A shop in one town, files in another
A firm has a shop in one town and an office in another. Each has its own private network. The shop needs the office file server.
The only link between them is the open internet. A tunnel carries the private traffic across it, wrapped so that nobody on the way can read it.
By the end of this lesson
Note
I can explain how a tunnel joins two sites.
Key words
| Word | What it means | Example |
|---|---|---|
| Tunnel | private traffic wrapped inside other traffic | |
| Key pair | a private key you keep and a public key you share | |
| Peer | the device at the other end of a tunnel | |
| Endpoint | the public address and port where a peer can be reached | 203.0.113.2:51820 |
| AllowedIPs | the networks that may use a peer, and the routes sent into the tunnel | |
| Handshake | the exchange that shows both ends hold the right keys |
The cells students fill in are left blank in this preview.
Private networks cannot cross the internet
Each site has private addresses. The internet has no routes to them. A packet from one site to the other is dropped on the way.
A tunnel solves this. The gateway at one site puts the whole private packet inside a new packet addressed to the other gateway.
The internet only ever sees traffic between the two gateways.
Worked example: one packet, two views
| Where | Source | Destination | Visible |
|---|---|---|---|
| Inside the shop | 192.168.50.5 | 192.168.60.9 | Plain data |
| On the internet | 198.51.100.1 | 198.51.100.2 | Scrambled data in UDP |
| Inside the office | 192.168.50.5 | 192.168.60.9 | Plain data |
The cells students fill in are left blank in this preview.
Meet the two sites
wglab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Try to cross to the other site
sudo ip netns exec a1 ping -c 2 -W 1 10.2.0.2Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Read the gateway's routes
sudo ip netns exec gwA ip routeShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
What the answers say
The first Run lists four machines and their addresses. Each gateway has a second address on wan0, the link that stands for the internet.
The ping fails with Destination Net Unreachable. The gateway's table has two lines, its own site and the internet link. It has no line for the other site.
Each gateway has a key pair
Each gateway makes a key pair: a private key and a public key made from it. Nobody can work back from the public key to the private one.
The private key stays on its gateway. The public key goes to the other end, in any way you like, even by email.
Each gateway lists the other as a peer, named by its public key.
Worked example: the parts of a configuration
| Line | Section | What it says |
|---|---|---|
| PrivateKey | Interface | This gateway's own secret |
| Address | Interface | This end's address inside the tunnel |
| ListenPort | Interface | The UDP port to listen on |
| PublicKey | Peer | The other gateway's public key |
| AllowedIPs | Peer | Networks that go to this peer |
| Endpoint | Peer | Where to find the peer on the internet |
The cells students fill in are left blank in this preview.
Ask for the tunnels that exist
sudo ip netns exec gwA wg showShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Look at the folder for the configuration
sudo ip netns exec gwA ls -ld /etc/wireguardShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Count the characters in a throwaway key
wg genkey | wc -cShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
What the three answers say
The first Run prints nothing at all. There is no tunnel yet, and no keys. A command that finds nothing often says nothing.
The second Run starts drwx------. Only root may open that folder, which is right: it will hold a private key.
The third Run makes a private key and counts it without showing it. It prints 45: the key's 44 characters and the newline after them.
A common mistake
Warning
Many people think the public key is a secret too. Only the private key is. Share the public key freely. Never send the private key, and never let anyone but its owner read the file that holds it.
AllowedIPs is the route list
The AllowedIPs line does two jobs. It lists the networks that may be sent to that peer. And wg-quick, the tool that brings a tunnel up, reads it to add a route for them into the tunnel.
A packet that arrives from the peer is accepted only if its source is on that list.
A sample for a shop and an office
# The shop gateway. Other addresses than the lab's.
[Interface]
PrivateKey = (the shop gateway's private key)
Address = 10.77.0.1/24
ListenPort = 51820
[Peer]
PublicKey = (the office gateway's public key)
AllowedIPs = 192.168.60.0/24
Endpoint = 198.51.100.2:51820The handshake proves the keys
When the first packet needs the tunnel, the two gateways make a handshake. Each proves it holds the private key that matches the public key the other expects.
After that, packets flow, and the handshake repeats every few minutes while there is traffic. A tunnel with no handshake carries nothing.
Going further: break the handshake on purpose
Once your tunnel works, run sudo ip netns exec gwA wg show while a1 pings b1, and note the transfer counters.
Then change one letter of the PublicKey in gwB's wg0.conf, run wglab down and wglab up, and ping again. What does wg show say about the latest handshake now? Put the key back afterwards.