Martijn van Wely <[email protected]> writes:
> I'm trying to add a NetBSD device to my wireguard network.
Note that NetBSD does not have wireguard(tm) but it has wg which is
compatible.
Note that NetBSD 10 and later have wg(4) in the kernel, and on 9 there
is some userland tools instead. My advice, for just about any question,
is make sure you are on 10 or an RC of 11.
> Since the wireguard 'server' peer is in a homenetwork, I've configured
> it to be reachable through duckdns.
What does that mean? I would expect:
some domain name e.g. foo.duckdns.com resolves to your public IP
address
you have configured port 51280 on your router to forward to the wg
machine
Is that right, or if not ??
> On Debian Linux I would have a /etc/wireguard/wg0.conf like this for
> one of the peers connecting to the server:
>
> [Interface]
> PrivateKey = [this peer's private key]
> Address = [this peer's ip adress]
>
> [Peer]
> PublicKey = [server's public key]
> PresharedKey = [a preshared key]
> AllowedIPs = [the ip range]
> Endpoint = [the duckdns url]:[listening port]
URL? What does that look like? NetBSD wg wants endpoint to look like
"IP-address:port". See wgconfig(8). wgconfig might take a name and do
a lookup. It might not. See the sources for that, or try it.
> And then you can activate it by running wg-quick wg0 up (or via the
> init system: systemctl start wg-quick@wg0).
>
> I noticed that wg-quick isn't available after installing
> wireguard-tools from pkgsrc (I guess because NetBSD's networking works
> differently from most Linux distros?).
Yes, networking was added to BSD quite a few years before Linux existed,
and Linux has new/different interfaces for a lot of things. The various
BSDs are mostly similar, but new things like wg surely differ.
I suppose one could make wg-quick use ifconfig/wgconfig. I have no idea
if anyone has tried or is motivated.
> But after some googling I've found some examples of setting it up via
> an ifconfig.if file with a bunch of calls to wgconfig.
> Since the command-line arguments for wgconfig map pretty well on to
> the lines in the wg0.conf I would normally write, I wrote this in
> /etc/ifconfig.wg0:
I think you absorbed this but lines with ! if /etc/ifconfig.foo0 are
exactly commands that are run at network configuration time. Lines
without ! are arguments to an invocation of ifconfig foo0.
You may or may not need to "!ifconfig wg0 create" first.
> [the selected ip/range within the wg-network]
> !wgconfig ${int} set private-key /etc/wireguard/private.key
> !wgconfig ${int} add peer wgserver $(cat /etc/wireguard/public.key)
> --preshared-key=/etc/wireguard/preshared.key --allowed-ips=[the
> wg-network's ip-range] --endpoint=[the duckdns url]:[listening port]
> up
Here I think "the duckdns url" is probably trouble.
> (also for context, yes they keys are stored as separate files in
> /etc/wireguard. They're owned by root:wheel with chmod 600 permission
> bits).
Sure, but I would suggest naming them somehow with your local hostname
and the servers, so that as you make things more complicated it will be
easier to follow.
> When I restart the network (by calling doas sh /etc/rc.d/network
> restart) I get the following error message:
> wg0wgconfig: getaddrinfo: hostname or servname not provided or not known.
I would suggest running the commands one at a time by cutting and
pasting, so you can understand more clearly what's going wrong.
> getaddrinfo [duckdns url] does work though, but maybe there's a
> problem with the fact that --endpoint is provided with a url:port
> instead of a ip:port (the man page does specify ip:port)?
I would expect this not to work.
> getaddrinfo with [duckdns url]:[listening port] fails.
> I've also tried quoting various part in the url and port in case it's
> a shell parsing problem, but that didn't help either.
I would hope that the hostname (not url) has just letters/numbers/period.
> Anyhow, does anyone know how to configure NetBSD as a wireguard peer
> when the other peer is behind a ddns url?
I would suggest skipping ifconfig.wg0 and writing a script and calling
the script from rc.local. In the script, use getaddrinfo/host/dig or
whatever and then grep/awk/sed/etc. to extract the IP address.
> Also: I am relatively experienced with Linux but new to NetBSD, so am
> I completely off base in how I should configure wireguard here in the
> first place?
You are not completely off base. You're quite close, except:
you are saying "duckdns url" but I think you mean "hostname"
the man page says IP address. Believe it, until you experiment and/or
read the source code. It's in the procedure handle_option_endpoint.
It looks to me like addresses only.
I have configured NetBSD as a wg server, and configured macOS, AOSP-ish,
and iOS clients.
A hint is that in Linux ethernets tend to be eth0. In BSD, interfaces
are named for the hardware type, and there's no assumption that there is
a primary ethernet eth0. This may be less true in Linux now.
> Also also, I'm new to mailing lists, so please say if I'm breaking
> some kind of etiquette or formatting rule.
Welcome to NetBSD, and you are doing great!
The basic etiquette guidelines are (IMHO of course):
- Don't post LLM output, and don't ask humans to debug or enhance LLM
output as in ("I got AI advice to do X, but what should I do next").
- Write to one list only; pick the best one.
- When replying to someone helping you, keep the reply on list.
- Don't reply to a message to start a new topic.
- Send plain text messages.
- When replying, don't top post, and trim text except when it's needed
for context for something you are saying.
- Quote properly; don't tell people that your text is in green or some
other HTMLism.
- If you are sending logs or some other machine output, don't wrap it.
If your MUA can't handle that, attach a text file. (Wrapped logs
are very hard to read.)
Your first message was 100% compliant. "netbsd-users@" is exactly the
right list.
