Setting up WireGuard VPN on roaming devices

Overview

Untangle NG Firewall version 16 and above supports WireGuard® VPN for secure remote access. WireGuard® is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. This article describes how to connect roaming devices including Untangle SD-WAN Router, mobile devices, and desktop systems to NG Firewall using the WireGuard app. For site-to-site tunnel configuration see Setting up WireGuard VPN Site-to-Site Connections in NG Firewall.

Server Configuration

As a first step, configure a new tunnel profile in the WireGuard app of NG Firewall. 

  1. Navigate to the WireGuard app in NG Firewall
  2. In the Tunnels tab, click Add
  3. Enter a Description to help you identify the tunnel
  4. Choose Roaming tunnel type
  5. Leave all other fields empty and click Done.

wg-add-roaming.png

Copy the profile

After you create the tunnel, copy the profile configuration.

  1. Click the gear icon in the Remote Client column associated with the tunnel. 
  2. In the Remote Configuration screen, switch the Type to Configuration File.
  3. Click the copy icon to copy the contents of the configuration.

wg-remote-config.png

Setting up the WireGuard App on a device

  1. Download and install the WireGuard app for your specific device using the following link: https://wireguard.com/install/
  2. Launch the WireGuard app and click Add Empty Tunnel
    wg-add-empty-tunnel.png
  3. Give the tunnel a name and paste the contents of profile.
  4. If you want the tunnel to connect automatically when necessary, enable the On-Demand option and specify one or more network interfaces to manage the connection.

wg-app-config.png

Alternatively, if you are configuring the WireGuard mobile app for iOS and Android you can take a picture of the QR code from the app. Choose "Create from QR code" and point the camera at the QR image provided by the tunnel profile in the NG Firewall administration.QR-Code.jpg

Connecting

To connect the tunnel, click Activate. To disconnect the tunnel, click Deactivate. If you use the On-demand option and noted previously, the tunnel activates automatically when WireGuard identifies a connection to an address specified by the Allowed IPs definition.

wg-app-connect.png

Configuring Full Tunnel

WireGuard supports Full Tunnel VPN routing. This means that when the client connects, all Internet traffic routes over the tunnel. This is useful to ensure that the device is fully protected by all security layers of NG Firewall. 

To configure full tunnel VPN, modify the AllowedIPs part of the configuration by removing all values and replacing them with "0.0.0.0/0". 

wg-full-tunnel.png

Note regarding full tunnel for Windows systems

On Windows based systems, the designation of 0.0.0.0/0 in allowedIPs blocks traffic to local networks. To maintain connectivity to local network resources, disable the option Block untunneled traffic (kill-switch). This option modifies the allowedIPs to allow access to local networks.

wg-windows-block-option.png

Configuring client DNS and network access

In some environments you may prefer to direct DNS requests from VPN clients to a specific host. You may also prefer to restrict what traffic gets routed over the VPN tunnel. These parameters are located in the Settings tab of the the WireGuard App in NG Firewall. By modifying these settings, the roaming profile adjusts to reflect the preferred DNS and AllowedIPs variables.

wg-remote-client-config.png

Follow
Was this article helpful?
7 out of 15 found this helpful
Have more questions? Submit a request

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk