Isolating WireGuard Networks on a Small Linux VPS Host: Setting Up Multiple VPNs
In this article, we will explore how to set up and isolate multiple WireGuard VPNs on a small Linux VPS host. This is especially useful if you have recently added another VPN for friends or colleagues to use, and want to ensure that the networks remain separate and secure.
Prerequisites
Before we begin, there are a few prerequisites that you should be aware of:
- A small Linux VPS host (e.g. DigitalOcean, Vultr, Linode)
- Root access to the VPS host
- Familiarity with the Linux command line
- Understanding of networking concepts (e.g. IP addresses, subnets)
Installing WireGuard
The first step is to install WireGuard on our VPS host. At the time of writing, WireGuard is not included in most Linux distributions by default, so we will need to install it manually.
For Ubuntu/Debian systems:
sudo apt-get update
sudo apt-get install wireguard
For CentOS/RHEL systems:
sudo yum install epel-release
sudo yum install wireguard-dkms wireguard-tools
Setting Up WireGuard Interfaces
Now that WireGuard is installed, we can set up our interfaces. For this example, we will create two WireGuard interfaces: wg0 for our existing VPN, and wg1 for the new VPN.
Let's start by creating our wg0 interface:
sudo nano /etc/wireguard/wg0.conf
Add the following configuration:
[Interface]
PrivateKey = [ generateserverprivatekey ]
Address = 10.0.0.1/28
ListenPort = 51820
Note: Replace [ generateserverprivatekey ] with a generated private key for your server. This can be done using the following command:
wg genkey
Now let's set up our wg1 interface with a unique IP address range:
sudo nano /etc/wireguard/wg1.conf
Add the following configuration:
[Interface]
PrivateKey = [ generateclientprivatekey ]
Address = 10.0.1.1/28
Note: Replace [ generateclientprivatekey ] with a generated private key for the VPN client. This can also be done using the wg genkey command.
Allowing Traffic on WireGuard Interfaces
Next, we need to allow traffic on both of our WireGuard interfaces. We can do this by adding some iptables rules:
sudo iptables -A INPUT -i wg0 -j ACCEPT
sudo iptables -A INPUT -i wg1 -j ACCEPT
This will allow incoming traffic on both of our WireGuard interfaces.
Setting Up Peer Connections
Now we need to set up our peer connections for each VPN network. For this example, we will assume that we have two VPN clients:`client1` and `client2`.
For wg0 (existing VPN):
sudo nano /etc/wireguard/wg0.conf
Add the following configuration at the end of the file:
[Peer]
PublicKey = [ client1publickey ]
AllowedIPs = 10.0.0.2/32
Endpoint = [ client1endpoint ]:51820
Note: Replace [ client1publickey ] with the public key of the first VPN client, and [ client1endpoint ] with the public IP address or hostname of the first VPN client endpoint.
We can add more peers as needed by repeating the above configuration with different keys and endpoints.
For wg1 (new VPN):
sudo nano /etc/wireguard/wg1.conf
Add the following configuration at the end of the file:
[Peer]
PublicKey = [ client2publickey ]
AllowedIPs = 10.0.1.2/32
Endpoint = [ client2endpoint ]:51820
Note: Replace [ client2publickey ] with the public key of the second VPN client, and [ client2endpoint ] with the public IP address or hostname of the second VPN client endpoint.
Starting WireGuard Interfaces
Finally, we can start our WireGuard interfaces:
sudo systemctl start wg-quick@wg0
sudo systemctl start wg-quick@wg1
In this article, we have learned how to isolate WireGuard networks on a small Linux VPS host, and set up multiple VPNs using WireGuard interfaces. We covered key concepts such as private keys, IP addresses, and peer connections. By following this guide, you should be able to set up and manage your own WireGuard-based VPNs securely.
References
-
WireGuard: Next Generation Kryptography for the Masses
Jason A. Donenfeld
-
Example WireGuard Configurations