;">com/ticket/6218 add option to set auto routes </del>for <del style="color: red; font-weight: bold; text-decoration: none;">oet*_aip0]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">This is seconds between keep alive messages, and is optional</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">Default is 0 (Disabled)</ins>. <ins style="color: red; font-weight: bold; text-decoration: none;">The recommended value </ins>for <ins style="color: red; font-weight: bold; text-decoration: none;">NAT'd devices is 25 seconds</ins>.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">*[http://svn.dd-wrt</del>.<del style="color: red; font-weight: bold; text-decoration: none;">com//ticket/6217#comment:1 add option to set a DNS in gui]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==Useful console commands==</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">====Allowed IPs====</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">This is required and represents IP addresses that this peer is allowed to use inside the tunnel. Usually the peer's tunnel IP addresses and the networks the peer routes through tunnel. Outgoing packets will be sent to the peer whose ''Allowed IP'''s contain the destination address, and for multiple matches, the longest matching prefix is chosen. Incoming packets are only accepted if traffic to their source IP would be sent to the same peer. May be specified multiple times.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">====Preshared Key====</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">A base64 preshared key generated by wg genpsk. This is optional and may be omitted. This adds an additional layer of symmetric-key cryptography into the existing public-key cryptography, for post-quantum resistance.</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">==Troubleshooting==</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">If you find any bugs report to: team@wireguard.com</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Start with rebooting all Peers</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*Enable syslogd at Services/Services/Sytem Log</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*In the script enable DEBUG by uncommenting the line:</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> #DEBUG= # uncomment/comment to enable/disable debug mode</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">==</ins>==Useful <ins style="color: red; font-weight: bold; text-decoration: none;">[[Telnet/SSH_and_the_command_line#The_DD-WRT_Command_Line|</ins>console commands<ins style="color: red; font-weight: bold; text-decoration: none;">]]==</ins>==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Check the tunnel status:</td><td> </td><td style="background: #eee; font-size: smaller;">Check the tunnel status:</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"> # wg</td><td> </td><td style="background: #eee; font-size: smaller;"> # wg</td></tr> <tr><td colspan="2" align="left"><strong>Line 53:</strong></td> <td colspan="2" align="left"><strong>Line 67:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"> 71 14687 SNAT 0 -- * ppp0 192.168.2.0/24 0.0.0.0/0 to:your_router_public_ip</td><td> </td><td style="background: #eee; font-size: smaller;"> 71 14687 SNAT 0 -- * ppp0 192.168.2.0/24 0.0.0.0/0 to:your_router_public_ip</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"> 38 2381 SNAT 0 -- * ppp0 10.0.0.0/24 0.0.0.0/0 to:your_router_public_ip</td><td> </td><td style="background: #eee; font-size: smaller;"> 38 2381 SNAT 0 -- * ppp0 10.0.0.0/24 0.0.0.0/0 to:your_router_public_ip</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"> wg showconf oet1</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"> ip addr </td><td> </td><td style="background: #eee; font-size: smaller;"> ip addr </td></tr> <tr><td colspan="2" align="left"><strong>Line 58:</strong></td> <td colspan="2" align="left"><strong>Line 74:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"> ip route show</td><td> </td><td style="background: #eee; font-size: smaller;"> ip route show</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del>ifconfig</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*More: ''</ins>ifconfig<ins style="color: red; font-weight: bold; text-decoration: none;">'', ''traceroute'', and ''ping''</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> traceroute</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">====Dynamic WAN IP on router<ins style="color: red; font-weight: bold; text-decoration: none;">==</ins>==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> ping</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">=<del style="color: red; font-weight: bold; text-decoration: none;">Troubleshooting</del>=</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">If you find any bugs report to: team@wireguard.com</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==Dynamic WAN IP on router==</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">After importing configs from ddwrt to Android/iOS app you can edit peer section (tap on pencil in upper right corner) - Endpoint. Enter something like this Endpoint = my.ddns.address.com:51820. This way you will be able to access your router even after reboot and changing IP.</td><td> </td><td style="background: #eee; font-size: smaller;">After importing configs from ddwrt to Android/iOS app you can edit peer section (tap on pencil in upper right corner) - Endpoint. Enter something like this Endpoint = my.ddns.address.com:51820. This way you will be able to access your router even after reboot and changing IP.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==Adding a second peer breaks the first==</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">==</ins>==Adding a second peer breaks the first<ins style="color: red; font-weight: bold; text-decoration: none;">==</ins>==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">You cannot use allowed IPs of 0.0.0.0/0 for both peers, as it causes a collision. What works are setting of e.g. 10.10.0.2/32 and 10.10.0.3/32. The Allowed IP's feature is for crypto routing. The key is valid for the entire allowed IP space.</td><td> </td><td style="background: #eee; font-size: smaller;">You cannot use allowed IPs of 0.0.0.0/0 for both peers, as it causes a collision. What works are setting of e.g. 10.10.0.2/32 and 10.10.0.3/32. The Allowed IP's feature is for crypto routing. The key is valid for the entire allowed IP space.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==Resolving local hostnames across wg tunnel with dnsmasq==</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">==</ins>==Resolving local hostnames across wg tunnel with dnsmasq<ins style="color: red; font-weight: bold; text-decoration: none;">==</ins>==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">First of all you need to enable &quot;Local DNS&quot; and disable &quot;No DNS Rebind&quot; options on DNSMasq section of Services.asp site.</td><td> </td><td style="background: #eee; font-size: smaller;">First of all you need to enable &quot;Local DNS&quot; and disable &quot;No DNS Rebind&quot; options on DNSMasq section of Services.asp site.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Then, on eop-tunnel.asp site for Peer Tunnel DNS field enter your router/local DNS ip (e.g. 192.168.1.1). Repeat it for every peer. Since Wireguard cannot be bridged, the wireguard interface or local IP of the interface needs specified in dnsmasq as additional binding interface / listener (interface=oet1). There is also a nvram var &quot;dnsmasq_addif&quot; which allows you to specify custom additional interfaces (nvram set dnsmasq_addif=oet1). But, the easiest way is to simply add a dhcp interface at networking.asp (bottom of the page). Since the client is not requesting any IP nothing special will happen. DHCP is present and reachable, but unused.</td><td> </td><td style="background: #eee; font-size: smaller;">Then, on eop-tunnel.asp site for Peer Tunnel DNS field enter your router/local DNS ip (e.g. 192.168.1.1). Repeat it for every peer. Since Wireguard cannot be bridged, the wireguard interface or local IP of the interface needs specified in dnsmasq as additional binding interface / listener (interface=oet1). There is also a nvram var &quot;dnsmasq_addif&quot; which allows you to specify custom additional interfaces (nvram set dnsmasq_addif=oet1). But, the easiest way is to simply add a dhcp interface at networking.asp (bottom of the page). Since the client is not requesting any IP nothing special will happen. DHCP is present and reachable, but unused.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==<del style="color: red; font-weight: bold; text-decoration: none;">Persistent Keep Alive</del>=<del style="color: red; font-weight: bold; text-decoration: none;">=</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">==<ins style="color: red; font-weight: bold; text-decoration: none;">Reference</ins>==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">This is optional, it's seconds between keep alive messages. Default is 0 (Disabled). Recommended value for NATed devices is 25.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">==Allowed IPs==</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">This is required. Represent IP addresses that this peer is allowed to use inside the tunnel. Usually the peer's tunnel IP addresses and the networks the peer routes through tunnel. Outgoing packets will be sent to the peer whose AllowedIPs contain the destination address (If there are multiple matches, the one with the longest matching prefix is chosen). Incoming packets are only accepted if traffic to their source IP would be sent to the same peer. May be specified multiple times.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">==Preshared Key== </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">A base64 preshared key generated by wg genpsk. Optional, and may be omitted. This option adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance.</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">=Reference</del>=</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[https://git.zx2c4.com/WireGuard/ Git Repository]&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">[https://git.zx2c4.com/WireGuard/ Git Repository]&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">[https://lists.zx2c4.com/mailman/listinfo/wireguard/ WireGuard Mailing Lists]&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">[https://lists.zx2c4.com/mailman/listinfo/wireguard/ WireGuard Mailing Lists]&lt;br&gt;</td></tr> </table> Fri, 17 Jan 2020 19:33:54 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:Wireguard