VPS: SOCKS5 and Wireguard (20241012)

• Dockge in https://blg.gkr.one/20240706-dockge/

• cloudflared in https://blg.gkr.one/20240713-cloudflared_vps/

• VPS setup and ufw-docker in https://blg.gkr.one/20240616-u24_vps_hardening/

Preamble

SOCKS5

Wireguard

[Interface]
PrivateKey = <server-private-key>
Address = 10.8.0.1/24 
ListenPort = 51820
PostUp = <iptables rules>
PostDown = <iptables rules>

[Peer]
PublicKey = <peer1-public-key>
PreSharedKey = <peer1-server-pre-shared-key>
AllowedIPs = 10.8.0.2/32

[Interface]
PrivateKey = <peer1-private-key>
Address = 10.8.0.2/32

[Peer]
PublicKey = <server-public-key>
PreSharedKey = <peer1-server-pre-shared-key>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = <vps_ip>:<wireguard_port>

Tailscale

SOCKS5 via SSH: browser access

• In this setup we will use vps as our configured ssh-ready host, supporting ssh key login.

• a SOCK5 compatible proxy installed on your preferred browser.
• in the following we will use Foxy Proxy on a Firefox instance (list of compatible browser) and port 3128

ssh -N -D 3128 vps

wg-easy: peer-to-peer access

• vps as our configured ssh-ready host, supporting ssh key login.

• a CNAME set at the domain’s DNS to provide an easy name for our vps (ie go from vps12345-patlabor.myfavoritevps.datacenter.tld to vps.example.com

• ufw and ufw-docker enabled on the host as described in “Ubuntu 24.04 VPS Hardening”; we will block access to the WebUI but authorize access to the Wireguard port.

• cloudflared configured on the host, as described in “VPS: Cloudflare Zero Trust access to Web Applications”; we will only grant access to the WebUI using Cloudflare’s Zero Trust.

services:
  wg-easy:
    environment:
      - LANG=en
      - WG_HOST=vps.example.com # Adapt with the CNAME set at your DNS
      - PASSWORD_HASH=${PASSWORD_HASH} # set the secret 
      - WG_DEVICE=ens3 # adapt with the network interface of the NIC that will respond to the wireguard service
      - PORT=51821 # WebUI access (TCP) to be accessed with Cloudflare ZeroTrust
      - WG_PORT=51820 # Wireguard port (UDP) to be opened through ufw-docker
      - WG_DEFAULT_ADDRESS=10.10.10.x # Authorized subnet
      - WG_DEFAULT_DNS=1.1.1.1 # use Cloudflare's DNS
      - WG_MTU=1420
      - WG_ALLOWED_IPS=10.10.10.0/24 # default configuration is to only allow peers to communicate with one another
      - WG_PERSISTENT_KEEPALIVE=25 # Value in seconds to keep the "connection" open
      - UI_TRAFFIC_STATS=true # Enable detailed RX / TX client stats in Web UI 
      - UI_CHART_TYPE=2 # Area chart
      - UI_ENABLE_SORT_CLIENTS=true # Enable UI sort clients by name
    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    volumes:
      - ./etc_wireguard:/etc/wireguard
    ports:
      - 51820:51820/udp # if you changed WG_PORT, adapt here 
      - 51821:51821/tcp # if you changed PORT, adapt here
    restart: unless-stopped
    cap_add:
      - NET_ADMIN # grants elevated network-related privileges to the container
      - SYS_MODULE # allows the container to load and unload kernel modules
    sysctls:
      - net.ipv4.ip_forward=1 #  enables IP forwarding, ie to act as a router, forwarding IP packets from one network interface to another
      - net.ipv4.conf.all.src_valid_mark=1 # affects how the system handles packet routing and marking: it enables the kernel to consider the packet mark when making routing decisions
    labels:
      - com.centurylinklabs.watchtower.enable=true

• POSTROUTING is a chain in the NAT (Network Address Translation) table of iptables. It allows packets to be altered as they are leaving the firewall's external device.

• MASQUERADEis a type of NAT action that translates host IPs in a private network into a single IP address.

• FORWARD is a chain used for packets that are routed through the current host to allow traffic to pass between different network interfaces.

1. Configure the Cloudflare Dashboard to setup an email protected zero trust layer to access the WebUI (i.e. we are not exposing the WebUI directly). Please see "VPS: Cloudflare Zero Trust access to Web Applications” for instructions on this process. Our url will be https://wgz.example.com

2. Enable clients to connect to the UDP port of our newly created wg-easy docker container (do a docker ps to confirm the container’s name), using

sudo ufw-docker allow wg-easy 51820/udp

Adding peers

• On the left side (top to bottom):
• it is possible to modify the name of the peer.
• it is also possible to change the assigned IP such that the host matches the last digits of the system in your LAN for example. If you check the PostUp entry in the etc_wireguard/wg0.cong you should see iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o ens3 -j MASQUERADE. This rule sets up IP masquerading for all traffic coming from the 10.10.10.0/24 network and going out through the ens3 interface; as such only modify this value to be within that range.

• On the right side (left to right):
• the toggle enables or disables the peer in the wg0.conf file
• the QR code button will display a QR code that can be used to load the key on compatible clients.
• the download button will download the test peer configuration file.
• the delete button will remove test from the list of peers.

[Interface]
PrivateKey = <peer1privatekey>
Address = 10.10.10.2/24
DNS = 1.1.1.1
MTU = 1420

[Peer]
PublicKey = <serverpublickey>
PresharedKey = <peer1server-presharekey>
AllowedIPs = 10.10.10.0/24
PersistentKeepalive = 25
Endpoint = vps.example.com:51820

• the Interface section, defining the local peer (test), containing the PrivateKey of the peer, the assigned Address of this peer, the DNS and MTU as configured at compose.yaml time.

• the Peer section, defining the remote peer (ie our VPS), with its PublicKey, the PreSharedKey, the list of AllowedIPs (ie what subnets would go through this tunnel; here only other peers on the 10.10.10.0/24 can be reached, while an AllowedIPs of 0.0.0.0/0, ::/0 would redirect all traffic through the VPN tunnel), how often the peer verified communication with the server (PersistentKeepAlive, in seconds) and the Endpoint where the server is answering (here vps.example.com on port 51820, as defined in the compose.yaml file).

Client configuration

Wireguard App: compatible clients

Ubuntu Linux and Unraid

sudo apt install wireguard
sudo mkdir -p /etc/wireguard
sudo nano /etc/wireguard/wg0.conf
# place peer.conf content obtained from wg_easy, then save file
sudo wg-quick up wg0
# will return something similar to:
# [#] ip link add wg0 type wireguard
# [#] wg setconf wg0 /dev/fd/63
# [#] ip -4 address add 10.10.10.2/24 dev wg0
# [#] ip link set mtu 1420 up dev wg0
# [#] resolvconf -a wg0 -m 0 -x
# [#] ip -4 route add 10.10.10.0/24 dev wg0
ip -4 -brief a
# to obtain the list all network interfaces configured for IPv4 on the host
# a wg0 entry will be listed

Potential next steps…

• domain1: LAN only access (192.168.22.0/24)

• domain2: Tailscale access (100.64.0.0/10)

• domain3: wg_easy access (10.10.10.0/24)

Further reading

• Digital Ocean’s How To Route Web Traffic Securely Without a VPN Using a SOCKS Tunnel

• Digital Ocean’s How to Set Up Wireguard on Ubuntu 22.04

• Unofficial WireGuard Documentation

• WireGuard AllowedIPs Calculator

Revision History

• 20241012-0: Initial Release

• 20240921-0: Initial Draft