# 🔑CyberSecurity | Configuring an overlay Wireguard 🗑️

Wireguard allows the creation of a quick overlay network in a basic hub and spoke configuration. Will setup a basic 3 node hub and spoke overlay.

Alpha - Server

Bravo - Client

Charlie - Hub

Install the wireguard software on the server, client and hub. The Windows software can be download from [here](https://www.wireguard.com/install/) and the linux software is available via apt. On debian buster you need to load wireguard from back-ports.

You need to enable IP forwarding on both Linux and Windows. On Windows go to the registry key HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters. If not already there, create a new REG\_DWORD value named IPEnableRouter. Set IPEnableRouter to 1 and reboot.

On linux add this file /etc/sysctl.d/10-custom-kernel-bbr.conf and reboot.

```plaintext
net.ipv4.ip_forward = 1
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
```

You can check that forwarding is enabled by using sudo sysctl net.ipv4.ip\_forward and verifying that the result returns a 1.

Next you need to create the keys on the hub which is a Linux Debian deployment.

```plaintext
$ wg genkey > endpoint-a.key
$ wg pubkey < endpoint-a.key > endpoint-a.pub
$ wg genkey > endpoint-b.key
$ wg pubkey < endpoint-b.key > endpoint-b.pub
$ wg genkey > endpoint-c.key
$ wg pubkey < endpoint-c.key > endpoint-c.pub
```

There are now private and public keys you can use in the configuration files.

Configuration for hub Charlie:

```plaintext
# /etc/wireguard/wg0.conf

# local settings for Charlie
[Interface]
PrivateKey = Charlie private key
Address = 100.64.0.254/32
ListenPort = 51820

# remote settings for Aplha
[Peer]
PublicKey = Alpha public key
AllowedIPs = 100.64.0.1/32,192.168.1.0/24

# remote settings for Bravo
[Peer]
PublicKey = Bravo public key
AllowedIPs = 100.64.0.2/32,192.168.4.0/24
```

Configuration for server Alpha which has a local subnet of 192.168.1.0/24:

```plaintext
# /etc/wireguard/wg0.conf

# local settings for Alpha
[Interface]
PrivateKey = Alpha private key
Address = 100.64.0.1/32

# remote settings for Charlie
[Peer]
PublicKey = Charlie public key
EndPoint = Charlie:51820
AllowedIPs = 100.64.0.0/24,192.168.4.0/24
```

Configuration for client Bravo which has a local subnet of 192.168.4.0/24:

```plaintext
# /etc/wireguard/wg0.conf

# local settings for Bravo
[Interface]
PrivateKey = Bravo private key
Address = 100.64.0.2/32

# remote settings for Charlie
[Peer]
PublicKey = Charlie public key
Endpoint = Charlie:51820
AllowedIPs = 100.64.0.0/24,192.168.1.0/24
```

Ensure all services are activated on the various nodes and thats it.

```plaintext
sudo systemctl enable wg-quick@wg0.service
sudo systemctl start wg-quick@wg0.service
```

Note: When configuring a server on OpenWRT the subnet on the server address needs to be /24 and not /32.

\* Ronald works connecting Internet inhabiting things at [Nepean Networks](https://nepeannetworks.com).