Source
r/vyos•
thews

Wireguard

I'm using the linuxserver/wireguard docker, and trying to get a vyos 1.4 appliance to connect to it, I have no problem with other implementations (android / ubuntu / windows) connecting to it.

I am having a problem setting the public-key, I only see instructions to generate, and the config allows me to set private-key but not public, I can set the peer's public-key without issue.

I read in the forums on an older version of VyOS that people were able to use a folder that contained the keys, but that doesn't seem to work on vyos 1.4 https://forum.vyos.io/t/convert-wireguard-config-from-rolling-to-1-2-5-lts/5345

​

vyos@wgtest# show interfaces wireguard wg01

address 127.0.0.1/30 description VPN-to-test mtu 1420 peer to-test {     address dockeripaddresshere     allowed-ips 0.0.0.0/0     persistent-keepalive 15     port 51820     public-key 44charkeyhere } private-key 44charkeyhere

The only thing I've seen in the log is this.

​

Oct 18 17:49:26 wgtest vyos-configd[692]: Received message: {"type": "node", "data": "VYOS_TAGNODE_VALUE=wg01/usr/libexec/vyos/conf_mode/interfaces-wireguard.py"}

Oct 18 17:49:26 wgtest vyos-configd[692]: module 'interfaces_wireguard' has no attribute 'generate' Oct 18 17:49:26 wgtest vyos-configd[692]: Sending response 4

It would also be nice if I could import the wireguard server generated config.

Posted Oct 18, 2021, 6:21 PM UTC

35
thewsOP•

I apologize for reddit destroying the code block that looked fine until after the post took.

1
tjharman•

I'm kinda confused by what you've posted.

Are you trying to tell Vyos the private-key of your remote peer? That's not at all how Wireguard works. Only the peer knows its private key. You never set the peers private key.

The peer encrypts his data with his private key and you decrypt it/verify it because you have his public key. Same in reverse.

The private key you're setting on your WG interface should be the one that matches with the public key you're confugring on your remote peer for your WG instance.

This is such a fundamental thing though that I must be misunderstand what the problem you're facing is? (And apologies for telling you how to suck eggs if so)

1
thewsOP•

I was only confused with the public key being on the peer part, but after looking at the conf files generated by wg I see that's normal. I thought the separate pki generated files had the public key not in the peer config and that the peer config might have been the public key of the peer.

Reddit stripping the formatting really made it difficult to follow. But you can see the private key is outside of the last closing curly bracket.

1
AxisNL•

Previously you generated your wireguard keys with generate wireguard default-keypair, and the private key would be stored on disk, not in your config.

In recent 1.4 versions, you have to generate the keys using generate pki wireguard key-pair and it will just print a set. You then use your private key in your config, and send the public key to your partner.

Are you sure you're running a recent version? Your config looks pretty sane, except for 127.0.0.1/30 as local address, don't know if that will work.

And you probably know this, but just to be sure: on both ends you generate a private key and a public key. You only store your private key locally, and you give your public key to the peer.

So on the vyos side, at the wg01 interface level, you configure your own private key. At the peer level, you specify the peer's public key. And on the other end you do the same of course ;)

1
thewsOP•

Yeah that's just a dummy address. I updated it from 1.3 to 1.4. I'm actually a developer and started tracing it all out in the repo and started tracing out everything that changed and saw that the functions in pki all write to file besides wireguard.

I was juggling a few things today and will get back to it tomorrow. I didn't set this one up from scratch and will try to set one up from scratch tomorrow to see if it's some other issue.

1