Development discussion of WireGuard
 help / color / mirror / Atom feed
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: wireguard@lists.zx2c4.com
Subject: Trying out WireGuard's kernel support in OpenBSD's -current snapshots
Date: Wed, 24 Jun 2020 00:07:22 -0600	[thread overview]
Message-ID: <20200624060722.GA686091@zx2c4.com> (raw)

Hi everyone,

With WireGuard now being enabled on OpenBSD's -current snapshot builds,
it's pretty easy to try it out on the platform. This email describes two
options for doing in the context of basic VPS providers or personal
machines.

Method A) From an existing OpenBSD install

If you already have an OpenBSD install -- perhaps your VPS provider
supports it as an auto install -- things are pretty easy:

1. Use sysupgrade(8) to upgrade to the latest snapshot as root:

    # sysupgrade -s

2. After it installs and it reboots, install wg(8) and wg-quick(8) as
   root:

    # pkg_add wireguard-tools

3. Now you can use wg(8) and wg-quick(8), in addition to ifconfig(8).


Method B) From an existing Linux install

You probably already have a Linux install -- or most likely your VPS
provider will have any number of Linux distros out of the box -- in
which case you can easily overwrite that Linux install with an OpenBSD
install.

1. Download the miniroot installer:

    $ curl -OJL https://cdn.openbsd.org/pub/OpenBSD/snapshots/amd64/miniroot67.img

2. Write the installer to your hard drive, which is usually either vda,
   sda, hda, or nvme0n1. One of these commands will work, and the other
   three will fail:

    $ sudo dd if=miniroot67.img of=/dev/vda
    $ sudo dd if=miniroot67.img of=/dev/sda
    $ sudo dd if=miniroot67.img of=/dev/hda
    $ sudo dd if=miniroot67.img of=/dev/nvme0n1

   After one of those succeeds, this step is complete.

3. Reboot the machine, and connect to its serial port. Most VPS
   providers have an option called "launch console" or similar. You'll see
   the OpenBSD installer. Most of the defaults should suit you fine, and
   there are any number of online manuals on installing OpenBSD.

4. When the installed system boots, install wg(8) and wg-quick(8) as
   root:

    # pkg_add wireguard-tools

5. Now you can use wg(8) and wg-quick(8), in addition to ifconfig(8).


Sidenote) Updating wireguard-go scripts to use the new wg(4) kernel
          driver

If you've already been using WireGuard with OpenBSD, it's via
wireguard-go.  The big recent news is that a new native WireGuard
implementation, wg(4), is now baked into the OpenBSD kernel, and
userland utilities like ifconfig(8) and tcpdump(8) support it too. From
a tooling perspective, however, very little should change: recent
versions of wg(8) and wg-quick(8) support WireGuard using the exact same
semantics as before, with these two exceptions:

1. Instead of running `wireguard-go tun0` to create a tunnel manually,
   you now run `ifconfig wg0 create`.

2. Instead of referring to the WireGuard interface as "tunX", it's now
   "wgX".

Other than those two things, all scripts and commands should behave
identically.


Please let us know if you run into any bugs or other headaches. Thanks
in advance for your testing and feedback.

Enjoy!
Jason

             reply	other threads:[~2020-06-24  6:07 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-24  6:07 Jason A. Donenfeld [this message]
2020-06-25  4:48 ` johnw

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200624060722.GA686091@zx2c4.com \
    --to=jason@zx2c4.com \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).