{"id":2315,"date":"2020-08-01T13:49:25","date_gmt":"2020-08-01T12:49:25","guid":{"rendered":"https:\/\/denbeke.be\/blog\/?p=2315"},"modified":"2021-04-12T10:01:22","modified_gmt":"2021-04-12T09:01:22","slug":"configuring-wireguard-vpn-with-wg-access-server","status":"publish","type":"post","link":"https:\/\/denbeke.be\/blog\/software\/configuring-wireguard-vpn-with-wg-access-server\/","title":{"rendered":"Configuring Wireguard VPN with wg-access-server"},"content":{"rendered":"\n

For years I have used IPSec and OpenVPN, but they are not always the easiest to setup. Recently I discovered how simple VPN config can be with Wireguard. If you follow this guide, you can have a VPN up and running in less than 10 minutes (given that you know Docker).<\/p>\n\n\n\n

Introduction<\/h3>\n\n\n\n

Wireguard<\/h4>\n\n\n\n

If you\u2019re reading this, you problably already know that Wireguard<\/a> is an open source, modern VPN that aims to be performant and easy to configure.<\/p>\n\n\n\n

Read more on their website<\/a> about it if you don\u2019t believe me \ud83d\ude09<\/p>\n\n\n\n

WireGuard\u00ae is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography<\/a><\/strong>. It aims to be faster<\/a>, simpler<\/a>, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform (Windows, macOS, BSD, iOS, Android) and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.<\/p><\/blockquote>\n\n\n\n

wg-access-server<\/h4>\n\n\n\n

Even though Wireguard is not hard to setup, there is something that makes the setup even simpler:<\/p>\n\n\n\n

wg-access-server<\/a> is an open source project that combines Wireguard with an admin interface in one easy to install binary:<\/p>\n\n\n\n

wg-access-server is a single binary that provides a WireGuard VPN server and device management web ui. We support user authentication, 1 click<\/em> device registration that works with Mac, Linux, Windows, Ios and Android including QR codes. You can configure different network isolation modes for better control and more.<\/p>

This project aims to deliver a simple VPN solution for developers, homelab enthusiasts and anyone else feeling adventurous.<\/p><\/blockquote>\n\n\n\n

The admin interface looks like this:<\/p>\n\n\n\n

\"wg-access-server
wg-access-server admin interface<\/figcaption><\/figure>\n\n\n\n

Running wg-access-server with Docker<\/h3>\n\n\n\n

The easiest way to run wg-access-server is by using Docker and docker-compose. If you are new to Docker<\/a> and docker-compose<\/a>, you might want to read some tutorials about it first.<\/p>\n\n\n\n

I use the following docker-compose.yml<\/code> config file for wg-access-server:<\/p>\n\n\n\n

version: \"3.4\"\nservices: \n  wireguard:\n    container_name: wireguard\n    image: place1\/wg-access-server\n    cap_add:\n      - NET_ADMIN\n    environment:\n      WG_WIREGUARD_PRIVATE_KEY: {put your private key here}\n      WG_STORAGE: sqlite3:\/\/\/wireguard-clients\/db.sqlite3\n      WG_EXTERNAL_HOST: my-host.com\n      WG_CONFIG: \"\/config.yaml\"\n      WG_ADMIN_USERNAME: {put your admin username here}\n      WG_ADMIN_PASSWORD: {put your plain text admin password here}\n    volumes:\n      - .\/data\/wg-access-server:\/data\"\n      - .\/data\/wireguard-clients:\/wireguard-clients\n      - .\/conf\/wireguard\/config.yaml:\/config.yaml:ro # if you have a custom config file\n    ports:\n      - \"8000:8000\/tcp\"\n      - \"51820:51820\/udp\"\n    devices:\n      - \"\/dev\/net\/tun:\/dev\/net\/tun\"\n    restart: unless-stopped<\/code><\/pre>\n\n\n\n
\u26a0\ufe0f Note that if you don\u2019t want to use a plaintext admin password, you have to specify it in the config file.<\/em> It\u2019s probably better than my plaintext config, but I don\u2019t expose the admin interface anywhere, so I don\u2019t really care.<\/em><\/p>\n\n\n\n
\u2139\ufe0f You can generate the WireGuard private key with Docker: docker\u00a0run\u00a0-it\u00a0place1\/wg-access-server\u00a0wg\u00a0genkey<\/code><\/p>\n\n\n\n
In .\/conf\/wireguard\/config.yaml<\/code> I specified the external host. By doing so, the generated client profiles contain the correct url. That way they can be used right away:<\/p>\n\n\n\n
loglevel: info\nwireguard:\n  externalHost: \"my-external-domain.com\"<\/code><\/pre>\n\n\n\n
\u2139\ufe0f Don\u2019t forget to open UDP port 51820<\/code> on your firewall.
\u2139\ufe0f If you want to expose the admin interface, you also have to open TCP port 8000<\/code> on your firewall (But in that case you better proxy it through an HTTPS web server like Treafik<\/a> or Caddy<\/a>).<\/p>\n\n\n\n
Once everything is configured you can use the known docker commands to start the service:<\/p>\n\n\n\n
sudo docker-compose up -d<\/code><\/pre>\n\n\n\n
Client device configuration for wg-access-server with WireGuard apps<\/h3>\n\n\n\n
Next step is to configure the client devices. Wireguard has apps for iOS, macOS, Android, Windows, any Linux flavour, \u2026 Check out the most up-to-date list on their website<\/a>.<\/p>\n\n\n\n
Adding a new client configuration is very easy. Navigate to your wg-access-server admin interface (e.g. local-ip-of-adguard-host:8000<\/code>. Then you just specify the name of the device and click on Add<\/em>.<\/p>\n\n\n\n
Once it is created, the client configuration will be displayed in the admin interface. 
\u26a0\ufe0f Note that you can only see this configuration once, afterwards it will be permanently deleted.<\/em><\/p>\n\n\n\n
\"wg-access-server
wg-access-server new client creation<\/figcaption><\/figure><\/div>\n\n\n\n
If you are configuring for a mobile device, you can scan the QR code with the Wireguard app for the most simple configuration.<\/p>\n\n\n\n
\"wg-access-server
wg-access-server client configuration with QR code<\/figcaption><\/figure><\/div>\n\n\n\n
On your iPhone:<\/p>\n\n\n\n
\"wg-access-server
Wireguard app on iOS<\/figcaption><\/figure><\/div>\n\n\n\n
You can also just download the profile (for e.g. desktop clients):<\/p>\n\n\n\n
\"wg-access-server
wg-access-server client configuration with config file (for macOS)<\/figcaption><\/figure>\n\n\n\n
Voila, your VPN is all setup!<\/p>\n\n\n\n
Conclusion<\/h3>\n\n\n\n
Setting up your personal VPN with Wireguard, wg-access-server and Docker is stupidly simple.<\/p>\n","protected":false},"excerpt":{"rendered":"
For years I have used IPSec and OpenVPN, but they are not always the easiest to setup. Recently I discovered how simple VPN config can be with Wireguard. If you follow this guide, you can have a VPN up and running in less than 10 minutes (given that you know Docker). Introduction Wireguard If you\u2019re […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[161],"tags":[286,129,140,125,287,151,186,196,285],"yoast_head":"\nConfiguring Wireguard VPN with wg-access-server – DenBeke<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/denbeke.be\/blog\/software\/configuring-wireguard-vpn-with-wg-access-server\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Configuring Wireguard VPN with wg-access-server – DenBeke\" \/>\n<meta property=\"og:description\" content=\"For years I have used IPSec and OpenVPN, but they are not always the easiest to setup. Recently I discovered how simple VPN config can be with Wireguard. If you follow this guide, you can have a VPN up and running in less than 10 minutes (given that you know Docker). Introduction Wireguard If you\u2019re […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/denbeke.be\/blog\/software\/configuring-wireguard-vpn-with-wg-access-server\/\" \/>\n<meta property=\"og:site_name\" content=\"DenBeke\" \/>\n<meta property=\"article:published_time\" content=\"2020-08-01T12:49:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-04-12T09:01:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/denbeke.be\/blog\/wp-content\/uploads\/2020\/08\/Wireguard-wg-access-server-admin-interface.png\" \/>\n<meta name=\"twitter:card\" content=\"summary\" \/>\n<meta name=\"twitter:creator\" content=\"@MthsBk\" \/>\n<meta name=\"twitter:site\" content=\"@MthsBk\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\">\n\t<meta name=\"twitter:data1\" content=\"5 minutes\">\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/denbeke.be\/blog\/#website\",\"url\":\"https:\/\/denbeke.be\/blog\/\",\"name\":\"DenBeke\",\"description\":\"Mathias Beke\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":\"https:\/\/denbeke.be\/blog\/?s={search_term_string}\",\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/denbeke.be\/blog\/software\/configuring-wireguard-vpn-with-wg-access-server\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/denbeke.be\/blog\/wp-content\/uploads\/2020\/08\/Wireguard-wg-access-server-admin-interface.png\",\"width\":2560,\"height\":1598},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/denbeke.be\/blog\/software\/configuring-wireguard-vpn-with-wg-access-server\/#webpage\",\"url\":\"https:\/\/denbeke.be\/blog\/software\/configuring-wireguard-vpn-with-wg-access-server\/\",\"name\":\"Configuring Wireguard VPN with wg-access-server – DenBeke\",\"isPartOf\":{\"@id\":\"https:\/\/denbeke.be\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/denbeke.be\/blog\/software\/configuring-wireguard-vpn-with-wg-access-server\/#primaryimage\"},\"datePublished\":\"2020-08-01T12:49:25+00:00\",\"dateModified\":\"2021-04-12T09:01:22+00:00\",\"author\":{\"@id\":\"https:\/\/denbeke.be\/blog\/#\/schema\/person\/386878f712fe3fe22227216f087772dc\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/denbeke.be\/blog\/software\/configuring-wireguard-vpn-with-wg-access-server\/\"]}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/denbeke.be\/blog\/#\/schema\/person\/386878f712fe3fe22227216f087772dc\",\"name\":\"Mathias Beke\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/denbeke.be\/blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/015ba35e6ce4f5859e3888ca99807575?s=96&d=mm&r=g\",\"caption\":\"Mathias Beke\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","_links":{"self":[{"href":"https:\/\/denbeke.be\/blog\/wp-json\/wp\/v2\/posts\/2315"}],"collection":[{"href":"https:\/\/denbeke.be\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/denbeke.be\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/denbeke.be\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/denbeke.be\/blog\/wp-json\/wp\/v2\/comments?post=2315"}],"version-history":[{"count":5,"href":"https:\/\/denbeke.be\/blog\/wp-json\/wp\/v2\/posts\/2315\/revisions"}],"predecessor-version":[{"id":2352,"href":"https:\/\/denbeke.be\/blog\/wp-json\/wp\/v2\/posts\/2315\/revisions\/2352"}],"wp:attachment":[{"href":"https:\/\/denbeke.be\/blog\/wp-json\/wp\/v2\/media?parent=2315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/denbeke.be\/blog\/wp-json\/wp\/v2\/categories?post=2315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/denbeke.be\/blog\/wp-json\/wp\/v2\/tags?post=2315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}