blob: 324c31b1213ae10805a04b86e673ce45bc169ae2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
The report is public. To restrict access, add basic authentication in httpd.conf
or place the report behind your VPN (see WireGuard guide).
text
---
### 2. WireGuard VPN – Secure administrative access
```markdown
# WireGuard VPN on OpenBSD (server + client)
This guide creates a private tunnel so that SSH, Git, and other
administrative services are accessible only through the VPN.
Replace `your_server_pubkey`, `your_client_pubkey`, `your_server_ip` and
`your_client_ip_range` accordingly.
## Server side (OpenBSD)
### 1. Install WireGuard
```bash
doas pkg_add wireguard-tools
2. Generate keys
bash
doas mkdir -m 700 /etc/wireguard
doas wg genkey | doas tee /etc/wireguard/server.key | doas wg pubkey > /etc/wireguard/server.pub
doas chmod 600 /etc/wireguard/server.key
3. Create /etc/wireguard/wg0.conf
ini
[Interface]
PrivateKey = <contents of /etc/wireguard/server.key>
ListenPort = 51820
[Peer]
PublicKey = <your_client_pubkey>
AllowedIPs = 10.77.77.2/32
4. Start the interface
bash
doas ifconfig wg0 create
doas ifconfig wg0 10.77.77.1/24
doas wg setconf wg0 /etc/wireguard/wg0.conf
doas ifconfig wg0 up
5. Make it permanent
Add to /etc/rc.local (create if missing):
bash
doas tee -a /etc/rc.local << 'EOF'
#!/bin/sh
ifconfig wg0 create 2>/dev/null
ifconfig wg0 10.77.77.1/24
wg setconf wg0 /etc/wireguard/wg0.conf
ifconfig wg0 up
EOF
doas chmod +x /etc/rc.local
Client side (Linux / Gentoo)
1. Install WireGuard
bash
doas emerge --ask net-vpn/wireguard-tools # Gentoo
sudo apt install wireguard-tools # Debian/Ubuntu
2. Generate client keys
bash
wg genkey > client.key
wg pubkey < client.key > client.pub
chmod 600 client.key
3. Create /etc/wireguard/wg0.conf (client)
ini
[Interface]
Address = 10.77.77.2/24
PrivateKey = <contents of client.key>
[Peer]
PublicKey = <your_server_pubkey>
Endpoint = your_server_ip:51820
AllowedIPs = 10.77.77.0/24
PersistentKeepalive = 25
4. Start the tunnel
bash
doas wg-quick up wg0 # or sudo wg-quick up wg0
ping 10.77.77.1
Now all sensitive services can listen on 10.77.77.1 only.
text
---
|
