Wiregaurd tunnels - bullshark.win

The names are universal among Alpine Arch and Debain for I think all of these packages.

Installation

Wiregaurd configs go in /etc/wiregaurd.

Debian

apt update && apt upgrade
apt install wiregaurd-tools iptables ufw

Alpine

apk update && apk upgrade
apk add wiregaurd-tools iptables ufw

Tables

Commands

Command	action
`wg show`	Display all wireguard peers and interfaces + their status
`wg-quick up/down yay`	quickly puts up or down and interface, yay.conf in /etc/wireguard
`wg genkey`	gens priv key
`wg pubkey < priv.key`	gens pub key from priv key
`wg genpsk`	generates symmetrical preshared key used to encrypt the diffie hellman key exchange
ufw allow port/protocol	Allows a port or protocol
ufw enable\|disable	enables / disables ufw
ufw status	lists ufw rules
iptables -S FORWARD	show iptables forwarding rules
iptables -t nat -S POSTROUTING	show iptables NAT rules

Files

Purpose	Item	Place
Rules checked before action	rules.before	/etc/ufw/
Wireguard config	server.conf	/etc/wireguard/

UFW

Your port will be specified in the config file. Ensure you ufw allow your port.

systemctl enable --now ufw
ufw enable
ufw allow 51900/udp
ufw allow 22 <- On VPS
51900/udp whatever port you defined in /etc/wireguard/config.conf

NAT with wireguard

Through wireguard

Add under [INTERFACE] above the first peer
/etc/wireguard/server.conf

PostUp = iptables -A FORWARD -i server -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i server -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

/etc/sysctl.conf

net.ipv4.ip_forward = 1

Reload: sysctl -p /etc/sysctl.conf

Through UFW

Survives ufw reload

Add rules to files

/etc/ufw/rules.before

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.0.0.1/24 -o eth0 -j MASQUERADE
COMMIT
*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT
-A ufw-before-input -j ufw-not-local
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
COMMIT

/etc/default/ufw

IPV6=yes
DEFAULT_INPUT_POLICY="DROP"
DEFAULT_OUTPUT_POLICY="ACCEPT"
DEFAULT_FORWARD_POLICY="ACCEPT"
DEFAULT_APPLICATION_POLICY="SKIP"
MANAGE_BUILTINS=no
IPT_SYSCTL=/etc/ufw/sysctl.conf
IPT_MODULES=""

/etc/sysctl.conf

net.ipv4.ip_forward = 1

Reload: sysctl -p /etc/sysctl.conf

wireguard config

If you do everything above and it doesn’t work add MTU = 1280 under [INTERFACE] on both wireguard configs.

After applying changes to wireguard configs they do not apply until you up and down the interface:

wg-quick down server && wg-quick up server

Post up rules are not needed in server.conf if done through UFW

A few last informational nuggets

It is important to have PersistentKeepalive = 25 under [INTERFACE] of the LAN | Client | Side behind NAT, to the wireguard config.
To generate wireguard configurations you can use the generator I had deepseek make.
Replace 192.168.1.1 with your servers IP
Replace -peer 10 with however many peer configs you wish to generate.

./wgconf generate new -dest 192.168.1.1 -port 51900 -timeout 25 -peer 10

To securely move config files you have a few options:
A: Copy / paste with SSH
B: scp
C: Encrypty with age and move over cloud drive, git, or telnet.