A Mechanised Cryptographic Proof of the WireGuard VPN Protocol

Re:A Mechanised Cryptographic Proof of the WireGuard VPN Pro... by cyphar on Monday May 13, 2019 @07:35AM (#19898187)

I have a script that will generate the server config and auto-generate the client configurations for you[1]. In short, the primary thing you need to remember to add is:

    PostUp   = iptables -A FORWARD -i %i -j ACCEPT
    PostUp   = iptables -A FORWARD -o %i -j ACCEPT
    PostUp   = iptables -t nat -A POSTROUTING -o $HOST_NIC -j MASQUERADE
    PostDown = iptables -D FORWARD -i %i -j ACCEPT
    PostDown = iptables -D FORWARD -o %i -j ACCEPT
    PostDown = iptables -t nat -D POSTROUTING -o $HOST_NIC -j MASQUERADE

To your server's .conf file (using wg-quick). HOST_NIC is eth0 or whatever your server gets its internet from. You also need to enable IP forwarding:

    sysctl -w net.ipv4.ip_forward=1

(If you want to use IPv6 too, make sure to add the corresponding ip6tables and net.ipv6.conf.all.forwarding=1 bits.)

[1]: https://github.com/cyphar/dotfiles/blob/master/.local/bin/wg...

[ Parent | on HN ]

Re:A Mechanised Cryptographic Proof of the WireGuard VPN Pro... by IOT_Apprentice on Monday May 13, 2019 @12:03PM (#19900626)

That is very slick.

I'm still working on getting ipv6 working correctly configured when I'm on work wifi, which is both ipv4/ipv6. Traffic flows fine on my personal iphone X with wireguard from home.

Our IT has reddit.com blocked and somehow my connection to reddit is being blocked still even though wireguard and 1.1.1.1 are setup on my VPS/wireguard setup.

[ Parent | on HN ]