Wireguard - Page 1
Forum section: electronics / general

author: PlainName
author_rank: Super Contributor
timestamp: May 04, 2025, 09:05:52 pm
content: We currently use Softether for VPN which is OK but gets knocked a lot unless we restrict IP blocks allowed to connect. Which kind of defeats its purpose. So, decided to have a look at Wireguard since it's all the rage currently and promises a lot. Went to the Wireguard website and the target user is clearly a Linux guru, but they do have Windows clients available, so I grabbed that.Installed the Windows client and it runs. But want to test before upsetting the route by installing it on there, and I note that the Wireguard site has a test server for just this purpose. Super, I will just connect to that... er, if I can find the details...There is nowt in plain text. There is a bash script which is indecipherable unless you are an aforementioned guru, and which is completely useless on Windows. There is no info on what should go under , no mention that there' s even a  never mind what might go under that. Plenty of long-winded command line stuff that's inappropriate.Have I missed something and there is actually a way to get this going really simply (like, just how any normal Windows app does things) or am I expected to become an expert in a foreign system and process I'm not going to use?

author: abeyer
author_rank: Frequent Contributor
timestamp: May 05, 2025, 12:52:44 am
content: A quick glance at it seems like you need to dynamically fetch the config info for the demo from a tcp stream at demo.wireguard.com:42912I dunno if modern windows ships with any tools anymore that support raw tcp... you'll likely have to install something that can. Or just stand up your own server may be easier and skip the demo server. This whole setup step is just a hack for demo purposes that lets you do the key setup on the server too... you'd neverwantto accept connections from randos on the internet if you weren't a demo server.

author: PlainName
author_rank: Super Contributor
timestamp: May 05, 2025, 07:10:28 am
content: Thanks. I will give up on that, thenQuoteIndeed. I just thought that if it were easy to just set the details (perhaps you're telling your better half over the phone how to connect her new laptop) then they would just print the stuff in an easy to read and set way. It just says to me that either it's not simple or they're obfuscating just to be awkward to non-gurus.

author: abeyer
author_rank: Frequent Contributor
timestamp: May 05, 2025, 06:56:36 pm
content: If you're interested in wireguard but not wanting to get as much into the weeds, you might consider tailscale. They're a paid service for anything but tiny personal usage, but do add a nice layer of management, ui, and extra features on top of wireguard that make it a lot more approachable.

author: PlainName
author_rank: Super Contributor
timestamp: May 05, 2025, 07:34:44 pm
content: Thanks for the pointer. I did look at Tailscale some while back but couldn't remember why I passed it up (other than the cost), so just took another look. Can't get to the download stuff without signing in with one of Apple, Google, Microsoft, etc. No, I ain't sharing any account I might have on those with anyone else, and especially not when it involves access to my network.

author: Zucca
author_rank: Unknown
timestamp: May 06, 2025, 02:11:13 am
content: +1 with Tailscale. They don't want to deal with authentications nor store any data, they are just using something else to check username and psw.If you try you will see you will be simply redirected to those others website, I mean a login in Google is 1:1 as a login in Tailscale using Google in a security point of view.

author: David Hess
author_rank: Super Contributor
timestamp: May 06, 2025, 04:50:28 am
content: Usually the setup involves downloading a configuration file and importing it into the Wireguard client. I have done it this way and it works great, much better than OpenVPN anyway.I have not had any luck copying the elements from the configuration file into a Wireguard configuration on a router yet. It should work, but has not for me.

author: Whales
author_rank: Super Contributor
timestamp: May 06, 2025, 05:16:50 am
content: QuoteThere are three ways to use wireguard:(1) Lots of small wg commands (aka pure wireguard). This is aimed at a nitty gritty network/linux admin audience that writes their own routing rules and creates their own bridge interfaces. This is what the developers of wireguard think and breathe. Almost all new users will want to run 100 miles from this and it's not made clear that this really isn't a good starting point.(2) a wg-quick config file (what most people use, simpler).The windows wireguard GUI expects this. Understanding and creating these files (on both ends of the connection) is still quite complicated and requires a good chunk of networking knowledge, but once they're made they are super-easy to use. There are guides on the web on how to make these.(3) a paid service that hosts part of the network for you and provides the wg-quick config files, so you just have to throw them at your copy of wireguard and it just works. Note: it'spossibleto do this in a way where your traffic can't be decrypted by them, even though it transits through them, but not if they're providing you the wg-quick files (which means they have all your private keys).It sounds like you stumbled upon (1). Yes this causes lots of confusion for new users, but it's still better than OpenVPNIf you are knowledgeable enough to know what a static IP and portforwarding is then (2) is an option, otherwise (3) might be more attractive for you.

author: Whales
author_rank: Super Contributor
timestamp: May 06, 2025, 05:33:32 am
content: Whilst I'm here, some differences from other VPN software that might cause you trouble if you're not aware of them:1. IP layer only. No raw ethernet frames, no DHCP, everything must have a pre-assigned static IP in the wg-quick configs. You can just give IPV4 addresses, don't worry about ipv6 if you're not used to it.2. The server and the client are treated almost equally in the config files, the only real difference is one has a "ListenPort". Otherwise it's a completely peer to peer protocol.3. Each peer (eg your server) will ONLY respond to packets if they pass all the checks. If anything is even slightly wrong then your packets will get silently ignored. You will see this in your windows GUI as lots of packets sent but 0 received --this is the ONLY way of knowing if the connection has successfully established or not.This is quite different to other VPN clients that will say "connection good" or "connection bad". Wireguard does not do that, it pretends to be a silent and passive tunnel between two points even if your config is wrong. A bad config is no different to the other endpoint not existing. This has a _lot_ of security and anti-denial-of-service advantages, but of course is a mile less convenient for users during testing & setup. You just gotta know.4. Ever peer needs to know ALL of the details of EVERY other peer it wants to talk to. This means the server MUST have a  in its config for every client.Every client does not necessarily need a  for every other client (even if you want them to be able to talk directly) because most Linux servers will route the packet themselves. For this to work you have to tell the clients that the server  has 'AllowedIps' of everyone else, otherwise the server will be forbidden from decrypting this packet. Youmightnot care about all of this -- I use it to ssh or VNC from one client to another in some setups.Wireguard is the most performant and reliable VPN software I've touched, but it absolutely requires another layer of automation to make it easy to use (like wg-quick or proprietary/paid-for stuff) and each of those is basically its own product with a different list of pros & cons. Pure wireguard is not a good place to start, people call all of the above "wireguard" as slang when really they're probably talking about one particular easier to use variant of it.

author: PlainName
author_rank: Super Contributor
timestamp: May 06, 2025, 06:48:39 am
content: Thanks very much for the info and advice.QuoteThat might be a problem. Need to think about it a bit deeper.

author: Whales
author_rank: Super Contributor
timestamp: May 06, 2025, 08:02:29 am
content: No probIf you can give some info about your use case then I might be able to give some suggestions or thoughts.Perhaps you're starting from an existing networking setup (eg 192.168.1.x/24 LAN) and want to add some remote users?It's fine for them to sit in a different address range (eg 192.168.88.x/24), both ip subnets will be behind your NAT and packets will route to each other fine. If wireguard is running on your main router then this is automatically done for you, if it's running on a different device then you just have to add a manual route to your router.Is is also possible to put your normal (DHCP'd local LAN) users and remote (wireguard) users on the same subnet. This might bring some benefits (some software assumes that the same subnet = safe, like windows firewall) but it still won't give you layer-2 messaging (eg broadcast packets). I'd normally say that software thatabsolutely requiresbroadcasts is getting rarer, but considering you're on the EEVblog forum I'd say you're probably using or supporting something a bit out of the ordinary

author: PlainName
author_rank: Super Contributor
timestamp: May 06, 2025, 10:22:37 am
content: Essentially a /23 network. Typically, fixed IP (either enforced via DHCP or set as fixed on device) are all in the 0.x range and dynamic (phones, IoT, etc) are in the 1.x range. Current VPN is Softether which forwards DHCP to incoming clients.Primary use is for a remote client that ideally wants to be on the LAN for NAS stuff. Everything like that is behind NAT and doesn't get forwarded to the internet, so the only way to access local things is, er, locally. Periodically there are various laptops and phones that are normally local but get to go on road trips and then find they've forgotten something, or want global access without going through dodgy wifi APs or spending loads on GSM.So nothing particularly complex or onerous. The current setup is fine except that it gets a lot of doorknocking so everything incoming is blocked except for the ISP range where the remote client is usually located. But now and then it's at some other place, or the ISP discovers another range, and then I have to manually set up (possibly remembering it's temporary) another filter to allow a connect. It's this part that I'd like to change, but not at the expense of making other parts trickier.

author: Whales
author_rank: Super Contributor
timestamp: May 06, 2025, 08:44:52 pm
content: Yes wireguard should help if you're worried about doorknockers & exploit finders. It will look like a normal DROP firewall port to all scan attempts (unless they have stolen legit creds somehow, but by that point it's no longer a door knock).QuoteThat should still work with the VPN users on a different subnet. Your router and/or VPN endpoint should route between the two networks, both of which are behind your NAT.Best thing to do is give it a try and see how it worksIf you're using SMB (Windows Shares) then I assume Microsoft has thrown another curveball to this in the last 5 seconds since I tried it, because they love doing that, so I can't say for certain. EDIT Yes I think there is a regkey or firewall rule you have to add to windows to allow someone outside the current subnet to access an SMB share on the current system.

author: PlainName
author_rank: Super Contributor
timestamp: May 06, 2025, 09:38:01 pm
content: Ah, I didn't know SMB could traverse nets. But... if it's new in 10/11 then it's not appropriate for us.I might have a play