- How To Install And Use Wireguard App On Mac Windows 10
- How To Install And Use Wireguard App On Mac High Sierra
WireGuard is a fast and modern VPN protocol.
The easiest way to use WireGuard is to install the Android app and add the.conf file to your phone. On your Mac, you need to install WireGuard using Homebrew ( brew install wireguard-tools ). Open a web browser and navigate to the WireGuard App store listing. Or search for 'wireguard' under apps and click get. Step 4.) After completing the install click the WireGuard icon in the top right and select 'Import tunnel(s) from file.' Step 5.) Locate the WireGuard config file that was downloaded in Step (2) and click the Import button. Wireguard: Tweaks for avoiding throttling; Mac: Discontinue Application Filter (for Mac OS Big S) 3.9.0.2161 2020-07-11. New network driver for Windows: improves speeds for OpenVPN, Wireguard, OpenWeb significantly (700+ mbit/sec) support for PPPoE connection on linux; compatibility with upcoming Mac OS 11 for OpenVPN/Wireguard.
It is a point-to-point VPN, which means it does not have a client-server architecture, but peers, and does not rely on a PKI, unlike OpenVPN. It is super simple to setup to connect multiple machines together.
WireGuard supports roaming, which means you can switch between network connections and not have to reconnect to your peers. On servers, it's rarely useful, but when one of the peer is a mobile client like a laptop or a smartphone, it's a life saver, because the usage of WireGuard is completely transparent.
I'm used to OpenVPN, I even maintain a quite popular script, but WireGuard is better in pretty much all aspects.
Edit: I made a wireguard-install script to automate the installation!
In this post, I will explain how I use WireGuard on my laptop and phone, which forward all their traffic to the server while having a dual-stack connectivity.
The setup is pretty simple : we have 2 peers, one server and one client. Connecting both in a private subnet is easy. The trick to make use of the VPN to forward all of the client's traffic trough the server is to:
- Make the client's WireGuard interface its gateway (default route)
- Enable IP routing on the server
- Enable NAT between the WireGuard interface and public interface on the server
We will see how to add multiple clients at the end of the tutorial.
Ready?
Installing WireGuard
WireGuard comes in two parts: the tools, which will allow us to manage the peers and interfaces, and the Linux kernel module. On other platforms such as macOS, non-rooted Android and FreeBSD, the module is replaced by a userspace Go implementation.
FYI, it is planned for the WireGuard module to be integrated in the Linux kernel itself.
WireGuard can run nearly anywhere, all the installation notes are on the website.
I'm usually using Debian 9 or Ubuntu 18.04 on my servers. On Debian, you need to install it from the
unstable
repository and on Ubuntu from a PPA.I recommend the cheap $3.50 VM from Vultr. You should choose the location that is the closest to you. They provide IPv4, IPv6 and 500 GB for traffic per month.
As for my clients, I use the macOS Go client, the Arch Linux build from the community repo and the Android app.
Edit: I use the excellent GUI client for macOS now!
Configuring WireGuard
Here are the steps: Installer canon pixma ip1000 ubuntu download.
- Add the WireGuard interface on the server
- Add the WireGuard interface on the client
- Add the server as a peer on the client
- Add the client as a peer on the server
- Tune the configuration to make the client's traffic go trough the server
Configuring the WireGuard interface on the server
The configuration of WireGuard lives in
/etc/wireguard
.We'll call our interface
wg0
, so the config file will be /etc/wireguard/wg0.conf
.First, let's assign IP addresses from a private subnet:
Then, let's define the port WireGuard will be listening on:
Then, let's generate a private key. WireGuard uses simple Curve25519 public and private keys for cryptography between the peers.
Add it to the configuration:
Free download endnote x7 for mac. We're done!
You have two ways of starting the interface.
The manual way is with
wg-quick
:You can remove the interface with :
I recommend to use the systemd service, and to enable it:
Thus the interface will be automatically added at boot.
You can see the interface status and the public key with
wg show
or wg
:Configuring the WireGuard interface on the client
The configuration on the client is essentially the same.
Generate a private with
wg genkey
, and assign addresses:Put this in
/etc/wireguard/wg0.conf
, and start the interface :Here I'm using it on macOS so the interface name is
utun1
.Edit: I use the excellent GUI client for macOS now!
Configuring peers
Now that our interfaces are up, let's configure the peers. It will allow us to make our server and our client communicate.
On the client, add this :
Thanks to this, all the packets destined to
AllowedIPs
will be encrypted with PublicKey
and sent to Endpoint
.On the server, it's basically the same, with the client private IP and without the endpoint:
Wait.. No endpoint? But wasn't this supposed to be a point-to-point server?
Yes! But WireGuard supports roaming on both ends, and that's what allows us to have peers on the server without endpoints. As long as the peers (the clients) have the initial endpoint of the server, the server will know where so send the packets back, because the client's endpoints will be built dynamically.
From the WireGuard website about built-in roaming:
The client configuration contains an initial endpoint of its single peer (the server), so that it knows where to send encrypted data before it has received encrypted data. The server configuration doesn't have any initial endpoints of its peers (the clients). This is because the server discovers the endpoint of its peers by examining from where correctly authenticated data originates. If the server itself changes its own endpoint, and sends data to the clients, the clients will discover the new server endpoint and update the configuration just the same. Both client and server send encrypted data to the most recent IP endpoint for which they authentically decrypted data. Thus, there is full IP roaming on both ends.
I hope that makes sense. Keep in mind that WireGuard does not create a tunnel like OpenVPN does, but each packet is encapsulated right away.
Now, restart the WireGuard interface on the server and the client. The server does not know how to connect to the client, so the client should sent a packet first.
When restarting the interface, here on the client, we can see that WireGuard added a route:
We can see the new peer:
Let's try connecting to it:
Success!
On the server, you should see that data has been transmitted, and you should also see that a dynamic endpoint is shown:
The endpoint is the client's public IP address (the router's, if it is behing NAT), and, as we did not set a port nor an endpoint, a random port.
You can try to ping your client form the server, it should work (if the client's firewall is not blocking incoming connections).
Now that our two peers can communicate, let's make all of our client's traffic go trough the server. Download mp3 from youtube mac online.
Forward the traffic of the client trough the server
Enable routing on the server
First we need to enable IPv4 and IPv6 routing on the server, so that it can forward packets. Free download football manager 2017 mac.
Enable NAT on the server
We want to enable NAT between the server's public interface (
ens3
for me) and the wg0
interface.For that, we need two iptables commands:
The good news is that WireGuard can execute these for us, when the interface is brought up. To keep things clean, we want to remove them when the interface is brought down, so here is what you need to add to your
[Interface]
block on the server:How To Install And Use Wireguard App On Mac Windows 10
That's it!
Make the server the client's gateway
We can leverage the
AllowedIPs
option to override the default route on the client.Simply change the line to:
Restart the interface. Done, all of your client's packets are going trough the server!
Adding more clients
Adding more client is a bliss.
The third peer's configuration file will look like this:
On the server:
Note that the clients won't have the other clients as peer since they don't have valid initial endpoints (= a public IP address and open/forwarded port).
Tips and tricks
Verifying your connection
I usually use ipv6-test.com or ipleak.net to verify that my traffic is going trough the VPN, including IPv6.
Generate a public key from a private key
If you need to get the public key from a private key, you can pipe the private key to
wg pubkey
like:To get a pair in two files :
Or in your terminal output:
IPv4, IP6, dual stack..?
Here, we use a dual stack VPN, and the peers connect via IPv4.
I prefer the endpoints to be IPv4 since sometimes I am on IPv4-only network but you could connect to your server via IPv6.
The privates addresses could also be IPv4 only or IPv6 only, but dual stack is the best!
Changing the client's DNS resolvers
A little tip if you wan to change your client's DNS resolvers upon connection. There are many reason to do this:
- With the new routes, your local network won't be accessible. So if the DNS servers pushed by your DHCP server are in the local network, you're screwed. (Or you add the correct route with
PostUp
on the client) - You want to use a private/self-hosted DNS server, like Pi-hole
- You want to use a specific DNS server on a platform where you can't without a VPN, like Android
As for me, I currently put Adguard DNS everywhere. It's especially useful on my Android phone where I don't have an ad blocker.
To specify DNS servers, add the
DNS
option to the client's [Interface]
block:Bypassing blocked ports and filtered connections
WireGuard uses UDP. A well-known way to bypass blocked ports with OpenVPN is to use TCP on the port 443 to simulate HTTPS, but it's slower.
On both OpenVPN and WireGuard, I usually connect to the port 53 via UDP, since DNS is never blocked (unless your network does DPI..).
Transferring a configuration file easily to the Android app
I mean it's not that difficult to transfer a file from my computer to my Android phone, but there is an even better way.
On the Android App, you have 3 means to create an interface:
- Create from file or archive
- Create from a QR Code
- Create from scratch
It's super easy to generate a QR Code on your computer using qrencode:
Scan the QR Code in your terminal with your phone, and you're done.
Configuration overview
It's been a long post, so let's see how our configuration files look by now.
Peer 1 (server)
Peer 2 (client 1)
Peer 3 (client 2)
Conclusion
WireGuard is super awesome and easy to setup.
Thanks to this, I can connect safely (encryption) from nearly anywhere (port 53), get IPv6 connection (dual-stack) while blocking ads (AdGuard) and having great speeds!
WireGuard is still being actively developed, and has received lots of support and donations. I have been using it for months to connect servers to each other (blog post incoming), and I never had any issue.
Enjoy!
Reading Time: 4minutesIn my blog post here I showed you how to setup and configure WireGuard VPN Server side. I that blog post I also tell you what WireGuard is and what the benefits are. If you want to know more about WireGuard or how to configure WireGuard VPN server, check my blog post here. In this blog post I will show you how to setup WireGuard client on Windows. The Windows installation package is the same for all current Windows operating systems including Windows Server.
Requirement for this blog: Setup WireGuard VPN server by me.
First we need to download WireGuard for Windows. The download is the same for server or client and can be downloaded from here. Choose the latest version under Windows:
The installation is very simple. Dubbleclick on the MSI package and WireGuard will install itself and start automatically:
The next part is to download the client configuration (wg0-client.conf) file from the DietPi server. You can do this using a program called WinSCP. You also need to install OpenSSH Server on DietPi for WinSCP to work. Installing OpenSSH on DietPi requires the same steps as WireGuard but instead search for OpenSSH and then select OpenSSH Server:
DietPi default comes with Dropbear SSH server which is a lightweight SSH server. The downside is that it does not support Secure Copy Protocol (SCP) and we need that to download our client configuration file. Just follow the steps on screen to install OpenSSH Server on DietPi. Then install WinSCP on your Windows 10 client and connect to your DietPi server with the following session settings:
You will get a prompt for a Unknown Certificate.Click on Yes to add it:
How To Install And Use Wireguard App On Mac High Sierra
Once WinSCP is connected to your DietPi server browse to the folder /etc/wireguard. Download the wg0-client.conf file to a location on your Windows 10 machine:
Go back to the WireGuard window and click on Import tunnel(s) from file to import the wg0-client.conf file:
Select the wg0-client.conf file:
Now you will see that WireGuard has created the tunnel on your Windows 10 machine at it is ready to connect. If you click on Activate it will connect the tunnel and you are good to go:
After connecting the tunnel you will see that all traffic from you Windows 10 client now goes trough your WireGuard server:
You can check the status of WireGuard on your DietPi with the following command:
You will see a screen like this showing the Windows 10 client connected:
That is basically it for running WireGuard client on Windows 10.
Performance tests
In the blog post where I talk about setting up WireGuard server I also said I would do performance tests. I am impressed with WireGuard and as I mentioned in my previous post I am running WireGuard server on a Raspberry Pi 3B:
Check out the load while copying a file over the WireGuard tunnel between my Windows 10 client and the WireGuard server:
It is pulling almost the maximum of 100Mbit without breaking a sweat. It is a beast :).
Related posts:
Vikash Jhagroe
Equipped with more than 10 years of experience working on applications and systems, Vikash is a master at connecting businesses with the tech that is right for them. He holds multiple Citrix certifications (CCP-M, CCP-N, CCE-V), he is a VMware Certified Professional, and his other areas of expertise include VDI, Microsoft, Enterprise Mobility, and corresponding solutions. He currently works as a senior consultant for a systems integrator in the Netherlands and operates his own blog at Vikash.nl. He is passionate about computers and computer systems, and he is committed to serving his clients well.