Wireguard VPN setup

Community Guides
55

I added a snippet to solve MTU problems with wg tunnels. I just got an issue loading www.duckduckgo.com (and only this server) when using the VPN. A solution was to reduce the MTU of eth0 in the qubes using the VPN, but a better alternative is to add a firewall rule to force the MTU to be smaller. (I found the fix as part of my job at ivpn)

1 Like
56

I’m having some issues connecting to protonvpn’s wireguard servers. Their configuration file provides a private key value of ***** and my fedora template is giving me the error “Key is not of the correct length or format” when I try to connect to it. They do provide a public key.

I don’t know enough about this to know for sure if this is a protonvpn issue or something else.

57

I don’t understand why you’re talking about the template. The template is just here to install wireguard (if it is not install) then, It’s all happening in the sys-vpn.
You have the public key directly in the config file and DON’T touch it.
Like @solene say, in sys-vpn, just open a terminal where you have your vpn.conf file, then run the command:

nmcli connection import type wireguard file vpn.conf

It’s just what you have to do :slight_smile:

It is not just a protonvpn issue, i do the same thing with riseup vpn. All is allright…

58

Is it at all possible to accomplish this with Fedora 38 minimal 32 bit? I have very limited resources (only 16 GB ram) so every MB counts.

59

I don’t think 32 bits templates are provided. I have a laptop with 8 GB of memory and I can definitely have a working VPN setup though :wink:

60

If wireguard is used, it will not be possible to connect to tor, is there any way to use wireguard in conjunction with tor?

61

You can proxy udp over tcp.
For example this:

1 Like
62

Can someone explain to me what this does? 9.9.9.9 is quad9 DNS server, does that mean that the DNS requests will be handled outside of VPN if I add this line?

63

The Qubes OS is using “virtual” DNS servers 10.139.1.1/10.139.1.2 for the qubes and the requests to these addresses are redirected from netvm to its next netvm using DNAT firewall rules like this:

$ sudo nft list chain ip qubes dnat-dns
table ip qubes {
        chain dnat-dns {
                type nat hook prerouting priority dstnat; policy accept;
                ip daddr 10.139.1.1 udp dport 53 dnat to 10.139.1.1
                ip daddr 10.139.1.1 tcp dport 53 dnat to 10.139.1.1
                ip daddr 10.139.1.2 udp dport 53 dnat to 10.139.1.2
                ip daddr 10.139.1.2 tcp dport 53 dnat to 10.139.1.2
        }
}

And when these DNS packets arrive to netvm that has netvm set to (none) then by default it’ll get this qubes real DNS servers (e.g. set by user in /etc/resolve.conf or using NetworkManager) and redirect all packets coming to virtual DNS server to the real ones like this:

table ip qubes {
	chain dnat-dns {
		type nat hook prerouting priority dstnat; policy accept;
		ip daddr 10.139.1.1 udp dport 53 dnat to 192.168.1.1
		ip daddr 10.139.1.1 tcp dport 53 dnat to 192.168.1.1
	}
}

And it you don’t redirect all the virtual DNS traffic to the real DNS server (be it 9.9.9.9 or the DNS provided by VPN server) in sys-vpn then this virtual DNS traffic will go through VPN to these “virtual” addresses and most probably DNS just won’t work since these addresses will be unreachable through VPN. This “virtual” DNS addresses leak could show VPN provider that you’re using Qubes OS.

1 Like
64

Sorry, I have very limited networking knowledge.
Why put 9.9.9.9 as the DNS provider? Wouldn’t that leak your real ip?

65

Because Quad is a DNS Resolver that is known and recognized for its reliability and have an excellent reputation. In addition, it is based in Switzerland. But you can use whatever dns you want.

For sure no, you’re using a vpn

66

The requests to Qubes OS “virtual” DNS from qubes connected to sys-vpn will be redirected to 9.9.9.9 over VPN connection and not to your clearnet. You can replace 9.9.9.9 to DNS server provided by your VPN.

67

Can you clarify what would happen if I’m not doing this step? What’s the danger exactly?

68

You may not have a working DNS, or it may not go through the VPN

69

@solene , perhaps i’ll be a good thing to have the hardening’s rules with nftables since 4.2 handles more than the nftables?

1 Like
70

Do I leave this as is, or do I need to put IP of the DNS provider?

I meant the last bit of the line above

71

You leave it as it is, you just change:
DNS=9.9.9.9 with DNS=*IP of the DNS provider*

72

Thank you for help. This is very confusing for me, as I’m just used to connecting to a VPN server via GUI and let the VPN do it’s thing in the background.

1 Like
73

Can I use this config for openvpn aswell?

74

yes

1 Like