Wireguard configuration for clients

This is a small helper script to be run on the Wireguard server. It is capable of managing Wireguard clients on the server side as well es creating configurations for clients.

Usage

Install the wg-admin tool on the Server.

If you are not happy with the defaults, you may point to the proper config:

• WG_ADMIN_CONF: the configuration file for wg-admin (defaults to $HOME/.wg-admin/conf

Create a running wireguard server config:

1. Create the key files:

   cd /etc/wireguard
   wg genkey | ( umask 077; tee private.key ) | wg pubkey > public.key
   

2. Initially create the interface and set initial parameters

   ip link add dev wg0 type wireguard
   wg set wg0 private-key private.key listen-port 55880
   wg showconf wg0 >/etc/wireguard/wg0.conf
   

3. Copy the example config to $WG_ADMIN_CONF. Adjust this file to your needs.

• admin: How to become admin user (SSH, Sudo)
• var: Place for the local client configurations
• iface: The wireguard interface to manage
• pool6: IPv6 address pool
• pool4: IPv4 address pool
• your (the server's) public key

1. Initialize Git:

   wg-admin git init -b master
   wg-admin git --commit 'initial commit' --allow-empty
   

2. If you want to sync your configs with a remote git repo:

   wg-admin git remote add origin <your remote repo>
   wg-admin git push -u origin master
   

To enable a client using Wireguard you need to

1. install wireguard on the client's device
2. create a configuration for this client
3. export the configuration to this client
4. import the created configuration on the client

Create client config

The clients are identified by their public key. Normally they (the clients) should create the private and public keys on their device. But given the knowledge of the average user, we create the configs centrally and distribute the ready-to-use configuration files.

A repository of the configurations is held in $HOME/wireguard/ and optionally on a remote Git repository.

1. Run the wg-admin command, where NAME is the name of your new config (client name).

   wg-admin add NAME
   wg-admin enable NAME
   

   A possible shortcut is wg-admin add --enable NAME.

Now the new peer NAME is allowed to connect.

Export client config

Depending on the client's capabilities you may want to export the text based config, the PNG based QR code, or the text based QR code. All the configurations are available in the $HOME/wireguard/client-configs/ directory.

Alternativly you can show the current up-to-date config for the client by running one of the following commands:

wg-admin show [--qr[=format]|--text] NAME

This configuration (file) should be imported on the client.