WireGuard VPN setup on Ubuntu 24.04

VPN
1

So I’ve been using Linux for some time now around my network for servers, but only as CLI servers. With the way Windows is getting worse at spying and telemetry gathering, I decided it was time to try daily driving Ubuntu Desktop, namely 24.04. Its been YEARS since i last tried the desktop enviroment, and wow, I’ve been blown away at how far hardware support has come. Ubuntu even had drivers for my LG Gram 16, including things like the keyboards Hot Keys, drivers for my USB dock/Monitor, just everything has worked (with the SOUL exception of the finger print reader).

The only stumbling block has been getting it setup with my Unifi Wireguard VPN.

TLDR:

I know the VPN server is configured right as its been working flawlessly for 6 months now for all my other devices (since moving from L2TP), but when I attempt to import the config file from Unifi (which i know works with my window machines), it errors out. Its worth adding WireGaurd Native Support is a new feature in 24.04 (so I’ve read) so I want to get that working rather than installing an additional client. I have tried opening the config file and using the info within to set it up manually but it just doesn’t work. Has anyone come across this at all, or could steer me in the right direction?

Thanks

Sprint

I renamed the file to .opvn when .conf didn’t work, same result

2

Hello! Thanks for posting on r/Ubiquiti!

This subreddit is here to provide unofficial technical support to people who use or want to dive into the world of Ubiquiti products. If you haven’t already been descriptive in your post, please take the time to edit it and add as many useful details as you can.

Please read and understand the rules in the sidebar, as posts and comments that violate them will be removed. Please put all off topic posts in the weekly off topic thread that is stickied to the top of the subreddit.

If you see people spreading misinformation, trying to mislead others, or other inappropriate behavior, please report it!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

3

you don’t really need to import anything, the client configuration is straight-forward:

[Interface]
PrivateKey = client's private key (matching the client's public key registered on the VPN server)
Address = client's IP address with netmask /32 (assigned by the VPN server)
DNS = comma separated DNS servers

[Peer]
PublicKey = VPN server's public key
AllowedIPs = 0.0.0.0/0
Endpoint = public IP address:port of the VPN server
4

The way I installed wireguard on my Debian machine (same issue as on Ubuntu, can’t import profile in GUI):

  • Install WireGuard (sudo apt-get install wireguard)
  • Create WG profile on UDM, download, and apply changes
  • Copy profile to WireGuard folder (sudo cp profile.ext /etc/wireguard/wg0.conf)
  • Make profile unavailable to “everyone” (sudo chmod go-r /etc/wireguard/wg0.conf)
  • Import profile (sudo nmcli connection import type wireguard file /etc/wireguard/wg0.conf)
  • Optionally rename connection to something less cryptic (sudo nmcli connection modify wg0 connection.id "human friendly name")

This gives me an always-on VPN to my UDM over WireGuard.

5

yeah this is basically the output/content of the config file from my UDM. I’ve manually inputted them into the VPN profile, but while the VPN icon lights up, no traffic passes, so I’m not sure whats going on… :confused:

6

#!/usr/bin/env bash

# https://www.reddit.com/r/Ubiquiti/comments/1ewan95/wireguard_vpn_setup_on_ubuntu_2404/

# Installing WireGuard

sudo apt-get update && sudo apt-get install wireguard -y

# Create WireGuard profile on UDM, download, and apply changes

# (Manual step)

# Copy the WireGuard profile to the WireGuard folder

sudo cp “~/Downloads/VPNServerWireGuard-Client.conf”/etc/wireguard/wg0.conf

# Make the WireGuard profile unavailable to ‘everyone’

sudo chmod go-r /etc/wireguard/wg0.conf

# Import the WireGuard profile for NetworkManager

sudo nmcli connection import type wireguard file /etc/wireguard/wg0.conf

# Un-tick “Make available to other users”

nmcli connection modify wg0 connection.permissions user:$(whoami)

# Verifying Permissions, you can check what permissions are set by running

nmcli connection show wg0 | grep permissions

# Optionally rename the connection to something less cryptic

sudo nmcli connection modify wg0 connection.id “Home (WG)”

# Inspect Connection Details, especially the ‘permissions’ line

nmcli connection show “Home (WG)”

7

UDM? why would UDM store clients’ PRIVATE key??
The VPN server needs only clients’ PUBLIC keys and you certainly can’t use those for configuring another client. You need the private key.

You need to copy the settings from one of the Windows clients (or just register a new peer on your VPN server and do it properly).

8

Couldn’t have written it better myself, that’s exactly how I set up my laptop VPN

9

So I just double checked, by re-generating a new client under WireGuard VPN, and when I export the config file, sure enough it provides it with a Private key… and Ubuntu will not allow me to save the VPN profile unless that private key field is populated? (I’m no VPN expert, i just know enough to fumble through setting them up :stuck_out_tongue: )

10

yeah, if you’re using some kind of peer generator then it will generate a new public/private key-pair, it just shouldn’t store clients’ private keys afterwards…

Try if the generated config works with the official wireguard client, then at least you’ll know the config is ok and you can start troubleshooting ubuntu’s network manager.

11

I know the config works as i use it in the wiregaurd client on my windows machine, and yes I only get that private key when I first generate the profile. If I go back in afterwards on the UDM, its not there.