Setting up a wireguard VPN connection on OpenBSD (how to)

silvanus

On reddit there were questions about using a commercial vpn config file on OpenBSD. I mean after wireguard has landed in the kernel and there is no need for extra tools like before (wg-quick). ifconfig and route do the job.

There are many vpn services, here is an example with mullvad. Config files look like:

[Interface]
PrivateKey = supprscreetprriiivvaatteekeeeeyyyyyyyyyyy=
Address = 10.68.166.222/32,fc00:aaaa:cccc:bb02::5:b6e4/128
DNS = 193.138.218.74

[Peer]
PublicKey = ThxxiisxsiissthhxeseerVeRPubliickeeybbccyy= 
AllowedIPs = 0.0.0.0/0,::0/0
Endpoint = 199.55.111.99:51280

That's imaginary data here for the example. The DNS server address should be configured in /etc/resolv.conf.
wgkey (PrivateKey) is the same for every server connection, if you generated multiple config files for one key. The "Address" line shows the private network IP for the connection.
wgpeer (PublicKey of the vpn server) depends on the country/server, just like the Endpoint IP.
wgaip (AllowedIPs) 0.0.0.0/0 shows that this config accepts any IP. The default (listening) port setting is 51280 but it could be also something else like 51234.

Setting up the connection (here ipv4) has basically two parts. 1. Configure interface, 2. change routing table:

doas ifconfig wg0 create wgkey supprscreetprriiivvaatteekeeeeyyyyyyyyyyy= wgpeer ThxxiisxsiissthhxeseerVeRPubliickeeybbccyy= wgendpoint 199.55.111.99 51280 wgaip 0.0.0.0/0
doas ifconfig wg0 10.68.166.222/32

The second IP is the default gateway (you can check it with 'route show'):

doas route add 199.55.111.99 192.168.0.1
doas route change default 10.67.185.229

Verify that the VPN is up:
curl https://wtfismyip.com/text
Or use mullvad's api:
curl https://am.i.mullvad.net/connected
This site also checks DNS leaks.

For turning the VPN off change back the default gateway:
doas route change default 192.168.0.1

Those /etc/wireguard/*.conf files scream for a nice, simple ksh script. 🙂

silvanus

As a simple script was mentioned, let's add one in case someone finds such a setup useful. It simply checks the .conf files in /etc/wireguard/ and establishes a connection like in the post above. There should be an other one (or addendum) for changing the wireguard server but did not figure out the best way yet.

#! /bin/ksh
#Create a wireguard VPN connection using .conf files from /etc/wireguard/
#This example is based on mullvad .conf files
#Start the script with the selected server, e.g.(if the file called "vpn"): vpn jp12 or vpn br1
#License GPL2, (c)  silvanus
#Change the default gateway according to your settings (I use here the one from the post above):
defaultgateway="192.168.0.1"

arg=$1
countryserver="$1"

echo "Trying to connect to $countryserver wireguard server"

wgkey=$(doas awk '/PrivateKey/{print $3}' /etc/wireguard/mullvad-$countryserver.conf)
wgpeer=$(doas awk '/PublicKey/{print $3}' /etc/wireguard/mullvad-$countryserver.conf)
wgendpoint=$(doas awk -F '[[:blank:]:]+' '/Endpoint/{print $3}' /etc/wireguard/mullvad-$countryserver.conf)
port=$(doas awk -F ':' '/Endpoint/{print $2}' /etc/wireguard/mullvad-$countryserver.conf)
wgaip="0.0.0.0/0"
wg0=$(doas awk -F '[[:blank:],]+' '/Address/{print $3}' /etc/wireguard/mullvad-$countryserver.conf)
address=$(doas awk -F '[[:blank:]/]+' '/Address/{print $3}' /etc/wireguard/mullvad-$countryserver.conf)

echo "Parsing wireguard config file - done"

doas ifconfig wg0 create wgkey $wgkey wgpeer $wgpeer wgendpoint $wgendpoint $port wgaip $wgaip && doas ifconfig wg0 $wg0
echo "Wireguard wg0 interface created and IP assigned"

doas route add $wgendpoint $defaultgateway && doas route change default $address && curl https://am.i.mullvad.net/connected

It's easy to change the wireguard server connection e.g. by using ifconfig wg0 destroy and route delete or flush (and establish a new wireguard connection). Just not sure regarding the best way to ensure that there is no traffic "in-between".