The configuration of Wireguard on DEBIX is divided into two parts, the first part: you need to recompile the linux-debix kernel (address: https://github.com/debix-tech/linux) on the PC to enable the wireguard driver, and then add the wireguard driver to DEBIX; the second part: configure wireguard on DEBIX.
Note: The attached kernel file is already compiled. If you don't want to recompile the kernel, please copy the appendix WireGuard file into the /lib/modules/5.10.72 folder of DEBIX; then you can skip the PC operation part.
PC operation section:
Software tool: MobaXtrem
Download address: MobaXterm free Xserver and tabbed SSH client for Windows.
(https://mobaxterm.mobatek.net/download.html)
1. Download DEBIX kernel on the PC to enable WireGuard application.
(1) Install git dependencies:
sudo apt install git bc bison flex libssl-dev make
(2) Download the source code:
git clone --depth=1 GitHub - debix-tech/linux: Kernel source of DEBIX kernel
(3) Export the environment variables:
export CROSS_COMPILE=~/tools/gcc-arm-9.2-2019.12-x86_64-aarch64-none-linux-gnu/bin/aarch64-none-linux-gnu-
export ARCH=arm64
(4) Go to the source directory and generate the default configuration file:
cd debix-kernel
make imx_v8_defconfig
(5) Enter menuconfig interface and configure the Wireguard items
make menuconfig
- The kernel version is 5.10.72, enter the Device Drivers item:
![](/Uploads/Temp/image/20231212/03.png)
- Select Network device support item
![](/Uploads/Temp/image/20231212/04.png)
- Enable modular WireGuard secure network tunnel
![](/Uploads/Temp/image/20231212/05.png)
Set to "M", then save and exit.
2. Compile the kernel on the PC and generate the wireguard.ko file
(1) Compile the kernel source code:
make -j4
(2) Compile kernel modules:
make modules
(3) Install the kernel module to out directory:
make INSTALL_MOD_STRIP=1 modules_install INSTALL_MOD_PATH=out
By comparing the pre-compilation and post-compilation kernel driver modules, the following driver module files are added after compilation:
a: 5.10.72/kernel/net/ipv6 ---- ip6_udp_tunnel.ko
b: 5.10.72/kernel/net/ipv4 ---- udp_tunnel.ko
c: 5.10.72/kernel/lib/crypto ---- libcurve25519-generic.ko
d: 5.10.72/kernel/lib/crypto ---- libcurve25519.ko
e: 5.10.72/kernel/lib/crypto ---- libchacha20poly1305.ko
f: 5.10.72/kernel/lib/crypto ---- libblake2s-generic.ko
g: 5.10.72/kernel/lib/crypto ---- libblake2s.ko
h: 5.10.72/kernel/drivers/net/wireguard ---- wireguard.ko
i: 5.10.72/kernel/arch/arm64/crypto ---- poly1305-neno.ko
j: 5.10.72 ---- modules.builtin.alias.bin
(4) File replacement:
a. Copy the extra driver files compiled in step (3) to the corresponding directory in DEBIX.
b. Replace the driver module mounting dependency file: /5.10.72/modules.dep, /5.10.72/modules.dep.bin
Replace the dependency files in the compiled kernel file with the two dependency files in the /lib/modules/5.10.72/ folder of DEBIX.
DEBIX operation section:
3. Install and configure Wireguard on DEBIX
(1) Update the application:
apt-get update
(2) Install wireguard:
apt install wireguard
(3) Check whether the installation is successful:
modprobe wireguard && lsmod | grep wireguard
If the installation is successful, it will display:
![](/Uploads/Temp/image/20231212/06.png)
(4) Configure the wireguard server:
- Create the wireguard directory
mkdir /etc/wireguard
- Enter the directory:
cd /etcwireguard
- lGenerate a pair of public and private keys via the command
wg genkey | tee privatekey | wg pubkey > publickey && cat privatekey && cat publickey
![](/Uploads/Temp/image/20231212/07.png)
(5) Wireguard PC-to-DEBIX configuration:
- First download WireGuard exe on the PC, download address:
https://www.wireguard.com/install/; According to the system you are using to choose to download, here choose for Windows.
- Second, open Wireguard, create a new tunnel, edit the configuration file.
![](/Uploads/Temp/image/20231212/08.png)
- Then, fill in the information generated on DEBIX to the configuration file on the PC.
![](/Uploads/Temp/image/20231212/09.png)
The content of the configuration file is described as follows:
[interface]
PrivateKey: client’s privateKey
Address: the virtual IP address of the client
[Peer]
PublicKey: the publicKey generated on DEBIX
AllowedIPs: the virtual IP addresses of DEBIX
Endpoint: IP address and listening port number of DEBIX
persistenKeeppalive: upload heartbeat packet interval(s)
Click Save when the configuration is complete.
(6) Get the publickey on the PC, configure the client file on DEBIX:
- Create a new wg0.conf in the /etc/wireguard folder
vim wg0.conf
- Fill in the configuration file content
![](/Uploads/Temp/image/20231212/10.png)
- Save and exit.
[Interface]
PrivateKey = #DEBIX server's private key
Address = #virtual address of the server
ListenPort = #The port number to listen on
#The following firewall settings need to correspond to the actual network card name, which may be something like ens33.
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens33 -j MASQUERADE
[Peer]
PublicKey = #client's public key
AllowedIPs = #IP address of the client's virtual network card
PersistentKeepalive = 25 #upload heartbeat packet interval(s)
wg
(8) Start wireguard:
wg-quick up wg0
Result:
(9) Exit wireguard:
wg-quick down wg0
The above is the completion of installing and running wireguard on DEBIX.