Differences

This shows you the differences between two versions of the page.

--- wireguard [2021/02/23 07:45] – baumi
+++ wireguard [2026/08/02 10:15] (current) – baumi
@@ Line 1: / Line 1: @@
 ====== Wireguard ======
-===== Install Wireguard on Debian 9.x and Raspbian 10.x =====
-<code>
-# echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable.list
-# echo -e "Package: *\nPin: release a=unstable\nPin-Priority: 150\n" > /etc/apt/preferences.d/limit-unstable
-# apt-get update && apt-get install wireguard-dkms wireguard-tools
-# modprobe wireguard && lsmod | grep wireguard
-</code>
 ===== Create Key Pairs =====
 **Host A**
 <code>
-root@hosta# wg genkey > privateA
+root@hosta # wg genkey > privateA
-root@hosta# wg pubkey < privateA > publicA
+root@hosta # wg pubkey < privateA > publicA
 </code>
 **Host B**
 <code>
-root@hostb# wg genkey > privateB
+root@hostb # wg genkey > privateB
-root@hostb# wg pubkey < privateB > publicB
+root@hostb # wg pubkey < privateB > publicB
 </code>
-{{tag>kb linux}}
 ===== Assign Link Network to Wireguard-Tunnel =====
-Link-Network: 172.24.0.0/30
+  Link-Network: 172.24.0.0/30
-HostA: 172.24.0.1/30
+  HostA: 172.24.0.1/30
-HostB: 172.24.0.2/30
+  HostB: 172.24.0.2/30
 ===== Create Config =====
+**Assumption**
+Host A is visible to Host B
 **Host A**
 <code>
-root@hosta# cat /etc/wireguard/wg0.conf
+root@hosta # cat /etc/wireguard/wg0.conf
 # HostA - HostB
 [Interface]
@@ Line 46: / Line 39: @@
 **Host B**
 <code>
-root@hostb# cat /etc/wireguard/wg0.conf
+root@hostb # cat /etc/wireguard/wg0.conf
 # HostB - HostA
 [Interface]
@@ Line 52: / Line 45: @@
 PrivateKey = <contents of privateB>
 ListenPort = 51820
+#If something needs to happen after tunnel is up or before tunnel goes down
+#PostUp = /usr/local/sbin/wg0-PostUp.sh
+#PreDown = /usr/local/sbin/wg0-PreDown.sh
 [Peer]
 PublicKey = <contents of publicA>
+Endpoint = <visible ip of HostA>
 AllowedIPs = 172.24.0.1/32
 # Uncomment if HostB is behind NAT Router
@@ Line 62: / Line 59: @@
 ===== Start Wireguard Tunnel =====
 Issue on both hosts
-root@hosta# wg-quick up wg0
+<code>
-root@hostb# wg-quick up wg0
+root@hosta # wg-quick up wg0
+root@hostb # wg-quick up wg0
+</code>
 ===== Check Status =====
 **Host A**
 <code>
-root@hosta# wg
+root@hosta # wg
 interface: wg0
   public key: PUBLIC-KEY-A
@@ Line 83: / Line 81: @@
 **Host B**
 <code>
-root@hostb# wg
+root@hostb # wg
 interface: wg0
   public key: PUBLIC-KEY-B
@@ Line 97: / Line 95: @@
 </code>
+===== Fallback systemd service to call PreDown script =====
+<code>
+root@hostb # cat << EOF > /etc/systemd/system/wg0-shutdown-fallback.service
+[Unit]
+Description=WireGuard wg0 shutdown fallback
+DefaultDependencies=no
+Before=shutdown.target reboot.target halt.target
+Before=wg-quick@wg0.service
+Conflicts=shutdown.target reboot.target halt.target
+After=local-fs.target
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/true
+ExecStop=/usr/local/sbin/wg0-PreDown.sh
+TimeoutStopSec=30
+[Install]
+WantedBy=multi-user.target
+EOF
+root@hostb # systemctl daemon-reload
+root@hostb # systemctl enable wg0-shutdown-fallback.service
+root@hostb # systemctl start wg0-shutdown-fallback.service
+</code>
+{{tag>kb linux}}