{"id":307,"date":"2020-10-08T23:03:00","date_gmt":"2020-10-08T23:03:00","guid":{"rendered":"https:\/\/lab.rapternet.us\/?p=307"},"modified":"2023-09-15T15:45:21","modified_gmt":"2023-09-15T20:45:21","slug":"wireguard-on-unifi-usg","status":"publish","type":"post","link":"https:\/\/lab.rapternet.us\/?p=307","title":{"rendered":"WireGuard on Unifi USG"},"content":{"rendered":"\n<p>I have been looking around for a good VPN solution to use while traveling recently. I have a few services running at home, that I really don&#8217;t want on the internet (OctoPrint, general ssh access etc), but I want to use remotely. I also want a way to secure my connection when I don&#8217;t trust the network I&#8217;m connecting through.<\/p>\n\n\n\n<p>I had previously set up a L2TP Remote user VPN in the UniFi controller, but it had a few issues.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Instability on android (the VPN wouldn&#8217;t even show as &#8216;disconnected&#8217;, it would simply stop)<\/li>\n\n\n\n<li>Issues when connecting to it from ipv6 cell carriers<\/li>\n<\/ul>\n\n\n\n<p>I had heard of Wireguard a while ago and have been keeping track of development and their status on integrating with the Linux kernel. It turns out some kind soul has created a deb package to install WireGuard on Vyatta (which is what the USG is based on).<\/p>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\">Installation<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Pick up the correct .deb from&nbsp;<a href=\"https:\/\/github.com\/Lochnair\/vyatta-wireguard\/releases\">here<\/a>\n<ul class=\"wp-block-list\">\n<li><span style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\"><code>curl -sL https:\/\/github.com\/WireGuard\/wireguard-vyatta-ubnt\/releases\/download\/&lt;version>\/wireguard-&lt;board>-&lt;version>.deb -o wireguard-&lt;board>-&lt;version>.deb<\/code>\u00a0<\/span>worked for me<\/li>\n\n\n\n<li>In my case, the command was\u00a0<span style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\"><code>curl -sL https:\/\/github.com\/WireGuard\/wireguard-vyatta-ubnt\/releases\/download\/1.0.20220627-1\/ugw4-v1-v1.0.20220627-v1.0.20210914.deb -o wireguard-ugw4-0.0.20191012-1.deb<\/code>\u00a0<\/span>for my USG pro 4<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><span style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\"><code>sudo dpkg -i wireguard-&lt;board>-&lt;version>-1.deb<\/code>\u00a0<\/span>to install the package<\/li>\n\n\n\n<li><span style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\"><code>sudo -i<\/code>\u00a0<\/span>to make everything easier<\/li>\n\n\n\n<li><span style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\"><code>cd \/config\/auth<\/code>\u00a0<\/span>for the location to put the wireguard configuration<\/li>\n\n\n\n<li><span style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\"><code>umask 077 &amp;&amp; mkdir wireguard &amp;&amp; cd wireguard<\/code>\u00a0<\/span>for the server keys<\/li>\n\n\n\n<li><span style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\"><code>wg genkey | tee wg_private.key | wg pubkey > wg_public.key<\/code>\u00a0<\/span>to create server keys<\/li>\n\n\n\n<li><span style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-luminous-vivid-amber-color\"><code>wg genkey | tee client1_private.key | wg pubkey > client1_public.key<\/code>\u00a0<\/span>to create the first client keys.<\/li>\n\n\n\n<li>You will need one of these keys for each client connecting to the VPN<\/li>\n\n\n\n<li>Then we move over to the UniFi controller to create the config for the VPN<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">config.gateway.json<\/h2>\n\n\n\n<p>UniFi gateways are pretty similar to EdgeRouter products from Ubiquiti, with a crucial difference. Any config changes done from the CLI are wiped out on reboots, or any config changes from the controller. the UniFi Controller is nice, but does not support the full range of EdgeOS features that we can use.<\/p>\n\n\n\n<p>Thankfully there is a solution &#8211; config.gateway.json. This file is layered over the base config that gets generated by UniFi, and allows much more control of a USG.<\/p>\n\n\n\n<p>I created this file in my UniFi controller, which for me, on Ubuntu the right location is:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">\/usr\/lib\/unifi\/data\/sites\/&lt;site-id&gt;\/config.gateway.json<\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">    {\n    \"firewall\": {\n        \"group\": {\n            \"network-group\": {\n                \"remote_user_vpn_network\": {\n                    \"description\": \"Remote User VPN subnets\",\n                    \"network\": [\n                        \"10.255.252.0\/24\"\n                    ]\n                }\n            }\n        }\n    },\n    \"interfaces\": {\n        \"wireguard\": {\n            \"wg0\": {\n                \"description\": \"VPN for remote clients\",\n                \"address\": [\n                    \"10.255.252.1\/24\"\n                ],\n                \"firewall\": {\n                    \"in\": {\n                        \"name\": \"LAN_IN\"\n                    },\n                    \"local\": {\n                        \"name\": \"LAN_LOCAL\"\n                    },\n                    \"out\": {\n                        \"name\": \"LAN_OUT\"\n                    }\n                },\n                \"listen-port\": \"443\",\n                \"mtu\": \"1352\",\n                \"peer\": [\n                    {\n                        \"&lt;content of client1_public.key&gt;\": {\n                            \"allowed-ips\":\n                            [\n                                \"10.255.252.2\/32\"\n                            ],\n                            \"persistent-keepalive\": 60\n                        }\n                    }\n                ],\n                \"private-key\": \"\/config\/auth\/wireguard\/wg_private.key\",\n                \"route-allowed-ips\": \"true\"\n            }\n        }\n    }\n    }<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Client Configs<\/h2>\n\n\n\n<p>Next up &#8211; lets add some client configs. First device I wanted to add (as I was at home, and wanted to make sure this worked from outside the network, and is the main device I seem to want remote access from) is my Android phone.<\/p>\n\n\n\n<p>So, I created the following config on the unifi controller:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">    [Interface]\n    PrivateKey = &lt;content of client1_private.key&gt;\n    Address = 10.255.252.2\/24\n    DNS = &lt;internal DNS Server&gt;\n    \n    [Peer]\n    PublicKey = &lt;content of wg_public.key&gt;\n    Endpoint = &lt;external-fqdn&gt;:443\n    AllowedIPs = &lt;local subnets&gt;, 10.255.252.0\/24<\/pre>\n\n\n\n<p>I could then use the following:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">qrencode -t ansiutf8 &lt; wireguard.conf<\/pre>\n\n\n\n<p>This printed a qrcode on my console that I could import the config into the&nbsp;<a href=\"https:\/\/f-droid.org\/en\/packages\/com.wireguard.android\/\">Android app<\/a>. qrencode is available on the ubuntu repo via:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">apt install qrencode<\/pre>\n\n\n\n<p>For additional clients, it is pretty easy as well, simply install wireguard-tools and then create a similar file. We have to re run the:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">wg genkey | tee client1_private.key | wg pubkey &gt; client1_public.key<\/pre>\n\n\n\n<p>and add an extra peer to the config.gateway.json file, for each new client, but that is all the config we need.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Starting it all up<\/h2>\n\n\n\n<p>You will also have to allow udp\/443 to pass through the firewall. I created a rule in the GUI that allows udp\/443 on the WAN_LOCAL group.<\/p>\n\n\n\n<p>Now, to force the provisioning for the USG, just go to your unifi controller, then find the device. In the settings (the cog icon) for the device find the following section:<\/p>\n\n\n\n<p>and trigger a force provision.<\/p>\n\n\n\n<p>Then when it is deployed, you can start the tunnel on your end device!<\/p>\n\n\n\n<p>To check if the wireguard service is actually listening, you can run netstat and see if there is anything listening on udp\/443<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">    root@edge:~# netstat -npl | grep 443 | grep udp\n    udp        0      0 0.0.0.0:443                 0.0.0.0:*                           -\n    udp6       0      0 :::443                  :::*                                -<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Update<\/h2>\n\n\n\n<p>Force provision is no longer available in the Unifi Controller WebUI, i suggest changing your firewall&#8217;s name to something different (I use &#8220;firewalll&#8221; with a third L), and then save the settings. This will get the firewall to provision again.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I have been looking around for a good VPN solution to use while traveling recently. I have a few services running at home, that I really don&#8217;t want on the internet (OctoPrint, general ssh access etc), but I want to use remotely. I also want a way to secure my connection when I don&#8217;t trust &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/lab.rapternet.us\/?p=307\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;WireGuard on Unifi USG&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[35,36],"class_list":["post-307","post","type-post","status-publish","format-standard","hentry","category-how-to","tag-unifi","tag-wireguard"],"_links":{"self":[{"href":"https:\/\/lab.rapternet.us\/index.php?rest_route=\/wp\/v2\/posts\/307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lab.rapternet.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lab.rapternet.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lab.rapternet.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lab.rapternet.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=307"}],"version-history":[{"count":9,"href":"https:\/\/lab.rapternet.us\/index.php?rest_route=\/wp\/v2\/posts\/307\/revisions"}],"predecessor-version":[{"id":3361,"href":"https:\/\/lab.rapternet.us\/index.php?rest_route=\/wp\/v2\/posts\/307\/revisions\/3361"}],"wp:attachment":[{"href":"https:\/\/lab.rapternet.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lab.rapternet.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lab.rapternet.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}