Skip to content

Commit e0dfa35

Browse files
ParaphraserParaphraser
committed
WireGuard - old-menu branch - PR 2 of 3
Adds service definition from [IOTstack tutorial: Quick and Dirty WireGuard](https://gist.github.com/Paraphraser/f46014b8a27e3f878f07657d6db4490e) gist. Adds same `duck.sh` proposed in PR 1 of 3 in this PR group. Reduces the following IOTstack documents to stubs, referring to Wiki master branch versions: * Accessing-your-Device-from-the-internet.md * WireGuard.md
1 parent c2d7825 commit e0dfa35

File tree

4 files changed

+45
-183
lines changed

4 files changed

+45
-183
lines changed

‎.templates/wireguard/service.yml‎

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,23 @@
1-
21
wireguard:
3-
image: linuxserver/wireguard
42
container_name: wireguard
5-
cap_add:
6-
- NET_ADMIN
7-
- SYS_MODULE
3+
image: ghcr.io/linuxserver/wireguard
4+
restart: unless-stopped
85
environment:
9-
- PUID=1000
10-
- PGID=1000
11-
- TZ=Europe/Berlin
12-
- SERVERURL=<enter yours>.duckdns.org #optional
13-
- SERVERPORT=51820 #optional
14-
- PEERS=1 #optional
15-
- PEERDNS=auto #optional
16-
- INTERNAL_SUBNET=100.64.0.0/24 #optional
17-
volumes:
18-
- ./services/wireguard/config:/config
19-
- /lib/modules:/lib/modules
6+
- PUID=1000
7+
- PGID=1000
8+
- TZ=Etc/UTC
9+
- SERVERURL=your.dynamic.dns.name
10+
- SERVERPORT=51820
11+
- PEERS=laptop,phone,tablet
12+
- PEERDNS=auto
13+
- ALLOWEDIPS=0.0.0.0/0
2014
ports:
21-
- 51820:51820/udp
15+
- "51820:51820/udp"
16+
volumes:
17+
- ./volumes/wireguard:/config
18+
- /lib/modules:/lib/modules:ro
19+
cap_add:
20+
- NET_ADMIN
21+
- SYS_MODULE
2222
sysctls:
23-
- net.ipv4.conf.all.src_valid_mark=1
24-
restart: unless-stopped
23+
- net.ipv4.conf.all.src_valid_mark=1

‎docs/Accessing-your-Device-from-the-internet.md‎

Lines changed: 1 addition & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,3 @@
11
# Accessing your device from the internet
2-
The challenge most of us face with remotely accessing your home network is that you don't have a static IP. From time to time the IP that your ISP assigns to you changes and it's difficult to keep up. Fortunately, there is a solution, a DynamicDNS. The section below shows you how to set up an easy to remember address that follows your public IP no matter when it changes.
32

4-
Secondly, how do you get into your home network? Your router has a firewall that is designed to keep the rest of the internet out of your network to protect you. Here we install a VPN and configure the firewall to only allow very secure VPN traffic in.
5-
6-
## DuckDNS
7-
If you want to have a dynamic DNS point to your Public IP I added a helper script.
8-
Register with duckdns.org and create a subdomain name. Then edit the `nano ~/IOTstack/duck/duck.sh` file and add your
9-
10-
```bash
11-
DOMAINS="YOUR_DOMAINS"
12-
DUCKDNS_TOKEN="YOUR_DUCKDNS_TOKEN"
13-
```
14-
15-
first test the script to make sure it works `sudo ~/IOTstack/duck/duck.sh` then `cat /var/log/duck.log`. If you get KO then something has gone wrong and you should check out your settings in the script. If you get an OK then you can do the next step.
16-
17-
Create a cron job by running the following command `crontab -e`
18-
19-
You will be asked to use an editor option 1 for nano should be fine
20-
paste the following in the editor `*/5 * * * * sudo ~/IOTstack/duck/duck.sh >/dev/null 2>&1` then ctrl+s and ctrl+x to save
21-
22-
Your Public IP should be updated every five minutes
23-
24-
## PiVPN
25-
pimylifeup.com has an excellent tutorial on how to install [PiVPN](https://pimylifeup.com/raspberry-pi-vpn-server/)
26-
27-
In point 17 and 18 they mention using noip for their dynamic DNS. Here you can use the DuckDNS address if you created one.
28-
29-
Don't forget you need to open the port 1194 on your firewall. Most people won't be able to VPN from inside their network so download OpenVPN client for your mobile phone and try to connect over mobile data. ([More info.](https://en.wikipedia.org/wiki/Hairpinning))
30-
31-
Once you activate your VPN (from your phone/laptop/work computer) you will effectively be on your home network and you can access your devices as if you were on the wifi at home.
32-
33-
I personally use the VPN any time I'm on public wifi, all your traffic is secure.
34-
35-
## Zerotier
36-
https://www.zerotier.com/
37-
38-
Zerotier is an alternative to PiVPN that doesn't require port forwarding on your router. It does however require registering for their free tier service [here](https://my.zerotier.com/login).
39-
40-
Kevin Zhang has written a how to guide [here](https://iamkelv.in/blog/2017/06/zerotier.html). Just note that the install link is outdated and should be:
41-
```
42-
curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/contact%40zerotier.com.gpg' | gpg --import && \
43-
if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi
44-
```
3+
This is the old-menu branch documentation. Please refer to [this page of the IOTstack Wiki](https://sensorsiot.github.io/IOTstack/Accessing-your-Device-from-the-internet.html).

‎docs/Containers/WireGuard.md‎

Lines changed: 1 addition & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -1,120 +1,3 @@
11
# WireGuard
22

3-
WireGuard is a fast, modern, secure VPN tunnel. It can securely connect you to your home network, allowing you to access your home network's local services from anywhere. It can also secure your traffic when using public internet connections.
4-
5-
WARNING: These instructions require that you have privileges to configure your network's gateway. If you are not able to make changes to your network's firewall settings, then you will not be able to finish this setup. If you are able to make these changes, then proceed to the next steps.
6-
7-
## Setup
8-
9-
There are a few things to configure before starting up the WireGuard container. First, it may be necessary to set up a way to locate your home network from the internet. One way to achieve this, if you haven't done so yet, is to set up a DuckDNS account as described in the [Wiki](https://sensorsiot.github.io/IOTstack/Accessing-your-Device-from-the-internet.md) under the section DuckDNS. This address will be used in the following configuration. After configuring the service, it needs to be made accessible from outside the home network. Lastly, each device will need WireGuard installed and set up with the details of your WireGuard service.
10-
11-
## WireGuard Configuration
12-
13-
The [Custom services and overriding default settings for IOTstack](https://sensorsiot.github.io/IOTstack/Custom/) page describes how to use a `compose-override.yml` file to allow `./menu.sh` to automatically incorporate your custom configurations into the final `docker-compose.yml` file that is responsible for defining all service containers.
14-
15-
You will need to create the `compose-override.yml` before building your stack via `./menu.sh`. If you have already built your stack, you'll have to re-build it after creating `compose-override.yml`.
16-
17-
Here is an example `compose-override.yml` file:
18-
```
19-
services:
20-
wireguard:
21-
environment:
22-
- PUID=1000
23-
- PGID=1000
24-
- TZ=America/Los_Angeles
25-
- SERVERURL=<Your-DuckDNS-account>.duckdns.org #optional
26-
- SERVERPORT=51820 #optional
27-
- PEERS=3 #optional
28-
- PEERDNS=auto #optional
29-
- INTERNAL_SUBNET=100.64.0.0/24 #optional
30-
```
31-
32-
The values you will probably want to change are `TZ` to your own timezone, `SERVERURL` to your own DuckDNS address and `PEERS` to set the number of devices you plan to connect to your VPN. If you also decide to edit the `SERVERPORT` value, you will also need to include a matching value in the `ports:` section as follows:
33-
34-
```
35-
services:
36-
wireguard:
37-
environment:
38-
- PUID=1000
39-
- PGID=1000
40-
- TZ=America/Los_Angeles
41-
- SERVERURL=<Your-DuckDNS-account>.duckdns.org #optional
42-
- SERVERPORT=55555 #optional
43-
- PEERS=3 #optional
44-
- PEERDNS=auto #optional
45-
- INTERNAL_SUBNET=100.64.0.0/24 #optional
46-
ports:
47-
- 55555:55555/udp
48-
```
49-
50-
If you customize other containers, just make sure the file only says `services:` once at the beginning of the file. Once you are done, you can run `./menu.sh` to build your stack. Finally, check that your changes were successfully integrated by running:
51-
52-
`$ cat docker-compose.yml`
53-
54-
If everything looks good, you can run the following to start your container: `$ docker-compose up -d`
55-
56-
## Network Configuration
57-
58-
A typical home network will have a firewall configured that effectively blocks all incoming attempts to open a new connection with devices on the network. However, in order to use our VPN from outside of our home network (which is precisely the point of running the service!), we need to configure port fowarding to allow incoming connections to reach our device running IOTstack. This step of the configuration varies based on the specific gateway device for your network. Note that these instructions assume you have privileges to configure your gateway's firewall settings (see warning above). This section will include some tips, but if you are unsure how to do this, the best idea would be to search the web for "[YOUR DEVICE NAME] port forwarding configuration".
59-
60-
NOTE: WireGuard uses UDP, not TCP. So make sure your port forwarding rules are for UDP only.
61-
62-
First, it's a good idea to check that WireGuard is at least accessible on the local network by using `nmap`:
63-
64-
```
65-
$ sudo nmap -sU -p 51820 ip.of.IOTstack.device
66-
OR from the IOTstack device itself:
67-
$ sudo nmap -sU -p 51820 127.0.0.1
68-
69-
PORT STATE SERVICE
70-
51820/udp open|filtered unknown
71-
MAC Address: XX:XX:XX:XX:XX:XX (Unknown)
72-
```
73-
If your result looks similar, then WireGuard is up and running and you simply need to set up port forwarding. Notice again, that WireGuard uses UDP.
74-
75-
Many routers/gateways are configurable via a web interface, in which case you will only need the ip address of the device, as well as the account and password to access it. You should be able to find your gateway's address with the following command:
76-
77-
```
78-
$ ip route | grep default
79-
80-
default via 192.168.1.1 dev eth0 proto dhcp metric 100
81-
```
82-
Then copy the ip to a browser window to configure. The login credentials may be physically printed on the device if you have never logged in or changed the default credentials.
83-
84-
Follow the instructions to configure UDP port forwarding for your network. Make sure that you configure only UDP port forwarding, only pointing specifically at your IOTstack device (by ip or hostname, whichever is more appropriate for your network configuration) and only for port 51820 (or whichever port you have configured for WireGuard). Remember that you are opening this port to the public internet, so be careful not to leave anything open that you're not using or point to the wrong device. Once you are finished, save your changes and test that the port is open from the internet, again using `nmap`:
85-
86-
```
87-
$ sudo nmap -sU -p 51820 <your-duckdns-account>.duckdns.org
88-
89-
PORT STATE SERVICE
90-
51820/udp open|filtered unknown
91-
MAC Address: XX:XX:XX:XX:XX:XX (Unknown)
92-
```
93-
If everything looks good, then the last step is to set up your devices to connect to your WireGuard service.
94-
95-
## Device Setup
96-
97-
Lastly, it's time to set up each device to connect to your VPN. You will need to install the WireGuard client on each device. This can be typically be done via each device's app store or package manager. For complete install instructions, see the [WireGuard Installation page](https://www.wireguard.com/install/).
98-
99-
## QR Code Mobile Device Setup
100-
After the client is installed on your devices, each one needs its own WireGuard peer configuration. The easiest devices to set up are mobile devices, which can be done by using the QR codes that are automatically generated for each WireGuard PEER, as defined in the `docker-compose.yml` file. The QR codes are located in the following locations:
101-
102-
```
103-
~/IOTstack/services/wireguard/config/peer1/peer1.png
104-
~/IOTstack/services/wireguard/config/peer2/peer2.png
105-
~/IOTstack/services/wireguard/config/peer3/peer3.png
106-
...
107-
```
108-
109-
To copy the files from a Raspberry Pi onto another Linux machine for example, you can use the following command:
110-
111-
```
112-
$ sudo scp pi@<Rpi-ip-address>:/home/pi/IOTstack/services/wireguard/config/peer1/peer1.png ~/peer1.png
113-
```
114-
(Hint: you can use the `scp -i` flag to specify an IdentityFile or better yet, `scp -F` flag if you have your device configured in `.ssh/config`)
115-
116-
You can repeat this step for each peer's QR code `.png` file and then scan the QR codes in the mobile app on your devices. The devices should now be configured and able to connect to your VPN.
117-
118-
## Setting Up Other Devices
119-
120-
Setting up other devices is a bit more complicated. Refer to the [WireGuard Quick Start](https://www.wireguard.com/quickstart/) page or search for instructions specific to your OS.
3+
This is the old-menu branch documentation. Please refer to [this page of the IOTstack Wiki](https://sensorsiot.github.io/IOTstack/Containers/WireGuard.html).

‎duck/duck.sh‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,27 @@
1-
#!/bin/bash
2-
# Your comma-separated domains list
3-
DOMAINS="YOUR_DOMAINS"
1+
#!/usr/bin/env bash
2+
3+
# Your DuckDNS domain (or comma-separated list of DuckDNS domains if you
4+
# have multiple domains associated with the same IP address).
5+
DOMAINS="YOURS.duckdns.org"
6+
47
# Your DuckDNS Token
58
DUCKDNS_TOKEN="YOUR_DUCKDNS_TOKEN"
6-
curl -k -o /var/log/duck.log "https://www.duckdns.org/update?domains=${DOMAINS}&token=${DUCKDNS_TOKEN}&ip="
9+
10+
# is this script running in the foreground or background?
11+
if [ "$(tty)" = "not a tty" ] ; then
12+
13+
# background! Assume launched by cron. Add a random delay to avoid
14+
# every client contacting DuckDNS at exactly the same moment.
15+
sleep $((RANDOM % 60))
16+
17+
fi
18+
19+
# mark the event in case this is being logged.
20+
echo "$(date "+%a, %d %b %Y %H:%M:%S %z") - updating DuckDNS"
21+
22+
# Request duckdns to update your domain name with your public IP address
23+
curl --max-time 10 \
24+
"https://www.duckdns.org/update?domains=${DOMAINS}&token=${DUCKDNS_TOKEN}&ip="
25+
26+
# curl does not append newline so fix that
27+
echo ""

0 commit comments

Comments
 (0)