Introduction
WireGuard is a simple and fast modern VPN protocol. It aims to be less complicated than IPSec, working more like ssh with private and public keys. It has fewer lines of code and is more easily audited than other VPN protocols. Initially released for the Linux kernel, it is now cross-platform and widely deployable.
Step 1 - Installation
Install the os-wireguard plugin in System › Firmware › Plugins, refresh the GUI and you will soon find VPN › WireGuard.
Step 2a - Setup WireGuard Instance on Ixolate Site A
Go to tab Instances and press + to create a new instance.
Enable the advanced mode toggle.
Enabled Checked Name wgopn-site-a Public Key Generate with “Generate new keypair” button Private Key Generates automatically Listen Port 51820 MTU 1420 (default) or 1412 if you use PPPoE Tunnel Address 10.2.2.1/24 Peers Populated in later step
Press Save and Apply.
Step 2b - Setup WireGuard Instance on Ixolate Site B
Go to tab Instance and press + to create a new instance.
Enable the advanced mode toggle.
Enabled Checked Name wgopn-site-b Public Key Generate with “Generate new keypair” button Private Key Generates automatically Listen Port 51820 MTU 1420 (default) or 1412 if you use PPPoE Tunnel Address 10.2.2.2/24 Peers Populated in later step
Press Save and Apply.
Step 3a - Setup WireGuard Peer on Ixolate Site A
Go to tab Peers and press + to create a new peer.
Enable the advanced mode toggle.
Enabled Checked Name wgopn-site-b Public Key Insert the public key of the instance from wgopn-site-b Shared Secret Leave empty Allowed IPs 10.2.2.2/32 192.168.0.0/24 Endpoint Address 203.0.113.2 Endpoint Port 51820
Press Save and Apply.
Go to tab Instances and edit wgopn-site-a.
Peers wgopn-site-b
Press Save and Apply.
Step 3b - Setup WireGuard Peer on Ixolate Site B
Go to tab Peers and press + to create a new peer.
Enable the advanced mode toggle.
Enabled Checked Name wgopn-site-a Public Key Insert the public key of the instance from wgopn-site-a Shared Secret Leave empty Allowed IPs 10.2.2.1/32 172.16.0.0/24 Endpoint Address 203.0.113.1 Endpoint Port 51820
Press Save and Apply.
Go to tab Instances and edit wgopn-site-b.
Peers wgopn-site-a
Press Save and Apply.
Step 4a - Setup Firewall Site A
Go to Firewall › Rules › WAN add a new rule to allow incoming wireguard traffic from Site B.
Action Pass Interface WAN Direction In TCP/IP Version IPv4 Protocol UDP Source 203.0.113.2 Destination 203.0.113.1 Destination port 51820 Description Allow Wireguard from Site B to Site A
Press Save and Apply.
Go to Firewall › Rules [new] and add a match rule to prevent fragmentation of traffic going through the wireguard tunnel.
Action Match Quick Unchecked Interface WireGuard (Group) Direction Any Protocol any Source any Destination any Destination port any Description Wireguard MSS Clamping Site A Max mss 1380 or lower, subtract at least 40 bytes from the Wireguard MTU
Step 4b - Setup Firewall Site B
Go to Firewall › Rules › WAN add a new rule to allow incoming wireguard traffic from Site A.
Action Pass Interface WAN Direction In TCP/IP Version IPv4 Protocol UDP Source 203.0.113.1 Destination 203.0.113.2 Destination port 51820 Description Allow Wireguard from Site A to Site B
Press Save and Apply.
Go to Firewall › Rules [new] and add a match rule to prevent fragmentation of traffic going through the wireguard tunnel.
Action Match Quick Unchecked Interface WireGuard (Group) Direction Any Protocol any Source any Destination any Destination port any Description Wireguard MSS Clamping Site B Max mss 1380 or lower, subtract at least 40 bytes from the Wireguard MTU
Step 4c - Enable Wireguard on Site A and Site B
Go to VPN › WireGuard › Settings on both sites and Enable WireGuard
Press Apply and check VPN › WireGuard › Diagnostics. You should see Send and Received traffic and Handshake should be populated by a number. This happens as soon as the first traffic flows between the sites.
Your tunnel is now up and running.
Step 5 - Allow traffic between Site A LAN Net and Site B LAN Net
Go to Ixolate Site A Firewall › Rules › LAN A add a new rule.
Action Pass Interface LAN A Direction In TCP/IP Version IPv4 Protocol Any Source 172.16.0.0/24 Source port Any Destination 192.168.0.0/24 Destination port Any Description Allow LAN Site A to LAN Site B
Press Save and Apply.
Go to Ixolate Site A Firewall › Rules › Wireguard (Group) add a new rule.
Action Pass Interface Wireguard (Group) Direction In TCP/IP Version IPv4 Protocol Any Source 192.168.0.0/24 Source port Any Destination 172.16.0.0/24 Destination port Any Description Allow LAN Site B to LAN Site A
Press Save and Apply. Allowed IPs
Go to Ixolate Site B Firewall › Rules › LAN A add a new rule.
Action Pass Interface LAN B Direction In TCP/IP Version IPv4 Protocol Any Source 192.168.0.0/24 Source port Any Destination 172.16.0.0/24 Destination port Any Description Allow LAN Site B to LAN Site A
Press Save and Apply.
Go to Ixolate Site B Firewall › Rules › Wireguard (Group) add a new rule.
Action Pass Interface Wireguard (Group) Direction In TCP/IP Version IPv4 Protocol Any Source 172.16.0.0/24 Source port Any Destination 192.168.0.0/24 Destination port Any Description Allow LAN Site A to LAN Site B
Press Save and Apply.