I obviously mean the typical use case for VPN, that is to hide your location.
In this example we will use wireguard to setup the following:
(Different Private Locations) <-> Frankfurt VPS <-> NJ VPS <-> USA websites
Your adversaries will see you connect to Frankfurt. Why Frankfurt? Well perhaps it’s a modern 1984 and you’ve found yourself in Oceana, Eurasia, Eastasia, and the safest hop to which your adversaries might find acceptable for you to communicate some soccer video game traffic to is Germany. I’m of course kidding around, gotta have fun right?
Anyway let’s configure our first hop, which is the most interesting part of the puzzle:
This is the entrypoint from the private location. (Entrypoint… hmm, sounds like I’ve been influenced by Docker)
First step let’s create the wireguard server that private client will connect to.
We’ll use an innocuous port commonly used for a popular video game (some kind of soccer game that’s popular over there, I don’t remember which, and it does not matter)… and NAT all our traffic through this server.
Forgot how to generate wireguard keys? Go to the official site, it’s all there. https://www.wireguard.com/quickstart/ If you want to use PreShared keys it’s
# Privacy centric for world travel...
But we don’t want to stop there…
We want traffic to flow on to a US-based server that we can also control.
This traffic will be private, within the wireguard network, so your adversaries will just see your game server playing another video game…
Create a wireguard config that will connect to our New Jersey VPS:
# Connect us up to the NJ Vultr to NAT Frankfurt's traffic
We will have routing table issues, so let’s handle that with some ruby…
As I wrote in the comment at the time…
This watches for wg0 connections and automatically add/removes routes
so that i can be mobile yet still appear from NJ regardless of where I
connect to the frankfurt rig from
In the above script, the hardcoded IP and device name would need to change. These are just the IP address given by the platform company (Vultr in this case), and the network interface name.
Moving on to the systemd service unit…
Frankfurt is done, start up the services and move on to the New Jersey VPS…
systemctl start email@example.com
Where’s wg1? I had used that to connect back to a Dallas VPS which connects a few other things like home, office, etc.
It’s really great to learn how basic routing works, and with wireguard it seems anything is possible with relative ease, as this exercise seems to reveal.
Picking another gaming port just to throw them off some more. Frankly I can’t tell the difference anymore.
We’re all set!
Wait, what about the clients?
Well you saw # MBP and # CM, those are my macbook and my windows computers. The clients are simple… Here’s MBP:
Here’s # CM
Everything here has since been deleted, so don’t judge me for not scrubbing keys, IPs, etc, again this was just an exercise and is here for reference to those that actually might need it and don’t have time to hack and slash/search their way to a working setup!
Perhaps in the future I’ll expand on this to have another port to effectively replace NJ with a home computer since certain websites will flag “normal web traffic” coming from a VPS/datacenter but not residential ISPs.
Something like this: Private Location <-> Frankfurt VPS <-> USA Home Computer <-> USA websites
I hope this showcases how powerful wireguard can be and provides some examples for those searching and dealing with this problem-set looking for reference.
Luckily I do not have a need for such capabilities, but it is good to know it can be done so easily and how. Reinforces my faith in humanity in some ways, and given world events over the last few years man do I appreciate the reinforcement.
Since learning mikrotik last year, and wireguard this year, I’ve found myself using this routing knowledge and especially wireguard daily for both home (mobile access to home network resources) and work (work from home problem-sets, connecting servers together to expose a private service to some employees, etc), this exercise is just another example of an important use case which wireguard solves perfectly. What an incredible piece of software.