Hey there, how are you?
So as a real Linux user you already have a home server, right?
And how would I know that?
Well, check out this video under the fourth rule, right?
So you have to have a home server.
And in order to reach your home server remotely so that you can do your maintenance, remote
access it in a very secure way, right?
One of the best ways to do that is by having VPN access to your home, right?
So let me show you how I did it and what is some of the better ways of doing stuff like
that, like reaching your private home over the internet in a secure way, right?
And I'm going to present something relatively affordable and easy to configure.
Okie dokie.
Let's go to, where are we?
This is my client PC.
Let's disconnect this screen for a second, ok?
So first of all what you are going to do is you are going to have Mikrotik router in
your home.
It is what it is.
If you have Mikrotik at home use one of those and configure WireGuard VPN on it
and I'm going to show you how.
So if you don't have Mikrotik you can also use your Linux server as a router at home
because WireGuard is essentially a Linux VPN first and foremost.
So we are going to go with that.
So once you are on your own Mikrotik and of course I'm not going to show you my keys,
you are going to go and make a new WireGuard.
But not under Pierce, you are going to go under WireGuard, make a new one, right?
Give it a comment, make it enabled, give it a name.
In my case it's going to be called WireGuard1 but this doesn't matter too much and the
default port you can leave it as is unless you want to make it a little bit more secure
by invoking some of the obscurity, right?
So you can shuffle the port to whatever you like.
But do take note at regarding which port you have used, right?
So once you have created your interface it is going to look like this, right?
So you can leave the MTU as is and the port as you have enabled it and then you are
going to have a private key and a public key pair, right?
So once again I'm not showing you either my private or public keys but you are going to
see them on your own interface, right?
Do make note on what your, let's call it VPN server, right?
Do make note on what your public key is.
The private key can remain stored on your Mikrotik but the public key you have to
not sign it, you have to write it down somewhere like copy paste it to
Kate or something like that.
So what you're going to do next is you are going to go to the pier stub.
So in pier stub you have to create a new pier, right?
And let me go ahead and show you my first pier already configured so you can see how
it looks like once it's done.
So what is important here is that in the public key of your first pier this is going
to be your first laptop or if you're connecting your phone then the public key of your phone, right?
Here is that you're going to type the public key of your laptop.
If the laptop is the first road warrior that you're connecting remotely
or VPN to your wire guard enabled VPN home, right?
So we are going to get to the point where we are actually having the public key of your laptop
but for now let's just type the IP address of your incoming pier, right?
So what you're going to do is you're going to type an IP address of your pier and this
must be in the same subnet where you have placed the IP of the wire guard.
And how do we know that?
We are going to go to the IP addresses, right?
And here let me spread this for a second.
Here you're going to see a wire guard interface, right?
So what you're going to do here go to the new button and when you create a new one
then you're going to let me just move it around.
You're going to select wire guard one interface which you have enabled or created in the first step,
right?
And you're going to invent a subnet, a private subnet that is for your wire guard interface, right?
So you can put any network and subnet that you like but make sure it should have some meaning
to you, right?
So what I did is I have made 192.168.98.1 for the microtik, right?
And slash 24 for 255 addresses.
This is like a default setup, nothing fancy, nothing special but it will do its job just right.
So once you have the .1 you can put whatever IP that you like, right?
Once you have an IP of your VPN server which is microtik in this case
then you're going to put the next one for your first peer.
You can basically put whichever IP you want like shuffle it to your heart's desire
but it has to be under the same subnet, right?
And also it has to have the mask slash 32 as it is just one IP address
for the allowed IP address that this peer is going to assign to itself, right?
So if this peer attempts to assign to itself as something else
it will not be allowed to do that.
And once you have all this I think we are pretty good.
You can put a comment on your laptop name, you can name it peer one,
although I think it will name itself as peer one when you create a new one
and basically we are somewhat done with this one
but we still are missing the public key that you haven't generated.
So let's go ahead and quickly switch to our laptop, right?
Okay, so on your laptop use VG command to generate a private and a public key pair.
So don't worry about this.
Let me just show you how it looks like after the generation has been done.
So we have a public key here and we have a private key here,
private key, right?
So don't worry about me showing you these keys
because these keys are simply for just for the demo purposes.
I'm not actually using these keys.
I am showing you these in my temporary folder
as means to give you heads up on how it looks like, right?
So make sure to write these down as well
and mark them as your peer keys, right?
This is important.
So the first thing that you're going to do is take your first peer.
So your peer is a laptop, right?
Usually take the public key that you have generated
and then go back to the microtik, right?
And put it in here as a public key of your first peer.
And once again, I'm going to repeat.
Your first peer will be your road warrior laptop.
It could be your smartphone as well.
But in this tutorial, I'm covering the laptop configuration.
And specifically, we are doing this on the KDE Plasma.
But this is just network manager stuff.
So you can do this on GNOME as well.
And even manually, if you feel the desire to do so via the config files.
So once you're done with this peer,
you can just click the OK button, right?
And then it will be closed.
And then let's go back to the laptop once again, okay?
And go to your network settings
and then go and add a new connection, right?
And in the new connections,
you're going to find a wire guard type of the connection, right?
So go ahead and click wire guard, click create.
And you can give it the name whichever you like
and give it an interface name, right?
So in my case, it will be WG1 in my case, right?
Let me just cancel this to show you
what it looks like after it has been generated, right?
So in the general, you can leave this as is.
And you can leave it.
All users may connect to this network
or uncheck this if you only want one user
to be able to use this network, right?
And then go ahead to the wire guard interface
and this is where you're going to paste your peer private key, right?
So what that is is the one that you have generated here,
private key, right?
Just copy paste it into that field on the peer laptop, right?
So this is our road warrior,
which is going to go around the internet
and it will always be able to connect to your home, right?
So next up, go to the IPv4 tab
or maybe just check that IPv6 is ignored
because usually you will want to have that ignored for now
and switch the IPv4 method to manual
and then type the IP address of your peer in here
and also put in the same netmask as you have used
the host one that you have used on Mikrotik
and simply ignore the gateway
and it will auto fill up with all of the zeros, right?
This is fine and it should be like that.
So put the IP address, the same one here
that you have assigned it as a peer one on the Mikrotik part
and the netmask 255 at all four octets.
The advanced part you can leave as is.
The routes part you can feel free not to touch this.
This is perfectly fine.
And then go back to the wire guard interface
and then go back to peers, right?
And here you have the option to paste the public key
of your Mikrotik.
So this is the first key that we have written
in the, let's say, Kate as a text editor, right?
So paste this one that you have fetched
from the Mikrotik as the Mikrotik's public key, right?
This is what goes in here, public key.
And then we have allowed IP addresses.
These are basically the destination networks,
destination subnets that you're going to want
to be able to fetch
or reach via your laptop road warrior, right?
So just separate them with a comma.
So this one is actually not that important.
This is my wire guard subnet, right?
So the only reason why I would want to have this subnet here
is in case I have multiple road warriors connected at once
and they want them to be able to talk
to each other over the internet
by being connected through my home, right?
So this is the reason why I have this subnet.
And the other subnet is basically my default subnet in my home.
So this is the one that you want to type in here.
Check which subnet is on your home LAN
and basically where your home server is
so that you will be able to reach it.
So type the same subnet here
and simply go to the endpoint address.
And this is where you're going to type the dynamic hostname
of your MikroTik, right?
And where you're going to find that
is by switching back to the MikroTik configuration.
Go to Quickset, go to VPN.
This is the quickest way to see it, right?
Don't enable VPN access here.
This is not wire guard.
Just check what the VPN address is.
This will always be the unique hostname
of your unique dynamic hostname of your MikroTik router, right?
So the important part is that your MikroTik
needs to be on the public IP, right?
You have to talk to your internet service provider
in order to switch your default network router
that they have shipped to you into the bridge mode.
And once they do that,
you will be able to configure your MikroTik
to be your main router, right?
And it will have the public facing IP address.
So this will be fine.
This part here is basically your serial number
of your MikroTik.
So of course I'm not showing you that either,
but basically this is what you're going to copy,
paste into the road warrior configuration, right?
So let's go back to my laptop here, okay?
So simply paste that here,
your public facing IP address of your MikroTik.
And in my case, it's a dynamic hostname
because my IP address keeps changing all the time.
Endpoint port is the same one
that you have configured in the MikroTik, right?
In my case, it would be the default one,
but you can switch it, right?
And the rest you can leave as is.
Then press OK and we are done
with the configuring of the laptop.
So one more thing that you need to do
is go back to MikroTik itself, turn this off,
turn this off as well,
and then go back to your firewall rules, right?
So IP and firewall here, right?
These are your firewall rules.
Whatever you have here, it is fine.
So first things first,
you're going to put, accept the incoming connections
for the WireGuard, right?
Go to the chain input.
This is very important.
Use the UDP as protocol and the destination port,
the one that you have used for the WireGuard VPN connection.
Anything else is not important here.
Press OK to create this filter rule
and it has to be somewhere in the beginning
of your configuration.
So if it ended up on the bottom,
simply drag and drop it to the beginning as far as you can
because this is important.
And then go to create the next one, right?
Just click the next rule and it will be like this.
Also put it in the input chain.
The source address must be your WireGuard VPN subnet.
So the same subnet that you have used
for the MikroTik WireGuard IP address
and the PIR WireGuard IP address,
you're going to put the same subnet in here.
Just name it properly, right?
So the dot zero in the end,
because we have slash 24 subnet, right?
The last talk that will be dot zero.
So this is our subnet and nothing else matters here.
Just click OK to apply this and you should be good, right?
So what you can do now
because you have configured everything
that was important to be configured,
you can go back to WireGuard,
you can go back to PIRs, right?
And go back to your laptop, okay?
Go back to your laptop and you can just click
on the wireless here.
I'm connected via my hotspot as my phone, right?
You can just click here and choose your VPN connection
and tell it to connect, right?
You can also go ahead and click connect here.
If you want and it will say connected, right?
And if we switch back to my micro tick quickly,
you will see that the last handshake was 12 seconds ago.
This is because we have just connected.
And once again, I'm going to go back to my laptop
and go here quickly, right?
So dot two is my laptop, right?
Of course, I'm responding to myself.
Dot one is our micro tick and of course,
it is responding because we are connected.
And let's go to another subnet.
And dot 10 is one of my home servers, right?
So there you have it.
And this is basically everything that you need to do
in order to configure your WireGuard.
I have actually wanted to show you how to do
the VPN thing with OpenBSD as my new router,
but I got stuck with, well, acquiring a proper second
network card for my new router server, which is x86 based.
It's a small server, right?
But it is what it is.
I cannot wait to release this tutorial for some other day
because I'm lacking some hardware.
So I went with micro tick and I'm going to use this
opportunity to thank everyone who has been supporting me
and also the guy who has ordered my first mug today.
I have saw it.
Thank you very much for supporting me and cheers to you, man.