Editing VPN using Wireguard

This article describes how to use VPN via [https://www.wireguard.com WireGuard] inside a Virtuozzo 7 / OpenVZ 7 Container.

== Install WireGuard on the Host Node ==
=== Install vzkernel-devel package ===
Install vzkernel-devel package for the running kernel on the Host Node.<br>
It's required for building third-party kernel modules.
 # yum install -y vzkernel-devel

=== Install WireGuard packages ===
Virtuozzo 7 is a derivative of RHEL7/CentOS7, so use corresponding part of [https://www.wireguard.com/install WireGuard installation].

 # curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
 # yum install epel-release
 # yum install wireguard-dkms wireguard-tools

== Allow WireGuard network interfaces inside a Container ==
Next, we need to patch wireguard kernel module to allow wireguard network interface to be created in Containers:<br>
(change the path to wireguard sources if needed)
 # patch /usr/src/wireguard-0.0.20190601/device.c diff-wireguard-allow-to-run-in-Containers

<pre>
--- ./device.c.orig     2019-07-02 16:05:42.162373405 +0300
+++ ./device.c  2019-06-10 17:21:27.956413409 +0300
@@ -281,7 +281,7 @@ static void wg_setup(struct net_device *
 #else
        dev->tx_queue_len = 0;
 #endif
-       dev->features |= NETIF_F_LLTX;
+       dev->features |= NETIF_F_LLTX | NETIF_F_VIRTUAL;
        dev->features |= WG_NETDEV_FEATURES;
        dev->hw_features |= WG_NETDEV_FEATURES;
        dev->hw_enc_features |= WG_NETDEV_FEATURES;
</pre>

{{Note|Why it's required?
As Virtuozzo is very keen on security and stability, we don't allow creation of any unverified network interface inside Containers.<br>
Only those which are safe (verified and considered properly virtualized) are allowed.}}

== Rebuild patched wireguard kernel module ==
Now need to rebuild patched wireguard kernel module.<br>
dkms does not have a command to rebuild a module, so have to remove/add the module.

 # dkms remove -m wireguard -v 0.0.20190601 --all
 # dkms add -m wireguard -v 0.0.20190601
 # dkms build -m wireguard -v 0.0.20190601
 # dkms install -m wireguard -v 0.0.20190601

== Load the wireguard kernel module ==
Now load the wireguard kernel module on the Host Node,<br>
it won't be automatically loaded upon request from inside a Container.
 # modprobe wireguard


== Create a Container ==
Create a Container with veth network (venet won't work here).

 # vzctl create 200 --ostemplate centos7-x86_64
 # prlctl set 200 --device-add net --network Bridged --dhcp yes
 # vzctl start 200
 # vzctl enter 200
 // The Container should have an IP assigned now

== Install WireGuard inside the Container ==
Same procedure like wireguard is installed on the Host:

 [CT]# curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
 [CT]# yum install epel-release
 [CT]# yum install wireguard-dkms wireguard-tools
 // may be its enough to install "wireguard-tools" package only, did not check

Now configure wireguard inside the Container using instructions from [https://www.wireguard.com/quickstart WireGuard quickstart]

== Allow WireGuard port(s) in firewall ==
Don't forget to open UDP port for wireguard on each end Node/Container.<br>
Wireguard supports UDP only at the moment.<br>
The port number can be checked via:
 [CT]# wg | grep listening
   listening port: 35849

 [CT]# firewall-cmd --permanent --zone=public --add-port=35849/udp     
 success
 [CT]# firewall-cmd --reload

Do the same on another Node/Container and voila!

[[Category: HOWTO]]
[[Category: Networking]]
@@ Line 1: / Line 1: @@
 This article describes how to use VPN via [https://www.wireguard.com WireGuard] inside a Virtuozzo 7 / OpenVZ 7 Container.
-{{warning|<br>
-This article describes the WireGuard configuration in an OpenVZ Container which '''does not survive WireGuard package update'''.<br>
-After WireGuard package update you have to repeat the described steps to make WireGuard working again.<br>
-If you wish to have a persistent configuration which survives WireGuard updates, please contact [https://www.virtuozzo.com/support/virtuozzo-professional-services.html '''Virtuozzo Professional Services''']}}
 == Install WireGuard on the Host Node ==
@@ Line 55: / Line 50: @@
 it won't be automatically loaded upon request from inside a Container.
   # modprobe wireguard
 == Create a Container ==