# WireGuard VPN Configuration Examples

## Overview

This directory contains example WireGuard VPN configurations for the SAW implementation.

## Files

```
config/wireguard/
├── wg0.conf.example    # Example WireGuard configuration
├── README.md           # This file
└── setup-vpn.sh        # VPN setup script (optional)
```

## Quick Start

### 1. Generate Keys

```bash
# Generate server keys
wg genkey | tee server_private.key | wg pubkey > server_public.key

# Generate client keys
wg genkey | tee client_private.key | wg pubkey > client_public.key
```

### 2. Configure Server

Create `/etc/wireguard/wg0.conf` on VPN server:

```ini
[Interface]
PrivateKey = <server_private_key>
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.0.0.2/32
```

### 3. Configure Client (SAW)

Copy the example config and update with your keys:

```bash
cp config/wireguard/wg0.conf.example /etc/wireguard/wg0.conf

# Edit the configuration
nano /etc/wireguard/wg0.conf
```

### 4. Start VPN

```bash
# Start WireGuard
sudo wg-quick up wg0

# Check status
sudo wg show

# Enable auto-start
sudo systemctl enable wg-quick@wg0
```

## Example Configuration

### wg0.conf.example

```ini
[Interface]
# Your WireGuard private key (generated with: wg genkey)
PrivateKey = YOUR_PRIVATE_KEY_HERE
# VPN interface IP and subnet
Address = 10.0.0.2/24
# DNS servers (should be VPN gateway)
DNS = 10.0.0.1

[Peer]
# VPN server's public key
PublicKey = YOUR_SERVER_PUBLIC_KEY_HERE
# VPN server's endpoint (IP:port)
Endpoint = vpn.example.com:51820
# Which IPs to route through VPN (0.0.0.0/0 = all traffic)
AllowedIPs = 0.0.0.0/0, ::/0
# Keep connection alive (optional)
PersistentKeepalive = 25
```

### Configuration Parameters Explained

#### [Interface] Section

| Parameter | Description | Example |
|-----------|-------------|---------|
| `PrivateKey` | Your WireGuard private key | Generated with `wg genkey` |
| `Address` | VPN interface IP and subnet | `10.0.0.2/24` |
| `ListenPort` | Port to listen on (server only) | `51820` |
| `DNS` | DNS servers to use | `10.0.0.1` |

#### [Peer] Section

| Parameter | Description | Example |
|-----------|-------------|---------|
| `PublicKey` | VPN server's public key | Generated on server |
| `Endpoint` | VPN server address and port | `vpn.example.com:51820` |
| `AllowedIPs` | IPs to route through VPN | `0.0.0.0/0, ::/0` |
| `PersistentKeepalive` | Keep connection alive (optional) | `25` |

## Security Considerations

### Key Management

1. **Generate keys securely**
   - Use `wg genkey` (cryptographically secure)
   - Never share private keys
   - Store keys in encrypted storage

2. **Use strong encryption**
   - WireGuard uses ChaCha20-Poly1305 (default)
   - Curve25519 key exchange (default)
   - No weak algorithms

3. **Restrict AllowedIPs**
   - Only allow necessary subnets
   - Use `/32` for single IPs
   - Avoid `0.0.0.0/0` if not needed

### Network Security

1. **Firewall configuration**
   - Allow WireGuard port (UDP 51820)
   - Block other ports
   - Implement egress filtering

2. **DNS security**
   - Use VPN gateway DNS
   - Block external DNS
   - Consider DNS-over-TLS

3. **Keep-alive settings**
   - Use `PersistentKeepalive` for NAT traversal
   - Set appropriate interval (25 seconds recommended)
   - Disable if not needed

## Troubleshooting

### VPN Not Connecting

```bash
# Check WireGuard status
sudo wg show

# Check configuration
sudo wg-quick diff wg0.conf

# Check logs
sudo journalctl -u wg-quick@wg0

# Test connectivity
ping -I wg0 <server-ip>
```

### DNS Not Working

```bash
# Check DNS configuration
cat /etc/resolv.conf

# Test DNS resolution
nslookup example.com

# Check firewall
sudo firewall-cmd --list-all
```

### Routing Issues

```bash
# Check routing table
ip route show

# Check WireGuard routes
ip route show table 51820

# Test routing
ping -I wg0 <external-ip>
```

## Advanced Configuration

### Split Tunneling

Route only specific traffic through VPN:

```ini
[Peer]
# Only route corporate network
AllowedIPs = 192.168.1.0/24, 10.0.0.0/8
```

### Multi-Hop VPN

Chain multiple VPN servers:

```ini
[Peer]
# First hop
PublicKey = <first_hop_public_key>
Endpoint = <first_hop_endpoint>
AllowedIPs = 10.1.0.0/24

[Peer]
# Second hop (behind first hop)
PublicKey = <second_hop_public_key>
Endpoint = <second_hop_endpoint>
AllowedIPs = 10.2.0.0/24
```

### Load Balancing

Multiple servers for redundancy:

```ini
[Peer]
PublicKey = <server1_public_key>
Endpoint = <server1_ip>:51820
AllowedIPs = 10.0.0.0/24

[Peer]
PublicKey = <server2_public_key>
Endpoint = <server2_ip>:51820
AllowedIPs = 10.0.0.0/24
```

## References

- [WireGuard Documentation](https://www.wireguard.com/)
- [WireGuard Quick Start](https://www.wireguard.com/quickstart/)
- [WireGuard Android/iOS](https://www.wireguard.com/install/)
- [WireGuard Windows](https://www.wireguard.com/install/)

## Support

For WireGuard configuration help:
- Check logs: `sudo journalctl -u wg-quick@wg0`
- Verify config: `sudo wg-quick diff wg0.conf`
- Test connectivity: `ping -I wg0 <server-ip>`