Differences

This shows you the differences between two versions of the page.

--- userdoc:tt_wireguard_vpn [2019/02/07 14:51]
abelbeck [WireGuard VPN Configuration]
+++ userdoc:tt_wireguard_vpn [2020/03/30 09:33] (current)
abelbeck [WireGuard VPN Configuration]
@@ Line 3: / Line 3: @@
 AstLinux now supports the [[https://www.wireguard.com/|WireGuard VPN]]. WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography.  WireGuard was created by Jason A. Donenfeld.
-!!Info ->!! Currently (November 2018) WireGuard has not quite yet been accepted into the mainline Linux kernel. Be certain to perform your own due diligence and testing of what could become the premier VPN in the not too distant future.
+!!Info ->!! Currently (March 2020) WireGuard is included in Linux 5.6 and onward.  Backports for older kernels are also maintained. Be certain to perform your own due diligence and testing of what could become the premier VPN type across most all platforms.
 !!Note: AstLinux 1.3.2 or later is required, new features with 1.3.5 or later!!
+!!Note: AstLinux 1.3.6 or later!! supports **Reload WireGuard VPN**
+!!Note: AstLinux 1.3.7 or later!! supports **WG->Local** firewall rules
 ===== WireGuard Initial Configuration =====
@@ Line 133: / Line 136: @@
 {{:userdoc:wireguard-vpn-edit-restart.jpg?nolink|Restart WireGuard VPN}}
+!!Note: AstLinux 1.3.6 or later!! supports **Reload WireGuard VPN** for those situations when only peers are edited, added or removed.  **Reload WireGuard VPN** will apply the peer changes without interrupting currently active peers.
+If Tunnel/Interface/Firewall Options are changed, you must use **Restart WireGuard VPN** to apply changes.
 ===== WireGuard Configuration Options =====
@@ Line 172: / Line 180: @@
   * Peer Isolation:  Choose to "Pass" or "Deny" Peer->Peer traffic. "Deny" isolates connected peers, blocking access with each other.
+!!Note: AstLinux 1.3.7 or later!! supports **WG->Local** firewall rules.
+{{:userdoc:wireguard-vpn-firewall-wg-local.png?nolink&621|WireGuard VPN Firewall WG->Local}}
+  * Firewall Rules: Choose either "Deny WG->Local" or "Pass WG->Local", with which the TCP/UDP fields apply to.
+!!Important ->!! The default policy is to allow all **WG->Local** traffic unless "Pass WG->Local" is defined, then the default policy is to deny all **WG->Local** traffic.
+ICMP Echo Request (ping) packets are allowed and rate-limited for **WG->Local** traffic, regardless of the "Firewall Rules:" choice.
+  * TCP: Define ''TCP'' rules of the form; host1,host2~port1,port2 host3,host4~port3,port4 ...
+  * UDP: Define ''UDP'' rules of the form; host1,host2~port1,port2 host3,host4~port3,port4 ...
+!!Tip ->!! Allow SSH and DNS traffic, deny all other traffic ... choose "Pass WG->Local" and set ''TCP'' to ''0/0~22,53'' and ''UDP'' to ''0/0~53''
+!!Tip ->!! Deny HTTP/HTTPS traffic, allow all other traffic ... choose "Deny WG->Local" and set ''TCP'' to ''0/0~80,443''
+!!Tip ->!! Click on the blue ''(i)'' icon for detailed help.
+\\
 {{:userdoc:wireguard-vpn-public-key.png?nolink|WireGuard VPN Public Key}}
-When WireGuard VPN is active, a "This Peer's Public Key:" entry is shown, for easy copy/paste to remote peer configurations
+When WireGuard VPN is active, a "This Peer's Public Key:" entry is shown, for easy copy/paste to remote peer configurations.
-.
 ===== Enable Firewall =====
@@ Line 227: / Line 255: @@
 ===== WireGuard Client Support =====
-WireGuard is now available for [[https://www.wireguard.com/install/|Android]] and as Beta-Version for [[https://www.wireguard.com/install/|Apple iOS]] (via TestFlight app only ≥12.x).
+WireGuard is now available for [[https://www.wireguard.com/install/|iOS / Android / macOS / Windows]] installation.
+Each client is open source and free to use.
 \\