Nerdberg Wireguard VPN with Systemd-Networkd

Template for a vpn-config useable with vpn.nerdberg.de, to be used with systemd-networkd. I'm using Arch, by the way.

Configure the VPN

Create two files, wg-nerdberg.netdev and wg-nerdberg.network in /etc/systemd/network according to the templates below. Then create a new vpn endpoint using the UI of vpn.nerdberg.de and fill in the keys and addresses for the placeholders indicated.

Template for wg-nerdberg.netdev

It's a systemd.netdev file.

This file should preferably have owner root, group systemd-network and be mode 0640 or -rw-r---- (i.e. writeable by root, readable by group, not readable by world) because it contains the wireguard private and shared key! If the file is world-readable the VPN still works, but this configuration will potentially leak your keys and systemd-networkd will complain in the journal "/etc/systemd/network/wg-nerdberg.netdev has 0644 mode that is too permissive, please adjust the ownership and access mode." on every boot.

  [NetDev]
  Name=wg-nerdberg
  Kind=wireguard
  Description=Nerdberg Tunnel Endpoint
  MTUBytes=1280
  
  [WireGuard]
  ListenPort=51902
  PrivateKey=ABC123....= # as created by vpn server
  
  [WireGuardPeer]
  PublicKey=ABC123...= # as created by vpn server
  PresharedKey=ABC123...= # as created by vpn server
  AllowedIPs=10.73.36.0/23,10.3.2.0/24
  Endpoint=vpn.nerdberg.de:51820
  PersistentKeepalive = 25

Template for wg-nerdberg.network

It's a systemd.network file.

  [Match]
  Name=wg-nerdberg
  
  [Link]
  # next line requires "networkctl up wg-nerdberg" to start the vpn
  # set ActivationPolicy=up, or comment out this line, to always start the vpn on machine boot
  ActivationPolicy=manual
  RequiredForOnline=no
  
  [Network]
  IPv6AcceptRA=false
  LinkLocalAddressing=no
  DHCP=no
  
  [Address]
  Address=10.3.2.120/32 # replace as created by vpn server
  Peer=10.3.2.1/32
  
  [Address]
  Address=fd00::3:2:b0/128 # replace as created by vpn server
  Peer=fd00::3:2:1/128
  
  # on-link
  [Route]
  Destination=10.3.2.0/24
  Gateway=10.3.2.1
  
  # LAN
  [Route]
  Destination=10.73.36.0/23
  Gateway=10.3.2.1

Verify your configuration...

Systemd Networkd

Use systemd-networkd's networkctl utility for that.

  [root@thinkcentre ~]# networkctl status wg-nerdberg
  ● 6: wg-nerdberg
                   NetDev File: /etc/systemd/network/wg-nerdberg.netdev
                     Link File: /usr/lib/systemd/network/99-default.link
                  Network File: /etc/systemd/network/wg-nerdberg.network
                         State: routable (configured)
                  Online state: online                                         
                          Type: wireguard
                          Kind: wireguard
                        Driver: wireguard
                           MTU: 1280 (max: 2147483552)
                         QDisc: noqueue
  IPv6 Address Generation Mode: none
      Number of Queues (Tx/Rx): 1/1
                       Address: 10.3.2.120
                                fd00::3:2:b0
             Activation Policy: manual
           Required For Online: no
  
  Aug 16 14:31:06 thinkcentre systemd-networkd[372]: wg-nerdberg: netdev ready
  Aug 16 14:31:06 thinkcentre systemd-networkd[372]: wg-nerdberg: Configuring with /etc/systemd/network/wg-nerdberg.network.
  Aug 16 14:31:06 thinkcentre systemd-networkd[372]: wg-nerdberg: Link UP
  Aug 16 14:31:06 thinkcentre systemd-networkd[372]: wg-nerdberg: Gained carrier

Wireguard Device

Use the wireguard wg utility for that.

  # wg show
  interface: wg-nerdberg
    public key: KOMmBnaj4ebyJbcLuSCjTLCoyTuV5ZON2nArENP4BGE=
    private key: (hidden)
    listening port: 51902
  
  peer: ZasbMPoNaD0OGfqm/PQgs+cO/Mhz6ePYFlSB77KyUmU=
    preshared key: (hidden)
    endpoint: 212.172.14.27:51820
    allowed ips: 10.3.2.0/24, 10.73.36.0/23
    latest handshake: 13 seconds ago
    transfer: 38.03 MiB received, 1.59 MiB sent
    persistent keepalive: every 25 seconds

Address

Use iputils' ip addr for that.

  # ip addr show dev wg-nerdberg
  6: wg-nerdberg: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1280 qdisc noqueue state UNKNOWN group default qlen 1000
      link/none 
      inet 10.3.2.120 peer 10.3.2.1/32 scope global wg-nerdberg
         valid_lft forever preferred_lft forever
      inet6 fd00::3:2:b0 peer fd00::3:2:1/128 scope global 
         valid_lft forever preferred_lft forever

Route

Use iputils' route for that.

  # ip route show dev wg-nerdberg
  10.3.2.0/24 via 10.3.2.1 proto static 
  10.3.2.1 proto kernel scope link src 10.3.2.120 
  10.73.36.0/23 via 10.3.2.1 proto static