Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| omv7:omv7_plugins:wireguard [2024/01/27 19:17] – [Point to point. Standard tunnel.] chente | omv7:omv7_plugins:wireguard [2024/04/24 15:28] (current) – [Configuring a Client] chente | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | {{indexmenu_n> | ||
| \\ | \\ | ||
| < | < | ||
| Line 19: | Line 20: | ||
| * You will be able to access all your shared folders and all the services you have configured on your local network as if you were there. | * You will be able to access all your shared folders and all the services you have configured on your local network as if you were there. | ||
| * By default all client traffic will be forwarded through the VPN connection (it is configurable), | * By default all client traffic will be forwarded through the VPN connection (it is configurable), | ||
| - | * The Custom Config tab allows you to make configurations according to specific needs. You can implement any Wireguard network topology. | + | * The Custom Config tab allows you to make configurations according to specific needs. You can use this tab if you need to connect the server to an external Wireguard VPN service, or you can implement any Wireguard network topology. |
| * The point-to-point connection allows the connection between two servers, communicating only with each other. For example to make remote backups. | * The point-to-point connection allows the connection between two servers, communicating only with each other. For example to make remote backups. | ||
| * The site-to-site provides a connection between two networks so that any IP on a local network is able to communicate with any IP on another local network. | * The site-to-site provides a connection between two networks so that any IP on a local network is able to communicate with any IP on another local network. | ||
| Line 61: | Line 62: | ||
| {{ : | {{ : | ||
| * In the OMV GUI go to **Services** > **Wireguard** > **Tunnels** Press the **Create** button. | * In the OMV GUI go to **Services** > **Wireguard** > **Tunnels** Press the **Create** button. | ||
| - | * In the dialog box enable the tunnel and fill in the fields: | + | |
| * **Name** You can name the tunnel to identify it later. | * **Name** You can name the tunnel to identify it later. | ||
| * **Network Adapter** Click on the **Network adapter** dropdown menu and choose your adapter. | * **Network Adapter** Click on the **Network adapter** dropdown menu and choose your adapter. | ||
| Line 71: | Line 72: | ||
| * **Port** field, type the port you want to use for the connection, usually it is 51820. | * **Port** field, type the port you want to use for the connection, usually it is 51820. | ||
| * You can choose any available port, it must not be occupied on your system by any service or by another wireguard tunnel. | * You can choose any available port, it must not be occupied on your system by any service or by another wireguard tunnel. | ||
| - | * Remember that you must open this port in the router and direct it to the IP of your server and with the same port. Use the UDP protocol. If you don't know how to do it, consult the manual of your router. | + | * Remember that you must open this port in the router and direct it to the IP of your server and with the same port. Use the UDP protocol. If you don't know how to do it, consult the manual of your router. |
| + | * **Advanced configuration** The previous fields are essential to configure a tunnel, if you need other custom configurations they can be the following (If you don't need any of this, leave the default values): | ||
| * **Configure iptables** By default this will generate the settings in iptables to allow traffic on your internal network from outside. | * **Configure iptables** By default this will generate the settings in iptables to allow traffic on your internal network from outside. | ||
| * If for some reason you need the plugin not to configure iptables, you can do so by clearing this checkbox. | * If for some reason you need the plugin not to configure iptables, you can do so by clearing this checkbox. | ||
| Line 85: | Line 87: | ||
| * **Persistent keepalive** By default it is disabled. Set a value, such as 25, so that a hello is sent through the tunnel every 25 seconds. | * **Persistent keepalive** By default it is disabled. Set a value, such as 25, so that a hello is sent through the tunnel every 25 seconds. | ||
| * Activate only if necessary for some reason. One of wireguard' | * Activate only if necessary for some reason. One of wireguard' | ||
| + | * **Local IP** Allows you to establish a network range that can be chosen in the configuration of each client to divide the tunnel traffic on that client. | ||
| + | * A common example could be '' | ||
| * **MTU** By default it is disabled. Generally this equates to '' | * **MTU** By default it is disabled. Generally this equates to '' | ||
| * If no value is set, wireguard will set it from the existing network configuration. Typically this value is 1500, so wireguard will automatically set '' | * If no value is set, wireguard will set it from the existing network configuration. Typically this value is 1500, so wireguard will automatically set '' | ||
| Line 131: | Line 135: | ||
| {{ : | {{ : | ||
| * In the OMV GUI go to **Services** > **Wireguard** > **Clients** Press the **Create** button. | * In the OMV GUI go to **Services** > **Wireguard** > **Clients** Press the **Create** button. | ||
| - | * In the dialog box enable the client and fill in the data: | + | * **Basic Configuration** These are the fields necessary to configure a client, in the dialog box enable the client and fill in the data: |
| * **Client number** It must not coincide with that of other clients. | * **Client number** It must not coincide with that of other clients. | ||
| * **Tunnel number** You must assign the client to one of the previously created tunnels. | * **Tunnel number** You must assign the client to one of the previously created tunnels. | ||
| * **Name** You can name the client to identify it later. | * **Name** You can name the client to identify it later. | ||
| - | | + | |
| * **Persistent Keepalive** The default setting is to leave it blank. In some cases it may be necessary to set a value here to keep the connection active. A suitable value is usually 25 (Every 25 seconds the client will send a packet to the server). | * **Persistent Keepalive** The default setting is to leave it blank. In some cases it may be necessary to set a value here to keep the connection active. A suitable value is usually 25 (Every 25 seconds the client will send a packet to the server). | ||
| * **DNS Servers** The default setting is to leave it blank. In some cases it may be necessary to establish a DNS server for the client to communicate correctly on the local network. The usual thing will be to establish the IP of the router. The menu will show the existing value in resolv.conf in case you want to copy it to the field on the right. | * **DNS Servers** The default setting is to leave it blank. In some cases it may be necessary to establish a DNS server for the client to communicate correctly on the local network. The usual thing will be to establish the IP of the router. The menu will show the existing value in resolv.conf in case you want to copy it to the field on the right. | ||
| - | * Click **Save**. At this point, if you have already activated the tunnel and the client, the connection will be up and running. | + | |
| + | * **VPN** button. Pressing this button will remove the '' | ||
| + | * **Local IP** button. Pressing this button will remove the network range '' | ||
| + | * **Additional subnet(s)** field. Allows you to manually add a network range to the AllowedIPs field on this client. | ||
| + | | ||
| * By pressing the button **Client Config** you can see the client configuration file, you can copy and paste the text in a file to configure the connection in the client. If you do it this way, add the ending " | * By pressing the button **Client Config** you can see the client configuration file, you can copy and paste the text in a file to configure the connection in the client. If you do it this way, add the ending " | ||
| - | * A QR will appear in the table (if the client is enabled), which you can scan from a smartphone to configure the connection without having to copy a file. If you need to send it you can take a photo. Treat this image as a password, it is the access key to your network. | + | * A QR will appear in the table (if the client is enabled), which you can scan from a smartphone to configure the connection without having to copy a file. If you need to send it you can take a photo. Treat this image as a password, it is the access key to your network |
| * Use a different client configuration for each client. If you configure the same connection on several clients at the same time, they will not be able to connect simultaneously. | * Use a different client configuration for each client. If you configure the same connection on several clients at the same time, they will not be able to connect simultaneously. | ||
| Line 148: | Line 156: | ||
| * By pressing the **Edit** button you can modify the parameters or disable the client. Select it previously. | * By pressing the **Edit** button you can modify the parameters or disable the client. Select it previously. | ||
| + | |||
| + | < | ||
| + | </ | ||
| + | Any changes made must be implemented again on the client using the QR code or configuration file for the changes to be applied. | ||
| + | </ | ||
| ---- | ---- | ||
| Line 173: | Line 186: | ||
| ---- | ---- | ||
| - | This tab allows you to create a tunnel with the custom settings you need. It allows to open an editing window where you can paste the configuration from a text file, therefore, you can choose the parameters you need for the tunnel. | + | This tab allows you to create a tunnel with the custom settings you need. It allows to open an editing window where you can paste the configuration from a text file, therefore, you can choose the parameters you need for the tunnel. Use this tab if you need to connect the server to an external (commercial) Wireguard VPN service. |
| If you need to configure a tunnel to connect the point-to-point server with another server, or any other network topology, you must do so in this tab, since it allows you to manually define keys, networks and other necessary parameters. | If you need to configure a tunnel to connect the point-to-point server with another server, or any other network topology, you must do so in this tab, since it allows you to manually define keys, networks and other necessary parameters. | ||
| Line 188: | Line 201: | ||
| * In the **Config** field write the configuration content of your tunnel following the Wireguard rules. | * In the **Config** field write the configuration content of your tunnel following the Wireguard rules. | ||
| * You can see how to do it on the [[https:// | * You can see how to do it on the [[https:// | ||
| + | * If you want to connect to a commercial VPN service, they will most likely provide you with the tunnel configuration template. In that case, simply copy and paste that template into the Config field. | ||
| * If you need special topologies you can find them on the [[https:// | * If you need special topologies you can find them on the [[https:// | ||
| * Note that the networks created by the plugin in the **Tunnel** and **Client** tabs are generated in the '' | * Note that the networks created by the plugin in the **Tunnel** and **Client** tabs are generated in the '' | ||