I should probably write a blog on how to do this. I have a setup guide for myself, but unfortunately it contains a lot of obviously private details that I can't post (ie access to my cloudflare/VPN stuff).

A lot of my stuff is ad-hoc from my personal exploration and experience on Linux.

In regards to the wireguard specific stuff, this isn't a bad guide.

https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar...

The harder part with the VPN stuff is the following.

1) Setting up a clear route of forwarding traffic to the pihole. To do so, you would need to setup netplan/systemd-networkd so your pi gets a static private IP. (Not that easy if you are doing a full ipv6 route too.)

2) Setup a DDNS mechanism (as you most likely are getting a dynamic IP). My suggestion for this was to get a domain name (8 quid a year) and use cloudflare as a DDNS host. You also need to punch a UDP port through your router to forward to your pi.

3) Then setup the rest of the wireguard stuff.

4) Setup the pihole and ensure all interfaces are covered so your VPN has a DNS server.

Part 2 is the hardest bit as I kind of needed some custom scripting to ensure cloudflare had working routes to my networks. e.g. https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab01...

The above script obviously running as a systemd service that restarts automatically.

Obviously you can use something else like noip or some other DDNS solution.

If you're a Linux person, just skip all the other non-sense and create a systemd-networkd file. It's by far the simplest solution I've used, and doesn't require goofy unit files to start/stop/restart via wg tool.

https://www.freedesktop.org/software/systemd/man/systemd.net...

Then choose your firewall of choice to setup NAT and forwarding. I used firewalld, but not sure I'd recommend it. It's just the first solution I got working.

You can set up a Pi-Hole (DNS sinkhole) and Pi-VPN (Wireguard installer and CLI-frontend for small deployments) very quickly. And you can do it on any debian VM or computer, not just Pi.

Once you have the base OS ready to go, it will take you less than 30 minutes if you know how to muck with your DHCP/firewall settings in your router.

https://github.com/pi-hole/pi-hole/#one-step-automated-insta...

Install Pi-Hole, then edit your DHCP server to hand out the Pi-Hole as the DNS server.

https://pivpn.io/

After installing Pi-hole, install this. Choose Wireguard, not OpenVPN. port-forward the Wireguard UDP port to your VPN server. use the "pivpn" command to create client configs and the "qr" subcommand to scan the config into your phone.

I'd recommend just using Tailscale. It's wonderful.

Tailscale is great. It's really changed my world and it's so dang simple.

I did this a few months ago. I’d previously tried a few years ago, and found no good online resources. Now they’re a dime a dozen.

The community around WG has gotten much easier for noobs to get into, and the porcelain around the tool itself has made it quite easy to use, IMO.

I like wg-netns. It allows setup of a wireguard tunnel, similar to wg-quick does, in a Linux network namespace. So I can run some processes using the VPN, and others without.

By specifying the namespace in a systemd service file, I can let a service use a specific VPN.

https://github.com/dadevel/wg-netns

The easiest way on the Pi is to install the HomeAssistant plugin, but it's quite easy to set up on a Linux too. Generate two keys, copy paste them in a five line config, same thing on the client. On a phone install the app and scan a QR code that you rsync over to your PC. There's a tutorial on the Wg website.

> Any good tutorials on setting up Wireguard? This (and Pihole) have been on my todo list for a while.

Pihole pretty much installs itself (it even has a pre-made image). WireGuard will take reading, testing and failing.

I recommend doing these things one thing at a time, and doing the Pihole first.

The easiest way is to use some kind of manager on top of wireguard. Tailscale is very good and free for a single user (or with headscale) Otherwise there is innernet, wiretrustee, ...

I used trailofbits/algo a long time ago for initial setup. Worked well at the time.

I use pivpn - it’s a pretty straightforward helper for both openvpn and wireguard