Help with setting up wireguard for a kubuntu VPN client (Linux)

jimbou

Hello,

When searching for help about wireguard, the search engine pointed me to this forum. I hope it did well. Otherwise, I am sorry and any administrator can feel free to eject me from here.

I am trying to configure a VPN client under kubuntu. It is quite easy with Windows, and it works flawlessly. However, I am having very hard time with kubuntu, because the number of available parameters is huge (more than 20) and without explanations.

It appears that VPN connection with wireguard is much quicker and easier to establish. I could establish one between my kubuntu client and a wireguard server embedded in an internet box (a so called Freebox). The client side as well as the server side both see the VPN connection established.

But that wireguard connection serves for nothing. I cannot access any equipment on the remote network (I have tried to ping them on their local IPV4 address).

The ifconfig command on the client shows a wg2 network without IPV4, only an IPV6.

It seems that I am missing something, and misusing wireguard. Any help to have a functionnal VPN wireguard connection will be welcome.

luckman212

Let's start with some basic information, since "the search engine" pointed you here but you very well may be in the "wrong place".

Are you using pfSense? (if "no" then you're better off asking on r/WireGuard)
If you are, share screenshots of your pfSense WireGuard tunnel/peer config (black out any sensitive info e.g. public IP addresses and keys)
Paste the wg client config (.conf) from your kubuntu system (again, remove any public IPs or hostnames, and pub/priv keypairs)

A valid wireguard config is very simple, and would look something like this

[Interface]
PrivateKey = uNn+7lL+0yVRug44yCDNSuI6JNX5gTirTbqoEzzQtng=
Address = 192.168.2.2/32
DNS = 192.168.1.1

[Peer]
PublicKey = MsvC4zFTgvxOjfzUOjz20KeX2uIUryJKuFx9iRslBio=
AllowedIPs = 192.168.1.0/24, 192.168.2.0/24
Endpoint = 100.50.50.5:51820

The above config would:

attempt to establish a tunnel to 100.50.50.5 on UDP port 51820 (the default wg port btw)
assign your kubuntu box an IP of 192.168.2.2 inside the tunnel
grant you access to the 192.168.1.x and 192.168.2.x networks on the remote side
change your system's DNS server to 192.168.1.1

A couple of common reasons this config would NOT work:

your LAN subnet overlaps in any way with the Address / AllowedIPs from the wg config. So make sure your LAN is using 192.168.10.x or 10.0.0.x or something like that. This is critical.
there is no DNS server at 192.168.1.1, or it doesn't accept connections from 192.168.2.x (in that case, remove the DNS = line or set it to a public DNS server like 8.8.8.8)
your ISP or another firewall is blocking connections to UDP port 51820

giuliafw70

If wg2 comes up with only IPv6, I would check the client profile first. NetworkManager can show a WireGuard tunnel as connected even when the IPv4 Address was not imported or was left empty. The client still needs its own tunnel address, for example 10.x.x.2/32, and AllowedIPs has to include the remote LAN you want to reach, not only the peer address. After connecting, ip addr show wg2 should show that IPv4 and ip route get <one remote LAN IP> should choose wg2. If either one is missing, the handshake is up but routing is not.