Wireguard VPN setup

[solene]

@phuc

Turned out the Wireguard server I was connecting to was the issue. I tried a different 1 but that did not work either. Well a few hours later and per some blood and tears, I decided to use a another server from Mullvad and lo and behold, that 1 works.

this is weird though

[solene]

Debugging happened in private, it seemed to be a Mullvad issue

[Cracked_Tessaract]

Was there a technical solution beyond “pick a different server”? The troubleshooting steps might be helpful for other who has this issue.

Great job @solene!

[phuc]

@solene had me check the output of systemd-resolve and the output of /etc/resolv.conf to check the DNS. I also restarted systemctl restart systemd-resolved.

In the end, I made a new fedora41 appvm @Cracked_Tessaract

Copied a completely different wireguard .conf over and ran nmcli connection import type wireguard file vpn.conf per solenes guide.

curl https://am.i.mullvad.net/connected returns successful connection. there appear to be 2 servers in my region affected with DNS issues. never had issues with mullvad before…

[Axel]

I was able to make my wireguard vm disposable like sys-net or at least I think I did, is that something someone else has already done or should I try and post about how I did it? If I should post about it, should it just be a reply to this post or a new one all together?

[solene]

This kind of operation should be straightforward or common enough that it should be documented separately if it’s not already in the documentation.

But if you really want to, you can edit the first post and add an extra section at the end about making the VPN from a disposable

[Axel]

Got it, I’ll write up how I did it soon in its own post.

[qubesfan35267]

Does anyone know why the “random connect to VPN at startup” sometimes work and at other times does not work or does work delayed?

Wireguard VPN setup

Good news, with fedora-38 the network manager supports Wireguard out of the box! The only thing required are extra firewall rules in the VPN qube, as explained in the community documentation about VPN. What you’ll need This guide assumes you are using a VPN service that has wireguard support, most of them do, but you can also add your own if you have a server. ProtonVPN has a free plan, it has limits but gives you a fully working VPN and they support WireGuard. This pro…

[barto]

@qubesfan35267

sometimes work and at other times does not work or does work delayed?

What do you mean, exactly? It works for me every day.

EDIT: I do have a “sleep 1” before and between the two lines in @solene’s post.
EDIT2: and you have to disable auto-connection for ALL tunnels

[solene]

if the qube can not reach the Internet when it runs this piece of code, the VPN will try to establish and hang. This may happen if it automatically start at boot and you need to type a WiFi password.

[qubesfan35267]

sometimes it is connecting right away…sometimes it is connecting with a delay of up to several minutes…sometimes it never connects…

Solene´s input might be connected to this behavior as well. Maybe I can work it with your “sleep” command…

Thank you for the quick reply you two!

[qubesfan35267]

So the “sleep” command seems to help. Thanks again!

[MSQLI]

@phuc

https://am.i.mullvad.net/connected

resolve call failed: All attempts to contact name server or network failed

[qubemanager]

If I want to create a VPN qube without a specified DNS server (= I prefer to use my VPN’s DNS) but I also want to avoid any potential DNS leaks, how should I modify the guide? Should I just simply skip the last quoted step?

@solene

# Redirect all the DNS traffic to the preferred DNS server
DNS=9.9.9.9
nft add chain qubes nat { type nat hook prerouting priority dstnat\; }
nft add rule qubes nat iifname == "vif*" tcp dport 53 dnat "$DNS"
nft add rule qubes nat iifname == "vif*" udp dport 53 dnat "$DNS"

[Alethia]

Found out that this is because network manager is not yet initialized. If you add:

sleep 10
nmcli connection up [conf]

Then it works

[barto]

@Alethia

Then it works

The delay doesn’t have to be that long (at least in my experience) - “sleep 1” was enough, albeit twice… and with some commands run in between, which probably take 0.1 seconds too.
The idea is to pick a random tunnel at start, resulting in the following, in rc.local:

sleep 1
RVPN=$(nmcli connection show | awk '/wireguard/ {print $1}' | \
        sort -R | head -n 1)
date +'%Y%m%d %H:%M:%S: '"${RVPN}" >> /tmp/chosen
sleep 1
nmcli connection up "${RVPN}"

This works 100% on my machines.

[D2Xoi28]

I am using this setup with openvpn.
To be sure about it:
Endpoint in a Wireguard config is the same as remote in an openvpn config?

[barto]

@D2Xoi28

Endpoint in a Wireguard config is the same as remote in an openvpn config?

Yes

[solene]

I got something to work from a debian-12-minimal template, do you think I should update this guide in-place and replace the fedora based guide, or should I write a new guide?

Fedora based guides are annoying for network as there is a new version every 6 months, and there is a delay to get the latest fedora as a template.

[qubesfan35267]

Hi Solene, thank you for all your great contributions to the community. I already used this guide for my debian-12-minimal vpn configurations. Everything has been working fine so far. Or have I been missing something and it should not even have been working with debian?
I think you are right with your assessment that debian makes more sense compared to fedora due to the latter switching to a new version every six month. Just add your debian guide and when fedora gets obsolete kick it out…