skz-wg/README.md at master

Samuel Aubertin a7c7fea3c6 readme typos

2023-12-22 08:28:53 +01:00

3.3 KiB

Raw Permalink Blame History

  ██████  ██ ▄█▀▒███████▒     █     █░  ▄████ 
▒██    ▒  ██▄█▒ ▒ ▒ ▒ ▄▀░    ▓█░ █ ░█░ ██▒ ▀█▒
░ ▓██▄   ▓███▄░ ░ ▒ ▄▀▒░ ░█▒░ █ ▒█░ █░█ ▒ ██░▄▄▄░
  ▒   ██▒▓██ █▄   ▄▀▒   ░    ░█░ █ ░█ ░▓█  ██▓
▒██████▒▒▒██▒ █▄▒███████▒    ░░██▒██▓ ░▒▓███▀▒
▒ ▒▓▒ ▒ ░▒ ▒▒ ▓▒░▒▒ ▓░▒░▒    ░ ▓░▒ ▒   ░▒   ▒ 
░ ░▒  ░ https://git.sk4.nz/sk4nz/skz-wg ░   ░ 
      ░  ░        ░ ░            ░          ░

Samuel 'sk4nz' AUBERTIN

skz-wg is a VPN (WireGuard) + DNS (Unbound) + Firewall (Packet Filter) automated setup for OpenBSD with client configuration management.

WARNING: The VPN clients outgoing packets are filtered, and the DNS resolver lies for adverting related hosts.

Howto

tl;dr: make

Install, configure and runs WireGuard for client FOO and BAR

CLIENTS="FOO BAR" make

Show informations about the running WireGuard instance

make info

Details

WireGuard

WireGuard website

Is configured to listen on WG_PORT, spawning the WG_LAN private network. It uses PSK authentication and keep-alives.

Server

Optionally declare the server IP address with SERVER=IP in the ./Makefile or using SERVER=IP make.

Clients

Declare clients a, b and c with CLIENTS=a b c in the ./Makefile or using CLIENTS="a b c" make.

Client management is additive, meaning you can add more with CLIENTS="new" make.

Configuration files

Each client has configuration files created in ./CLIENT_NAME:

sk4nz.conf # The client configuration file
sk4nz.key  # The client secret key
sk4nz.pub  # The client public key
sk4nz.psk  # The client PSK
sk4nz.qr   # QRcode configuration

You can use the .conf or it's QRcode encoded version .qr to configure clients.

Unbound

Unbound website

Lies on ads (used list are declared in ADS_URLS) and validates DNSSEC when available.

Packet Filter

OpenBSD PF website

NATs WG_LAN and filters both ingress and egress ports.

To allow more ports, please edit IN_TCP, OUT_TCP, IN_UDP, OUT_UDP and VPN_TCP in the ./Makefile.

Ingress: `IN_TCP`, `IN_UDP`

IN_TCP: Allowed ports for the incoming TCP packets to the server WAN interface.
IN_UDP: Allowed ports for the incoming UDP packets to the server WAN interface.

Egress: `OUT_TCP`, `OUT_UDP`

OUT_TCP: Allowed destination ports for the outgoing TCP packets from the server WAN interface.
OUT_UDP: Allowed destination ports for the outgoing UDP packets from the server WAN interface.

NAT: `VPN_TCP`

Allowed destination ports for packets coming from the WG_LAN before going throug the NAT.

3.3 KiB Raw Permalink Blame History