Thanks to previous jobs, I’ve had an OpenVPN server running at my house for the past decade. It gives me access to my home network while I’m out in the world, and allows me to securely proxy my web traffic over insecure WiFi so it bounces to the Internet from my house. It’s fast enough, but there’s that yearly churn of generating new certificates for all my devices and the occasional server cert maintenance. Kind of a hassle.
I’ve recently become aware of WireGuard, another VPN protocol, that offers some apparent advantages over OpenVPN like multi-threading (it doesn’t use openssl which is famously single-threaded), simpler config files, and no need to regenerate openssl certificates when they expire. The cryptography is faster. Many of the commercial/free VPN services also use WireGuard under the hood. It’s functionally serverless, but can be configured to run as one.
I tried walking through the WireGuard Quick Start Guide and, my friends, this page quickly confused me. It’s half whitepaper, half video demo of how to set up a tunnel. Who puts up a GIF of a screenshare where all of the useful text commands you’d need to create your own tunnel are not copy-pasteable? A cruel bastard, that’s who.
Thankfully there’s a library of sites that are more helpful than the tool vendor. Thanks to Elliot Cooper for his article on Bash-Prompt. This page helped me figure it out.
What confused me was the distinction between the wg command line app and wg-quick, the other command line app. wg does the heavy lifting in the kernel, but its commands and configs are fed in on the command line, not a config file. I was trying to feed the config file to wg and failing because it doesn’t understand it. Annoying. wg-quick takes a config file and uses the options there to tell wg what to do. It also handles creating virtual interfaces, adding routes, and controlling some firewall rules. Stuff you’d expect the main binary to handle, not a packaged script.
Equally confusing is that wg doesn’t provide its own systemd server daemon. No, that’d be too sensible. For that, you have to use, once again, wg-quick, which does provide a daemon service. But you’d have to install and enable the service. Whack.
Anyway, now that I’ve learned how to run the server and hammer out configs for each client, my fleet of devices can now use WireGuard. I don’t notice any speed improvements, because my home’s cable modem uplink is still limited, but I feel like my devices are burning less battery. That’s a plus.
I’ll continue running both VPN servers until I get bored of one of them. It’s nice to have options.