Template for a vpn-config useable with vpn.nerdberg.de, to be used with systemd-networkd.
Configure the VPN
Create two files, wg-nerdberg.netdev and wg-nerdberg.network in /etc/systemd/network according to the templates below.
Template for wg-netdberg.netdev
It's a systemd.netdev file.
[NetDev] Name=wg-nerdberg Kind=wireguard Description=Nerdberg Tunnel Endpoint MTUBytes=1280 [WireGuard] ListenPort=51902 PrivateKey=ABC123....= # as created by vpn server [WireGuardPeer] PublicKey=ABC123...= # as created by vpn server PresharedKey=ABC123...= # as created by vpn server AllowedIPs=10.73.36.0/23,10.3.2.0/24 Endpoint=vpn.nerdberg.de:51820 PersistentKeepalive = 25
Template for wg-netdberg.network
It's a systemd.network file.
[Match] Name=wg-nerdberg [Link] RequiredForOnline=no [Network] IPv6AcceptRA=false LinkLocalAddressing=no DHCP=no [Address] Address=10.3.2.120/32 # replace as created by vpn server Peer=10.3.2.1/32 [Address] Address=fd00::3:2:b0/128 # replace as created by vpn server Peer=fd00::3:2:1/128 # on-link [Route] Destination=10.3.2.0/24 Gateway=10.3.2.1 # LAN [Route] Destination=10.73.36.0/23 Gateway=10.3.2.1
Verify your configuration...
Systemd Networkd
Use systemd-networkd's networkctl utility for that.
[root@thinkcentre ~]# networkctl status wg-nerdberg
● 6: wg-nerdberg
NetDev File: /etc/systemd/network/wg-nerdberg.netdev
Link File: /usr/lib/systemd/network/99-default.link
Network File: /etc/systemd/network/wg-nerdberg.network
State: routable (configured)
Online state: online
Type: wireguard
Kind: wireguard
Driver: wireguard
MTU: 1280 (max: 2147483552)
QDisc: noqueue
IPv6 Address Generation Mode: none
Number of Queues (Tx/Rx): 1/1
Address: 10.3.2.120
fd00::3:2:b0
Activation Policy: up
Required For Online: no
Aug 16 14:31:06 thinkcentre systemd-networkd[372]: wg-nerdberg: netdev ready Aug 16 14:31:06 thinkcentre systemd-networkd[372]: wg-nerdberg: Configuring with /etc/systemd/network/wg-nerdberg.network. Aug 16 14:31:06 thinkcentre systemd-networkd[372]: wg-nerdberg: Link UP Aug 16 14:31:06 thinkcentre systemd-networkd[372]: wg-nerdberg: Gained carrier
Wireguard Device
Use the wireguard wg utility for that.
# wg show
interface: wg-nerdberg
public key: KOMmBnaj4ebyJbcLuSCjTLCoyTuV5ZON2nArENP4BGE=
private key: (hidden)
listening port: 51902
peer: ZasbMPoNaD0OGfqm/PQgs+cO/Mhz6ePYFlSB77KyUmU=
preshared key: (hidden)
endpoint: 212.172.14.27:51820
allowed ips: 10.3.2.0/24, 10.73.36.0/23
latest handshake: 13 seconds ago
transfer: 38.03 MiB received, 1.59 MiB sent
persistent keepalive: every 25 seconds
Address
Use iputils' ip addr for that.
# ip addr show dev wg-nerdberg
6: wg-nerdberg: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1280 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 10.3.2.120 peer 10.3.2.1/32 scope global wg-nerdberg
valid_lft forever preferred_lft forever
inet6 fd00::3:2:b0 peer fd00::3:2:1/128 scope global
valid_lft forever preferred_lft forever
Route
Use iputils' route for that.
# ip route show dev wg-nerdberg 10.3.2.0/24 via 10.3.2.1 proto static 10.3.2.1 proto kernel scope link src 10.3.2.120 10.73.36.0/23 via 10.3.2.1 proto static