Skip to main content

Setting up Wireguard in an LXC container

Step 1 - Install Wireguard kernel module

On proxmox host shell

apt update
apt install wireguard pve-headers

Set module to auto-load at boot

echo "wireguard" >> /etc/modules-load.d/modules.conf

 

Step 2 - Start container and load user space tools fore wireguard

Create Container with usual settings

Once container started, log in and install tools

apt-get install --no-install-recommends wireguard-tools

Test everything works by adding a temporary wg0 device

image.png

 

Step 3 - Generate Key Pair

Generate private key and remove all permissions for anyone other than root

wg genkey | tee /etc/wireguard/private.key
chmod go= /etc/wireguard/private.key

Generate public key derived from private key

cat /etc/wireguard/private.key | wg pubkey | tee /etc/wireguard/public.key

 

Step 4 - Choose IP range

The server needs a range of private IPv4 addresses to use for clients and its tunnel interface. These IP addresses should be chosen from a reserved block of addresses:
10.0.0.0 to 10.255.255.255 (10/8 prefix)
172.16.0.0 to 172.31.255.255 (172.16/12 prefix)
192.168.0.0 to 192.168.255.255 (192.168/16 prefix)

 

Step 5 - Create Server Configuration

Create configuration file

nano /etc/wireguard/wg0.conf

Template for config file

[Interface]
PrivateKey = base64_encoded_private_key_goes_here<server private key>
Address = 10.8.0.0.1/2432
ListenPort = 51820
SaveConfig = truefalse
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <client public key>
AllowedIPS = <client configured IP address>

NOTE: iptables is not installed in container by default

apt install iptables

Step 6 - Routing WireGuard Peers internet traffic through WireGuard Server (Optional)

If only using WG to connect a peer to the server in order to access services on the server only, this does not need to be completed.
If routing Peers internet traffic through WG Server configure IP fowarding by following tutorial steps 4 and 5 on Digital Ocean

 

Step 7 - Starting WireGuard Server

WG can be configured to run as a systemd service using built-in wg-quick script, which means it can be configured to start on boot.

systemctl enable [email protected]
systemctl start [email protected]

 

Step 8 - (For Windows) Configure WireGuard client

On Windows client Add Tunnel -> Add empty tunnel

image.png

Adjust the configuration for to:

[Interface]
PrivateKey = <generated private key>
Address = 10.0.0.3/24
DNS = 1.1.1.1, 1.0.0.12/32

[Peer]
PublicKey = YOUR_SERVER_PUBLIC_KEY
AllowedIPs = 0.0.0.0/00, 192.168.0.0/24, 10.0.0.1/32
Endpoint = YOUR_SERVER_WAN_IP:51820


Step 9 - Add client public key to server

Back on container shell

wg set wg0 peer <client public key> allowed-ips <client VPN IP>

note: client VPN IP should be the address set in the client interface field (10.0.0.3)2/32)

If there are issues with this method, add the information to the [Peer] section of the server.conf file.

Back to top