Is WireGuard the right solution for this ?

DaveOB · Sep 21st 2023

I have a Pi4 running OMV6, docker, Containers for Nginx, Portainer, and Shared Folders which I can access on my LAN using SMB and FTP ( Filezilla ).

Very happy and it's very stable.

The Pi has a Static IP address allocated by the network Mikrotik HAP Lite router. My Fixed Fiber internet connection has a Static IP allocated by my ISP.

I use a different port number on the Pi IP for OMV6, Portainer, FTP, SSH ( Putty ), etc

I want to be able to access all of these items when away from home, either from my Laptop, or my Android phone.

Any pointers on how to set this up ? If I activate a WireGuard Client on my laptop or phone, does that mean that all internet comms for those devices will be channeled thru the vpn ?

chente · Sep 21st 2023

Quote from DaveOB

Is WireGuard the right solution for this ?

Yeah.

Quote from DaveOB

Any pointers on how to set this up ?

omv6:omv6_plugins:wireguard [omv-extras.org]

Quote from DaveOB

If I activate a WireGuard Client on my laptop or phone, does that mean that all internet comms for those devices will be channeled thru the vpn ?

It depends on what you want in your case. You can configure it. Everything is explained in the link above.

margaretikiko · Sep 22nd 2023

I think yup, WireGuard is a good solution for accessing your Pi4 remotely. You have just to set up a WireGuard server on your Pi4, configure your router to forward ports 51820 and 51821 to your Pi4, then install the WireGuard client on your laptop and phone, and finally configure the WireGuard client on your laptop and phone to connect to your WireGuard server.

Once you have done this, you will be able to access all of the services on your Pi4 from outside your home by connecting to your WireGuard server.

P.S. When you connect to your WireGuard server, all of your internet traffic will be channeled through the VPN.

I recommend using a strong passphrase for your WireGuard server and keeping your WireGuard server and client software up to date.

chente · Sep 22nd 2023

Quote from margaretikiko

P.S. When you connect to your WireGuard server, all of your internet traffic will be channeled through the VPN.

That is configurable. It may or may not be so. https://wiki.omv-extras.org/do…_split_the_tunnel_traffic

fbeye · Sep 22nd 2023

I only wish that WG App for iPhone would pass along it's configuration to it's Hot spot!

On my iPhone I indeed have access to my home LAN as well as [home] wan ip but at work when I connect my laptop to my iPhone hot spot, it reverts back to the LTE IP etc.

I know Android has an ability as such but nothing [yet] for iPhone.

BlueCoffee · Sep 22nd 2023

Quote from fbeye

I only wish that WG App for iPhone would pass along it's configuration to it's Hot spot!
On my iPhone I indeed have access to my home LAN as well as [home] wan ip but at work when I connect my laptop to my iPhone hot spot, it reverts back to the LTE IP etc.

I know Android has an ability as such but nothing [yet] for iPhone.

Buy a good phone than and not the iphone junk

fbeye · Sep 22nd 2023

Quote from BlueCoffee

Buy a good phone than and not the iphone junk

I am mortally wounded. I have a Samsung phone for work and I don't like it! I mean clearly it has it's advantage. Ah well

DaveOB · Sep 23rd 2023

Update :
Couldn't get it working, even though the ISP had allocated me a Static IP the week before.
Took them a while to confirm that cgnat was not enabled.

Eventually removed the mikrotik hap lite router from the setup as I no longer needed that for the purpose that it was originally installed.

Forwarded port 51820 to the IP for the Pi on the Zyxel router, and everything worked perfectly.

Side note : I used a data connection on my android phone to test, and ran WireGuard on the phone to connect to the VPN on the Pi.
At first I couldn't see any files in the SMB shares, then found X-plore File Explorer for android - awesome app that allowed me to setup LAN connection to the Pi Shared folders, as well as FTP connections to my other domains.

Also found that if I enabled Hotspot on the phone, my laptop could connect to the phone over wifi. If I also enabled WireGuard on the laptop, I could not access the files on the Pi. I think having WireGuard active on the phone and the laptop at the same time was conflicting. Turned off WireGuard on the laptop and then I was able to easily see the files on the Pi ( from the laptop ).

On the laptop, it wouldn't see the Pi's files on the mapped network drives that I have set up. I had to go to File Explorer > Network > Pi, so I could see the files.

chente · Sep 23rd 2023

Quote from DaveOB

At first I couldn't see any files in the SMB shares, then found X-plore File Explorer for android - awesome app that allowed me to setup LAN connection to the Pi Shared folders, as well as FTP connections to my other domains.

Wireguard is not a file explorer. Wireguard only facilitates encrypted remote connection. Once the connection is established, you need tools to access network services. In this case you needed a file explorer because you wanted to access the samba service. In the same way to access a web interface you need a browser.

Quote from DaveOB

Also found that if I enabled Hotspot on the phone, my laptop could connect to the phone over wifi. If I also enabled WireGuard on the laptop, I could not access the files on the Pi. I think having WireGuard active on the phone and the laptop at the same time was conflicting. Turned off WireGuard on the laptop and then I was able to easily see the files on the Pi ( from the laptop ).

If you configure Wireguard on the smartphone and on the laptop, you are doing it twice. It's the same as if you establish a Wireguard connection on your home network. It may or may not work depending on the capabilities of your router or your configuration. Generally it won't work unless you do something else. That configuration is possible.

Quote from DaveOB

On the laptop, it wouldn't see the Pi's files on the mapped network drives that I have set up. I had to go to File Explorer > Network > Pi, so I could see the files.

Possibly a domain resolution issue. It would be necessary to know more details to determine it.

margaretikiko · Sep 24th 2023

Quote from chente

That is configurable. It may or may not be so. https://wiki.omv-extras.org/do…_split_the_tunnel_traffic

Then more complicated than I've thought.

chente · Sep 24th 2023

Quote from margaretikiko

Then more complicated than I've thought.

It's not complicated, it's very easy. If you leave the default setting AllowedIPs=0.0.0.0/0 and that means all traffic is routed through the tunnel. That's normal. Other situations are customizations.

Everything is customizable in Linux.

margaretikiko · Sep 26th 2023

Ok, yeah, this sounds reasonable.

Louie1961 · Sep 26th 2023

If you like the Wireguard protocol but want the ability to traverse CGNAT, and the speed of a peer to peer conection, check out Tailscale.

chente · Sep 26th 2023

Quote from Louie1961

If you like the Wireguard protocol but want the ability to traverse CGNAT, and the speed of a peer to peer conection, check out Tailscale.

I haven't looked into it much, but I think to use Taiscale you need to install an app to connect to a third party server that routes communications. I would run away from all that if possible. I would only use it if I can't get rid of CGNAT. In my country all ISPs accept requests to leave CGNAT.

Louie1961 · Sep 27th 2023

With Tailscale the connections are peer to peer. Their server is like a proxy that connects the peers. Normally none of your data goes through their server. Tailscale doesn't even do user identity management.

chente · Sep 27th 2023

Quote from Louie1961

Normally none of your data goes through their server. Tailscale doesn't even do user identity management.

mmmm Are you sure about that? Where have you read it? It's hard to believe, I get the feeling that it's not like that. If you don't go through an external server you won't be able to connect two ends with CGNAT in the middle.

Louie1961 · Sep 27th 2023

In their documentation, on Cristian Lempa's channel, on Lawrence Systems' channel, etc. Your data only flows through their server as a last resort if they can't find a way to do NAT traversal and create a direct peer to peer connection. Then in only that case your data goes through their relay server. But it goes through encrypted, and they can't decrypt it.

chente · Sep 27th 2023

The application you install is supplied by them, I suppose. From the moment there is a third party in the middle, that system is no longer as secure as a system where only you intervene can be. It's just my humble opinion.

Louie1961 · Sep 28th 2023

How is it any different than installing an application for wireguard itself? Did you read their documentation?

chente · Sep 28th 2023

Quote from Louie1961

How is it any different than installing an application for wireguard itself? Did you read their documentation?

Alright. You made me do a quick google search and I found this quickly.

WireGuard vs. Tailscale

Should I use Tailscale or WireGuard® to secure my network? The answer is yes!

tailscale.com

That document was written by the company that develops and sells services with Tailscale. After reading it I come to the conclusion that if you are not behind CGNAT there is no reason to use Tailscale. This would be the list of disadvantages and advantages that quickly comes to mind:

DISADVANTAGES OF TAILSCALE:

- It is a private company that sells services. That already makes me distrustful as it is not an open source solution. If there is a company behind it, don't expect them to look out for your interests. They only care about their own interests.

- You must open an account with their company and configure the connections. I don't know what information they will request to do this, but anything they ask for is unnecessary. After that you must configure the service on their website and you will be at the mercy of the changes they make.

- You must install its application on each of the devices designed by that company. While it is true that, as they say (although I have not verified this nor am I going to do so), that application is open source, perhaps you should review that code to make sure that what a private company is telling you is true. In general I don't trust when there are economic interests involved. I wouldn't be surprised if they collect data on your system or something like that.

- The connection through Tailscale is slower than the connection with Wireguard. Tailscale connects a client to the Tailscale server using Wireguard, the server communicates with another client using Wireguard. Wireguard communicates two clients with each other directly. It is evident what is the reason why the connection is slower in the case of Tailscale. If you make the connection with Wireguard directly you are avoiding all traffic from passing through their servers. On the other hand, in addition to the above, it would also be necessary to study what is the maximum speed that its servers allow. It's probably not as fast as you'd like for customers using the free service.

- You depend on the profitability of the company. If the company decides at any time that this business is no longer profitable, you will be left alone. You depend on that company to make enough money to maintain the free service you are using.

- I haven't thought much about it, but I'm sure there are more disadvantages....

ADVANTAGES OF TAILSCALE:

- You overcome the CGNAT problem.

Is WireGuard the right solution for this ?

Participate now!

Similar Threads

Remote access to my nas?

Wireguard on docker: question about not routing internet traffic on client

Tags