wireguard vpn [WIP]

[Galaxis]

For the past couple of days, I've been trying to set up a WireGuard VPN on SuperZaxxon.

Current status: Seems to work in principle - I can create a tunnel, and I can connect to the system on the other side.

I'm using the wireguard-go userspace implementation though, haven't tried to make the kernel module work (there's a wireguard-compat module, but it only promises support down to 3.10 kernels, so I didn't even have a look at it).

I cross-built the wireguard-go program on a different system (Code::Blocks has a native go, but it's too old, and my attempts to compile a current version on the Pandora went nowhere fast). Golang has built-in support for crosscompiling, but it doesn't know about the ARM softfp ABI used in SuperZaxxon. The workaround is to build for ARM5, which results in a binary with full softfloat. Not optimal for the Pandora, but it probably doesn't make much of a difference for this use case.

I managed to compile the other component (wireguard-tools, required create a tunnel configuration) locally on the Pandora.

Is there any interest in the binaries? I don't think I'm motivated to create a PND, but if anyone else has a use for this stuff nowadays, I could pack up the files prepared for installation to /usr/local, and write a short text about the tweaks required on the Pandora (there's little things like /dev/net/tun does not exist and a few other obstacles). I plan to write a short blog post on how to reproduce the results some time soon.

 

[levi]

Nice work. I don't have a use for a VPN myself, but impressive thoroughness anyway.

 

[Galaxis]

Automation for setting up a basic tunnel with wg-quick now works (I have a wrapper script that creates /dev/net/tun and the missing /dev/fd -> /proc/self/fd symlink before invoking wg-quick), except for changing the nameserver - it tries to use tools that don't exist for that one. A few other advanced wg-quick functions will most probably fail too due to outdated tooling.

Changing the nameserver seems tricky - nmcli on the Pandora is too old to be helpful with that. Probably just overwrite /etc/resolv.conf? Though I assume it will be restored when returning from sleep.

Apropos sleep - when the tunnel interface is called anything that starts with "w" (wg0 is the default), restoring Wifi when waking up the Pandora will be broken. Probably some script that's involved uses a somewhat too fuzzy wildcard match? Didn't try to debug that one yet.

 

[Galaxis]

Well, doesn't seem as if anyone has much use for this, but I wrote up some more about building the stuff over on my blog nevertheless (some info is duplicated from the above posts). There's also an archive with the files at the bottom of that blog entry. Note I don't say anything about how to actually set up WireGuard, but there's a bunch of guides out there.

One of the neat things about WireGuard is that it supports roaming clients and doesn't mind being suspended, so it fits the Pandora environment pretty well.