OpenBSD WireGuard VPN Server

Server Setup & Configuration

After installing OpenBSD on your cloud based server and hardening SSH connectivity, run the following commands in order to patch the base system, update all installed packages, and reboot to apply changes and reload the kernel:

syspatch applies binary security patches to the OpenBSD base system.

pkg_add -Uu updates all installed third-party packages to their latest available versions.

reboot ensures kernel-level patches take effect and all services restart with the updated binaries.

Install wireguard-tools for key generation and tunnel management, and vim as a text editor for modifying configuration files:

Enable IPv4 and IPv6 forwarding at runtime so the server can route VPN traffic between interfaces. IPv6 forwarding is only needed if you plan to tunnel IPv6 traffic through the VPN:

The sysctl changes above are lost on reboot. To make IP forwarding persistent across reboots, append the values to /etc/sysctl.conf:

Create a directory to store WireGuard's configuration files and keys, then navigate into it. All server-side WireGuard files will be stored here:

To securely connect a client and a server using WireGuard, it is essential to generate a cryptographic key pair. These keys facilitate client authentication and the encryption-decryption process for data transmission.

The private and public key pairs are primarily for authentication purposes. When a client tries to establish a connection with the server, it authenticates itself by presenting its public key, which the server will be configured to recognize as trusted. The server also authenticates itself to the client by providing its public key. This mutual authentication confirms the identities of both parties, ensuring that communications are between legitimate endpoints.

After the authentication phase, WireGuard establishes an encrypted communication channel between the client and server. However, rather than using the initial public and private keys directly for encrypting all the data, WireGuard uses these keys to generate temporary session-specific keys. These session keys are dynamically generated for each connection session, enabling the encryption and decryption of data. The use of session keys means that even if a session key were compromised, it would not affect the security of past or future sessions, nor compromise the private keys used for authentication.

Generate the server's private key and derive the corresponding public key. The umask 0077 subshell ensures private.key is created with 600 permissions, preventing any user other than root from reading it:

Create a configuration file for the WireGuard wg0 tunnel interface:

Open wg0.conf using a text editor and add the following. The [Interface] section defines the server's private key and listen port. The [Peer] section defines the client that will be allowed to connect:

Change file permissions on wg0.conf and private.key to root-only access (600). Both files contain the server's private key, which must never be readable by other users:

Before configuring the firewall, verify your server's primary network interface name using ifconfig. On most cloud-hosted OpenBSD instances, the primary interface is vio0. If yours is different (e.g., em0, re0), substitute it in the firewall rules below.

Open the Packet Filter (PF) firewall configuration file:

Add the following three rules to the firewall configuration file:

The first rule allows all traffic on the WireGuard interface. The second rule allows incoming UDP traffic on the listen port configured in wg0.conf. The third rule translates outgoing traffic from the wg0 network to the primary interface vio0 via NAT. If your primary interface is different from vio0, replace it accordingly.

Reload the PF firewall with the newly added rules:

Open the vio0 network configuration file:

Add the following lines to the /etc/hostname.vio0 file. This specifies the private IP address range and subnet, activates the vio0 interface, and applies the WireGuard configuration from wg0.conf on boot:

Client Configuration

With the server configured, the next step is setting up WireGuard on the client device. This involves installing the WireGuard tools, generating a client key pair for authentication, creating a tunnel configuration file, and then updating the server's wg0.conf with the client's public key. The steps below are performed on a Debian system but apply to most Linux distributions with minor differences in package manager commands.

Install wireguard-tools on the client device. This package provides the wg and wg-quick utilities needed to generate keys and manage WireGuard tunnels:

Create the WireGuard configuration directory and navigate into it. This is where the client's keys and tunnel configuration will be stored:

Generate the client's private key and derive the corresponding public key. As with the server, the umask 0077 subshell ensures private.key is created with restricted permissions so only root can read it:

Create a configuration file for the client's WireGuard wg0 tunnel interface:

Open wg0.conf with a text editor and add the following. The [Interface] section defines the client's private key and tunnel address. The [Peer] section points to the server's public key and endpoint. Adjust the address if using a different private IP configuration:

Change file permissions on both files to root-only access (600). The config file contains the client's private key in plaintext, so it needs the same protection as private.key itself:

Final Steps

Before starting the tunnel, copy the client's public key (from /etc/wireguard/public.key on the client) and paste it into the server's wg0.conf under the [Peer] section's PublicKey field. Likewise, the server's public key should already be in the client's wg0.conf under its [Peer] section. Below is an example of what completed configurations look like for both sides:

OpenBSD Server:

Debian Client:

With both configuration files in place, bring up the WireGuard tunnel on the server. The netstart script reads /etc/hostname.wg0 to create the wg0 interface and apply the WireGuard configuration:

On the client, use wg-quick to bring up the tunnel. This sets the interface address, configures routing for the AllowedIPs ranges, and establishes the encrypted connection to the server:

Verify the tunnel is working by checking your public IP address. If the VPN is active and configured correctly, this command should return the IP address of your OpenBSD server instead of your client's normal public IP:

To stop a VPN connection on a client you can run:

To make things slightly more efficient I wrote a script that can be used to start and stop the VPN connection with ./wg.sh start and ./wg.sh stop. Here is a link to the source code on GitHub: wg.sh