@mrjones Thanks, it looks very good. I'm about to add a few status commands, like sh wireguard wbN status and peer status and the such, so please leave this task still open. I stopped after 2 lines of writing wiki, the annoying google captchas wasted my time, so I stopped :).

@mrjones i whitelisted you on wiki
try again

@hagbard wiki tells me that my post is spam, so I am unable to save at the moment. https://wiki.vyos.net/index.php?title=Wireguard

Found a possible bug when you remove keppalive, the wg device show still as configured with keepalive, I have to check if that is actually true and if so I need to ping upstream and let them know.

T783 and making endpoint optional is currently reviewed by the maintainers.

@hagbard
Good. There is no urgency.

@vast-ast
Already fixed in my branch, since it's a minor change. I have the keepalive option on my plate as well as the show command. I was just on vacation for a week and didn't have much time to contribute. How urgent do you need persistent-keepalive?

@hagbard
This is not critical, but it would be convenient to save the tun interface without specifying a peer. Now validation does not allow this. One of the cases, when we prepared the server, and then we automate the addition and removal of the peer (my case), or we want to do this later for some other reason.

Let me know if you need any help with it or have any questions.
I'm going to change the endpoint parameter to an optional parameter.
https://www.wireguard.com/#conceptual-overview may help you as well.

https://github.com/vyos/vyos-wireguard is just copied, not forked. Anything else inside is/was unmodified. I can had 3 lines to have the module loaded at boot time, but in general I don't feel very happy with the package and it's maintenance.
How do you usually backport packages in general and track patches and the such?
Should it be re-debianized and produce the vyos-wireguard-tools etc. instead of wireguard-tools?
Who is maintaining it, like adding the patches, testing etc.?

Thx @vas-ast, it's not only when you run via NAT, it's in general if you act as the server. I'm going to fix that, that was the first implementation I was happy to have that release to the public. Your input is always valuable, so if you find more, please don't hesitate to report here.
Thanks again.

I would like to contribute

In T427#17621, @hagbard wrote:

All right pull request opened. I'm going to enhance a few parts, like the endpoint format check, show status etc., but as mentioned above I won't have much time next week and it seemed everyone needed it quickly.
I've rebuilt the iso, rebuilt vyos-1x and used the follwing config:

host01:

set interfaces wireguard wg01 address '10.2.2.1/24'
set interfaces wireguard wg01 description 'wg02-test'
set interfaces wireguard wg01 listen-port '12345'
set interfaces wireguard wg01 peer 7QQU75St+Kr4+B097E7qzMv0PbBtbvLCyGCpTwRxBEI= allowed-ips '10.1.1.0/24'
set interfaces wireguard wg01 peer 7QQU75St+Kr4+B097E7qzMv0PbBtbvLCyGCpTwRxBEI= endpoint '192.168.0.130:12345'
set protocols static interface-route 10.1.1.0/24 next-hop-interface wg01

host02:
set interfaces wireguard wg01 address '10.1.1.1/24'
set interfaces wireguard wg01 description 'wg01-test'
set interfaces wireguard wg01 listen-port '12345'
set interfaces wireguard wg01 peer z80pwzfFfwfte3p06iIVVBDPfUL+MSH0dL9I33nJzTo= allowed-ips '10.2.2.0/24'
set interfaces wireguard wg01 peer z80pwzfFfwfte3p06iIVVBDPfUL+MSH0dL9I33nJzTo= endpoint '192.168.0.113:12345'
set protocols static interface-route 10.2.2.0/24 next-hop-interface wg01

You'll need:
https://github.com/vyos/vyos-1x/pull/27/files
https://github.com/vyos/vyos-build/pull/22

and the config above. You can add multiple endpoints and peers to a wg device, or multiple wg devices with single or multiple peers. So far all working as long as you set your route. I did basic IPv6 tests as well, ss the main functionality should be working well.
I'm going to open a subtask for documentation, I need to create first an account for the wiki etc.

All right pull request opened. I'm going to enhance a few parts, like the endpoint format check, show status etc., but as mentioned above I won't have much time next week and it seemed everyone needed it quickly.
I've rebuilt the iso, rebuilt vyos-1x and used the follwing config:

Cool, Thanks!

@syncer he is following me anyway. I'm almost done, just need to implement the suggested changes from Daniil and Christian.

@hagbard just merge your changes and @UnicronNL can continue

@c-po thanks a lot, I was thinking first I have to add it to the rules and do it via configure, the control file is way easier of course. I'm off next week and try to enjoy summer before the rain comes, but try to get the first stages going.

Required packages should be added to this file: https://github.com/vyos/vyos-1x/blob/current/debian/control

@dmbaturin When I rebuild the iso, I'm currently using the ./configure switch you recently introduced to get the wireguard packages added. How am I supposed to to it for the pull request then? Where would I have to define the modules to load?

Thx guys, learned something new. will implement it that way.

Please put key generation as usual under run generate vpn (openvpn key generation uses the same subtree)

if the interface gets delete from the config, the wg device gets deleted from the OS and all its routes

This is exactly the reason why "set protocols static ..." commands use zebra instead of pushing routes directly to the kernel with iproute2. Zebra takes care of interfaces going up and down and reinstalls the routes when needed.

Should I place the key-pair generation under 'system wireguard' or 'system options wireguard'?

@dmbaturin thx for the input, I have added the route setup to the wireguard.py script, because if the interface gets delete from the config, the wg device gets deleted from the OS and all its routes. The config would still have then the routes in the effective config and when you reboot it tries to setup routes on a non existing interface.
The examples on the wireguard website, do it similar, after the tunnel is up, they add the routes. I also couldn't find anything in their code which adds automatically the routes for allowed-ips.

Now, is that suppose to happen automatically ( i can include it in the wireguard.py script), or is it supposed to be setup via 'set static proto ...'? What would be the better way?

If wireguard cannot create routes on its own, I believe we should leave route setup to the user. Doing it automatically when it's not actually supported is a very leaky abstraction.

pre-build pkgs:
https://github.com/hagbard-01/wireguard-pkgs

Hi Guys,

@Asteroza I can understand why. I never knew about it till I got the task here, digging into the documentation for a few days, I was quite impressed and thought, well let's test it first. It's an awesome way of implementing tunnels.

Apparently Linus loves Wireguard as well now.

@syncer I think by the end of this week I should have it fully working. Didn't have much time during the weekend to do anything since I was on-call. I read their paper they published, the technology is actually pretty cool.

@hagbard hey, let me know when it's ready, keen to test that
people keeping to tell that it works great

Sorry guys - the fix worked, but only for community strings that are network-specific. See new pull request for the non-specific network version as well.

Works now, though I need to discuss the pull requests with PPP maintainers.

Should be working now.

I believe I've fixed it, though feedback won't harm.

Found that already :)

This was solved in https://github.com/vyos/vyatta-cfg-dhcp-server/commit/7488d52ce2946a4eaa47b1d909970f24956529c7

In case anyone wants to follow the progress: https://github.com/hagbard-01/vyos-1x/tree/wireguard

Haha tnx!

Arghh, I had the rolling build from July 30th. Sorry for the noise, all working now.
Oh and you guys are really awesome.

image vyos-1.2.0-rolling+201807301123-amd64.iso

@hagbard and then install the packages on that. (download and install)

@hagbard you need latest rolling to get it up

@hagbard yea, it's more about share work and involves other people in collaboration :)
You also may want to join accel-ppp telegram channel tg://join?invite=DS6swRC3DvEWdNijTqaaeA

2312 open("/sys/module/wireguard/initstate", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
2312 stat("/sys/module/wireguard", 0x7ffeb8212c70) = -1 ENOENT (No such file or directory) <-----
2312 open("/lib/modules/4.14.26-amd64-vyos/extra/wireguard.ko", O_RDONLY|O_CLOEXEC) = 3
2312 fstat(3, {st_mode=S_IFREG|0644, st_size=342768, ...}) = 0
2312 mmap(NULL, 342768, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f0f94c3a000
2312 finit_module(3, "", 0) = -1 EINVAL (Invalid argument)
2312 write(2, "modprobe: ERROR: could not inser"..., 64) = 64

@UnicronNL module can't be loaded via modpprobe I get.

@syncer It doesn't really matter to me, I was just concerned that if you have pppoe-server running, you can't use gre tunnels (the kernel module can't be loaded anymore).

@dmbaturin No worries, I'm well aware of the new scheme. (will be a fresh and new implementation of the syntax).

@syncer he means the edgOs one :) package i build are only the wire guard tools and kernel module. Those packages are good.

What package do you refer?
Built by @UnicronNL or edgeos one?
If latest, than we just use it as reference for cli and need to migrate it to xml

@UnicronNL @hagbard Please do not use that package! I've inspected it, and it's below any reasonable standards!

@hagbard http://dev.packages.vyos.net/repositories/current/vyos/pool/main/w/wireguard/
here are the packages

@hagbard if you want you can do cli part and we can ask do other stuff @dmbaturin and/or @UnicronNL
it's up to you
thanks!

@hagbard not having GRE on PPPoE server not a problem
we still need to see how we handle this and bunch of other issues
but we definitely need BRAS functionality

@UnicronNL thx a lot for the packages, speeds my task up quite a bit.

@syncer I discovered a possible issue, accel-ppp is incompatible with the ip_gre driver, so using accel-ppp means you can't have gre tunnels anymore and vice versa. I'm not sure if accel-ppp is a good idea to integrate into vyos. Shall I continue with the packages or should we check if we can find anything compatible which doesn't interfere with router stuff. Not having gre is in my opinion a very significant issue.

@hagbard I have created the wireguard package https://github.com/vyos/vyos-wireguard

It will come in 2 parts, the ppp server as a package first and then the rewrite for its config, hard to estimate the time it will need, let me first package accel-ppp.