Setting Up a Secure Proxy with WireGuard VPN

WireGuard VPN is a modern, high-performance VPN protocol designed to be simple and secure. In this tutorial, we’ll walk through how to set up a secure proxy server using WireGuard, allowing you to tunnel traffic through a secure connection while maintaining high performance.

Prerequisites

Before proceeding with the installation and setup of WireGuard, ensure that the following are in place:

• A Linux server (Ubuntu or CentOS recommended)
• Root or sudo access on the server
• WireGuard installed on the server and client machines
• Basic knowledge of networking and VPN protocols

Step 1: Installing WireGuard on the Server

The first step is to install WireGuard on your server. This tutorial assumes you’re using Ubuntu, but instructions for other distributions can be adapted similarly.

sudo apt update
sudo apt install wireguard
Once WireGuard is installed, you can proceed with setting up the configuration file.

Step 2: Generating the Keys for the Server

WireGuard uses public-key cryptography for authentication. Each device that connects to the WireGuard VPN needs a pair of keys: a public key and a private key.
To generate the keys on the server, run the following commands:
wg genkey | tee privatekey | wg pubkey > publickey
This will create a private key (privatekey) and a public key (publickey) in your current directory. Store these keys securely.

Step 3: Configuring WireGuard on the Server

Create a configuration file for the WireGuard server. The configuration file should be placed in /etc/wireguard/.
sudo nano /etc/wireguard/wg0.conf
Add the following content to the file, replacing with the private key you just generated:
ini
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey =

[Peer]
PublicKey =
AllowedIPs = 10.0.0.2/32
In this configuration:
Address is the server’s internal IP address in the VPN network.
ListenPort is the port WireGuard will listen on (51820 by default).
PrivateKey is the server’s private key.
The [Peer] section specifies the client, with the client’s public key and the allowed IP addresses for that client.

Step 4: Enabling IP Forwarding on the Server

To ensure that traffic from the VPN is routed correctly, you need to enable IP forwarding on your server.
Edit the sysctl configuration:
sudo nano /etc/sysctl.conf
Add the following line to enable IPv4 forwarding:
net.ipv4.ip_forward = 1
Apply the changes:
sudo sysctl -p

Step 5: Configuring the Firewall

WireGuard uses UDP for its communication. You’ll need to allow traffic on the WireGuard port (51820) through the firewall.
For UFW (Uncomplicated Firewall), use the following commands:
sudo ufw allow 51820/udp
sudo ufw enable
For other firewalls, adjust the settings as required.

Step 6: Setting Up the Client

Now that the server is configured, let’s set up the client. On the client machine, install WireGuard as well.
sudo apt update
sudo apt install wireguard
Generate the client keys:
wg genkey | tee privatekey | wg pubkey > publickey
Create the WireGuard client configuration file:
sudo nano /etc/wireguard/wg0.conf
Add the following content, replacing with the private key you generated and with the public key from the server:
ini
[Interface]
PrivateKey =
Address = 10.0.0.2/32

[Peer]
PublicKey =
Endpoint = :51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
In this configuration:
Address is the client’s internal IP address within the VPN.
PublicKey is the server’s public key.
Endpoint is the server’s IP address and the WireGuard port.
AllowedIPs = 0.0.0.0/0 ensures that all traffic from the client is routed through the VPN.

Step 7: Starting the WireGuard Service

Start the WireGuard interface on both the server and the client. On both machines, use the following command to bring up the VPN interface:
sudo wg-quick up wg0
You can also enable WireGuard to start on boot:
sudo systemctl enable wg-quick@wg0

Step 8: Testing the Connection

To test if the connection is working, you can use the ping command to test the client’s connectivity to the server’s VPN address:
ping 10.0.0.1
If you receive replies, the VPN tunnel is successfully established.

Step 9: Routing Traffic through a Secure Proxy

To use WireGuard as a secure proxy, configure your server to route the client’s internet traffic through the VPN. This can be done by setting up NAT (Network Address Translation) on the server.
Add the following rule to enable NAT for the WireGuard network:
sudo iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
This rule ensures that any traffic from the WireGuard network is routed through the server’s external interface (eth0).
Additionally, you may want to configure a DNS resolver. This can be done by specifying DNS servers in the WireGuard configuration files, both on the server and client.
ini
[Interface]
DNS = 1.1.1.1, 8.8.8.8

Step 10: Verifying the Proxy Setup

Once the setup is complete, you can verify that your internet traffic is routed through the secure proxy by checking your external IP address. Run the following command:
curl ifconfig.me
This should show the IP address of the WireGuard server, confirming that traffic is being routed securely through the proxy.