Wireguard Status App, QR-Code

[admins]

Hi all
I've tested the wireguard implementation of pfsense.
First of all, thx Jim for integrating it.

Feautre request:

1. I wan't to see which peers are connected with wireguard on the Dashboard
2. It would be nice if you create a qr code, so thats faster to configure a mobile device

Thx
admins

[Aerowinder]

@admins Totally agree on #2.

For #1, it's my understanding that this is not possible, as wg does not expose this information. WireGuard is not like other VPNs. It would be nice if you could at least see the last handshake on a connection, but same issue - wg does not expose that information at this time.

[jimp]

1 isn't possible yet as wg doesn't output any information of that kind.

2 is already on our radar for an export option, no ETA but soon.

[yon 0]

@jimp

QR code is need.

Can you refer to some functions in it?

https://github.com/k4yt3x/wg-meshconf

[jimp]

We already know how to generate the QR codes and have most of the code to do that, but we need all the other structure of an "export" package to generate the client configurations. Making the QR codes is super simple, it's just a QR code made from a string that is the entire client config file. We have a QR code library in the FreeRADIUS package that is easy to work with. It's the rest of the code to get it to that point with a user-friendly GUI that is necessary. It's not as easy as making a button to click, since the user may want to customize things like the address clients use to connect, what networks to route across the VPN, etc.

We are actively working on it already, just no ETA. Be patient.

[Lichtlos]

@jimp is this still on track for 2022?

[cmcdonald]

We are constantly exploring new features and capabilities for sure. Yes, these features are high on the list of things to build. There is some initial work on QR in the public GitHub repository for the WireGuard package. This is a high priority for me once we get 22.01 and 2.6.0 shipped here very soon. Stay tuned.

[a.dresner]

@cmcdonald Thank you for all your work, watching your YouTube videos has been very helpful. Look forward to seeing this come to fruition - any updates?

[galileofigaro99]

I'm also new here, but I wanted to chime in and say that I've used Wireguard in the past, and it's a pretty nifty implementation. Your feature request is a great idea, especially since it would make it easier to configure mobile devices.

[Lichtlos]

https://www.cyberciti.biz/faq/how-to-generate-wireguard-qr-code-on-linux-for-mobile/ this seems like a quick-win for easy QR-code generation

[slu]

I configured yesterday a WireGuard connection on the german FRITZ!Box with the qrcode, this was so easy and quick.
Hope we see the QR-Code feature also in pfSense ;)

[Cris70]

@jimp any news on the possibility to generate QR codes for quickly configuring WireGuard peers?

[netgate12345]

Hi Netgate team,

Last response on this topic was late 2021. This function does not seems to be high on the release priority list.
The Wireguard implementation in PFsense now is still "raw" (read: complex to the users) and cannot simply, securely and user-friendly be enrolled by (home/business) Pfsense users.

Some (friendly) considerations for the team of the problems:
1- How can we securely exchange the wireguard encryption keys, such as the Pre-shared Key and other keys, without a QR-code to all listed Wireguard peers/clients? Please help. The "netgate docs" do not help on this: https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/configure.html
2- Creating a new Peer Configuration and enrolling is now a lot of work and time consuming. Same problem exists when periodically renewing all of the Peer keys (1 per device) for the Peer configurations.

The rest of the world seems to accept QR-codes to securely enrol Wireguard VPN configurations. Even router brands such as Fritzbox... (see post above) have implemented this for the public to the supported devices. Why would Pfsense not accept this enrol standard and release this function for it's users? This also could be a huge opportunity for potential new Pfsense installs.

Hope to receive a reply from you that the QR-code functionality will be released soon to Pfsense users.
Thank you. Much appreciated your effort on this.

[Owen82]

@netgate12345 Agreed. I feel pfsense is sadly (very) behind the curve with this. Along with the lack of QR code functionality also adding/control of fw rules/nat/routes/MTU/MSS etc would be very welcome by everyone who is using this.

[jader]

I still needing this feature. How could I start to learn how to do a package for PFSENSE and I'll try to discovery how to do it.
I understand once that:
a) all info configurated on GUI interface can be recovered
b) there are several sites to create QRCODE from text file

would be easy to create basic QRCODE.
Advanced options would be phase 2!

Let's go create a v1 of QRCODE-WG package by ourselves.

Who wanna to create a GitHub project and start to moving ahead on these??

[jader]

Overview:

a) create screen with :
field to type IP interface WG
- how get latest one to add + 1c? where is stored?
- OneWord name to identify cliente

b) validate IP typed (do not exist, valid, inside WG interface range)

c) Use template file and replace data from step A to generate config-IP.file

d) convert config-IP.file to QRCODE
(verify how https://www.wireguardconfig.com/qrcode do it on client side)

e) save/show config-IP.file e show QRCODE on screen

f) (MAYBE) sent QRCODE by e-mail (if so... request it on step A)