VPN with WireGuard

wget https://raspi.debian.net/daily/raspi_${RPI_MODEL}_${DEBIAN_RELEASE}.img.xz.sha256
wget https://raspi.debian.net/daily/raspi_${RPI_MODEL}_${DEBIAN_RELEASE}.img.xz
sha256sum -c raspi_${RPI_MODEL}_${DEBIAN_RELEASE}.img.xz.sha256
# if sha256sum reports success...
xzcat raspi_${RPI_MODEL}_${DEBIAN_RELEASE}.img.xz | sudo dd of=${SD_CARD} bs=64k oflag=dsync status=progress

# add a normal user, in this case named "urpi"
adduser urpi
usermod -aG sudo urpi
# install some useful packages for working remotely
apt update
apt install tmux sudo
# get ip address of the machine
ip address show

# add entry in .ssh/config for the Raspberry, set up the ssh key, and so on
ssh rpi
# at this point, it is possible to detach the Raspberry from the monitor and keyboard
# just leave the power and ethernet cable and work from a more comfortable device through SSH
sudo tmux
# start upgrade process in one pane/window
apt upgrade

# change hostname from a different tmux pane
hostnamectl set-hostname rpi
# also edit value in /etc/hosts
# 127.0.1.1       rpi

# eventually do other tasks while updates are installed, it will take a while on the Raspberry

# add entries to local.conf if you want to use WireGuard as vpn for
# accessing internet
# if ouy only want to use as vpn for accessing local machines, then
# those changes are not required
echo 'net.ipv4.ip_forward=1'          >> /etc/sysctl.d/local.conf
echo 'net.ipv6.conf.all.forwarding=1' >> /etc/sysctl.d/local.conf
sysctl -p /etc/sysctl.d/local.conf

# install wireguard
apt install wireguard openresolv

# generate keys
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey | tee /etc/wireguard/server_public.key

# create config file
# note that it needs the public key of the client, which is generated in the
# snippet after this one
printf '[Interface]
PrivateKey = %s
Address = 10.10.0.1/24
ListenPort = 51820
#DNS = <optional dns entry>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # Add forwarding when VPN is started
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE # Remove forwarding when VPN is shutdown

[Peer]
PublicKey = %s
AllowedIPs = 10.10.0.2/32
' "$(cat /etc/wireguard/server_private.key)" "$(cat /etc/wireguard/client_public.key)" > /etc/wireguard/wg0.conf

# start and verify wireguard service
systemctl enable wg-quick@wg0.service
systemctl status wg-quick@wg0
systemctl start  wg-quick@wg0.service
systemctl status wg-quick@wg0

apt install wireguard openresolv

# generate keys, I do not think they need to be there
wg genkey | tee /etc/wireguard/client_private.key | wg pubkey | tee /etc/wireguard/client_public.key

# ip address of RPI
server_address_and_port="12.34.56.78:51820"

printf '[Interface]
Address = 10.10.0.2/32
PrivateKey = %s
#DNS = <optional dns entry>

[Peer]
PublicKey = %s
# forward everything
AllowedIps = 0.0.0.0/0, ::/0
Endpoint = %s
PersistentKeepalive = 25
' "$(cat /etc/wireguard/client_private.key)" "$(cat /etc/wireguard/server_public.key)" "$server_address_and_port" > /etc/wireguard/wg0-client.conf

wg-quick up wg0-client
wg show
#open webpage in browser that shows ip address, ping hangs
wg-quick down wg0-client