VPN using Wireguard - Revision history

Finist: Warning about WireGuard update procedure.

2019-07-11T09:07:01Z

Warning about WireGuard update procedure.

Finist: insert patch content right into the page

2019-07-04T12:26:30Z

insert patch content right into the page

Finist: initial commit

2019-07-04T12:13:01Z

initial commit

New page

This article describes how to use VPN via [https://www.wireguard.com WireGuard] inside a Virtuozzo 7 / OpenVZ 7 Container.

== Install WireGuard on the Host Node ==
=== Install vzkernel-devel package ===
Install vzkernel-devel package for the running kernel on the Host Node. 
It's required for building third-party kernel modules.
# yum install -y vzkernel-devel

=== Install WireGuard packages ===
Virtuozzo 7 is a derivative of RHEL7/CentOS7, so use corresponding part of [https://www.wireguard.com/install WireGuard installation].

# curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
# yum install epel-release
# yum install wireguard-dkms wireguard-tools

== Allow WireGuard network interfaces inside a Container ==
Next, we need to patch wireguard kernel module to allow wireguard network interface to be created in Containers: 
(change the path to wireguard sources if needed)
# patch /usr/src/wireguard-0.0.20190601/device.c diff-wireguard-allow-to-run-in-Containers

{{Note|Why it's required?
As Virtuozzo is very keen on security and stability, we don't allow creation of any unverified network interface inside Containers. 
Only those which are safe (verified and considered properly virtualized) are allowed.}}

== Rebuild patched wireguard kernel module ==
Now need to rebuild patched wireguard kernel module. 
dkms does not have a command to rebuild a module, so have to remove/add the module.

# dkms remove -m wireguard -v 0.0.20190601 --all
# dkms add -m wireguard -v 0.0.20190601
# dkms build -m wireguard -v 0.0.20190601
# dkms install -m wireguard -v 0.0.20190601

== Load the wireguard kernel module ==
Now load the wireguard kernel module on the Host Node, 
it won't be automatically loaded upon request from inside a Container.
# modprobe wireguard

== Create a Container ==
Create a Container with veth network (venet won't work here).

# vzctl create 200 --ostemplate centos7-x86_64
# prlctl set 200 --device-add net --network Bridged --dhcp yes
# vzctl start 200
# vzctl enter 200
// The Container should have an IP assigned now

== Install WireGuard inside the Container ==
Same procedure like wireguard is installed on the Host:

[CT]# curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
[CT]# yum install epel-release
[CT]# yum install wireguard-dkms wireguard-tools
// may be its enough to install "wireguard-tools" package only, did not check

Now configure wireguard inside the Container using instructions from [https://www.wireguard.com/quickstart WireGuard quickstart]

== Allow WireGuard port(s) in firewall ==
Don't forget to open UDP port for wireguard on each end Node/Container. 
Wireguard supports UDP only at the moment. 
The port number can be checked via:
[CT]# wg | grep listening
listening port: 35849

[CT]# firewall-cmd --permanent --zone=public --add-port=35849/udp
success
[CT]# firewall-cmd --reload

Do the same on another Node/Container and voila!

[[Category: HOWTO]]
[[Category: Networking]]

@@ Line 1: / Line 1: @@
 This article describes how to use VPN via [https://www.wireguard.com WireGuard] inside a Virtuozzo 7 / OpenVZ 7 Container.
 == Install WireGuard on the Host Node ==
@@ Line 50: / Line 55: @@
 it won't be automatically loaded upon request from inside a Container.
   # modprobe wireguard
 == Create a Container ==

@@ Line 18: / Line 18: @@
 (change the path to wireguard sources if needed)
   # patch /usr/src/wireguard-0.0.20190601/device.c diff-wireguard-allow-to-run-in-Containers
 {{Note|Why it's required?