Implementation of wireguard

[rkosick]

Since now I configured a wireguard connection and start it via ssh before backup to a local rsync server through my local network with the lbb web interface. Works great and is really fast.
Background: I have several services running in my local network and I don't want to make them all available to the internet. So wireguard is an easy way to connect to my local network and use them in general.
Don't know if it just me, but I think that would be a good option for the rsync backup. Or even for connections to a samba/ftp file server or similary for future options.
FRITZ!Box (Fritzbox) also started to make wireguard available. So there is no extra server needed anymore. I think it is easier to configure than ever.

How to implement it:

Install wireguard on lbb:
apt-get install wireguard

Create the folder and set permissions:
mkdir -p /etc/wireguard
chown root:root /etc/wireguard
chmod 700 /etc/wireguard

Make an option to Upload a wireguard configuration file created by your wireguard server or FRITZ!Box
Save the Uploaded file as /etc/wireguard/wg0.conf

Make an option to activate the wireguard connection by execute the following command:
wg-quick up wg0

Or make an option to use the wireguard connection automatically using rsync backup. Should be an option since maybe people will also like to use rsync backup with a server available from the internet.

Would like to know what you think about it.

[EDIT:] corrected the command to activate the wireguard connection

[outdoorbits]

Did you test this? I didn't have the time yet, but I would expect, your LBB gets a new IP when this VPN is activated. And this IP probably will be accessible from your LAN at home but not from outside. If this is right, sitting in your hotel room, you wouldn't have access to your LBB until it disconnects the VPN after the backup has finished. If the backup takes a long time, you couldn't stop it, excepted you disconnect power. Not a good option.

[rkosick]

Yeah that's a really good thought and is true if you use openvpn for example. Then you would only be able to access lbb if you use a vpn connection again on you mobile phone and connect to it again with the IP adress of your locat network. That would be hassle.

With wireguard it is different, I tested it and it works. Wireguard will not touch the wlan0 interface. It creates a virtual interface wg0 and connects this one the the server. Traffic is then routed between the interfaces. Lbb is still available in the public network under its IP address.
When I use it, the diplay will have a minor "bug" (not a bug since right now it was not planned as I use it) because it wants to display the second IP address of the new interface too. And because of lack of space, it will attach the first x digits on the wireguard IP address after the local address.
Random example: The IP address of the public hotel network is 192.168.225.114 and your wireguard IP address is 21.109.222.3 it will show:

IP (online):
192.168.225.114 21

[outdoorbits]

Unfortunately my router does not support wireguard yet, so I couldn't test it. But I could connect my lbb by openVPN to my local network. To access the webUI, I had to connect my client via openVPN as well.
This probably will not work in commercial VPNs. I don't have any experience about that. But does anybody know if VPN providers allow to communicate between multiple devices at the same account?
Anyway, including VPNs into lbb won't be a simple task but I will try to include this.

[rkosick]

You can also easily create a wireguard server using another Raspberry Pi and the PiVPN project. See https://github.com/pivpn/pivpn for instructions.

[outdoorbits]

Could you provide a file as it is exported from your fritz.box? Please don't forget to remove keys and your address... ;-)

[rkosick]

See attachted file.

wireguard_fb.conf.txt

[outdoorbits]

I just uploaded a VPN-enabled version. You'll find the configuration in Settings and I hope, it's intuitive. I couldn't test it, because I couldn't setup a server as I desired. Please tell me about your experience!

[rkosick]

Wow that was fast, thanks, I just used the update function (had wireguard package installed before). Settings looking good and are intuitive. I tested the wireguard connection right now.
Upload of the configuration file is working and everything looks good. Had a look via ssh to /etc/wireguard/wg0.conf
After resetting comitup credentials and a reboot, I saw normal behavior. So I connected to a hotspot of my mobile connection again. Lbb gets the public external IP from the mobile ISP. Like supposed.
Now I started the backup to rsync server and also did a test to google drive. Display shows "Connect VPN WireGuard" and via ssh I can see that this is actual working, lbb gets the public IP of the wireguard server.
But it doesn't mater if I connect the source or not. Lbb displays after maybe 10 seconds:

VPN failed
Connect VPN
USB storage

rsync

Remark: VPN would be desirable for rsync, smb or ftp etc if it is located in a private network. If I want to do a backup via rclone like google, I maybe won't like it this way. Not sure right now how to implement these options. But would be something after it is working anyway. Now it's not working for me.

[rkosick]

Remark: I only deleted my previous config file in /etc/wireguard/ and nothing else before using the update function.

[outdoorbits]

Maybe it's just the check-process. Could you connect wireguard and send me the output of sudo systemctl status ***@***.***

[rkosick]

Sorry, since I have no laptop available right now, I couldn't provide this information. It's a hassle to try to copy something like that on my phone. Was going to do it on the weekend.

[outdoorbits]

I fixed some bugs and changed VPN-detection. Would you please test again... ?

[rkosick]

I did the update right now and it works great. Tested wireguard with rsync. Thank you so much.

[outdoorbits]

Very well! You wished to have an option to use samba via VPN and other cloud services eventually without? The samba idea I don't understand. Then you would push all the traffic from LBB to your router and back to your laptop via VPN. I'm not sure if there would be a relevant benefit in security. Could you please explain? I can implement an option to select for witch services (rsync and/or cloud services) the VPN should be active.

[rkosick]

Yeah samba was just an example if anybody would like to use it. I don't.
And your are right: It makes sense to have an option to use VPN only with rsync for example. It doesn't make sense for cloud services. At least if these services are not banned in a country.