Guide: Install Wireguard On Raspberry latest releases

[fisix]

Registered on forum just to make this post: I did some testing using wireguard client built from source as described in this guide and I was disappointed to find that it doesn't utilise the full network bandwidth (maximum I could get was 85% of bw), kernel module version 1.0.20200729-5-gdace9d0. Then I removed the kernel module and installed one provided by wireguard-dkms from raspbian testing repo (version 1.0.20200712), ran speedtest again to find that my bandwidth is fully utilized now, went from 8,5MB/s to 11.5MB/s. Go figure.

any chance you have instructions or guidance on how to do that?

ah, nevermind, i found this:

https://www.sigmdel.ca/michel/ha/wiregu ... 02_en.html

[fjleon]

maybe it's the -j parameter used to compile? wonder if you leave that out if you will have better performance. or maybe the new version has performance issues. i do not know too much about source packages so don't know how to find out what compiler flags were used. perhaps someone here has more experience and can find out if there's indeed a difference.

the whole idea behind wireguard is having more performance so if we can consistently get better performance from the testing package then i'll sure test it.

can you provide the exact steps you used to remove the compiled kernel module and replace it with the one from the testing repo?

[synapsis]

maybe it's the -j parameter used to compile? wonder if you leave that out if you will have better performance. or maybe the new version has performance issues. i do not know too much about source packages so don't know how to find out what compiler flags were used. perhaps someone here has more experience and can find out if there's indeed a difference.

the whole idea behind wireguard is having more performance so if we can consistently get better performance from the testing package then i'll sure test it.

can you provide the exact steps you used to remove the compiled kernel module and replace it with the one from the testing repo?

Sorry I don't have the exact steps anymore as I wiped my bash history, but it should be:
Unload wireguard kernel module by doing

Code: Select all

sudo modprobe -r wireguard

Remove wireguard.so from one of the directories in /lib/modules/ (depends on your raspberry pi version, mine was in /lib/modules/5.4.51-v7l+)
Install wireguard-dkms package from testing repo

You can verify the version of currently loaded kernel module by checking /var/log/kern.log, for me it says: wireguard: WireGuard 1.0.20200712 loaded

[rebe09]

Hello
I tried to install wireguard following the instructions in post #1 in this thread on the latest 64bit kernel image
( https://downloads.raspberrypi.org/raspi ... 020-08-24/ )
But after:

Code: Select all

make -C wireguard-linux-compat/src -j$(nproc)

I got:

Code: Select all

make: Entering directory '/home/pi/wireguard-linux-compat/src'
make[1]: *** No rule to make target 'modules'.  Stop.
make: *** [Makefile:26: module] Error 2
make: Leaving directory '/home/pi/wireguard-linux-compat/src'

Could anybody please advise what to do?
Did anybody already got wireguard running on 64bit kernel?

Thanks in advance
Kind regards

[ejolson]

Hello
I tried to install wireguard following the instructions in post #1 in this thread on the latest 64bit kernel image
( https://downloads.raspberrypi.org/raspi ... 020-08-24/ )
But after:

Code: Select all

make -C wireguard-linux-compat/src -j$(nproc)

I got:

Code: Select all

make: Entering directory '/home/pi/wireguard-linux-compat/src'
make[1]: *** No rule to make target 'modules'.  Stop.
make: *** [Makefile:26: module] Error 2
make: Leaving directory '/home/pi/wireguard-linux-compat/src'

Could anybody please advise what to do?
Did anybody already got wireguard running on 64bit kernel?

Thanks in advance
Kind regards

If you are running the regular 32-bit Raspberry Pi OS user land with the 64-bit kernel, you will need to set up a 64-bit chroot environment to build 64-bit kernel modules. If you are running the full 64-bit beta test of Debian Buster for Raspberry Pi, then it should just build and not building is a bug. The output when you type

Code: Select all

$ file /bin/bash

will tell which of the two alternatives you stuck in.

[rebe09]

Hello.
I'm running the full 64bit Beta.

Code: Select all

file /bin/bash

brings:

Code: Select all

/bin/bash: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, BuildID[sha1]=b11533bde88bb45ef2891fbf3ad86c1869ed3a41, stripped

The steps I did:
1. Install the beta
2. do the steps from post #1 here.

thanks

[bassamanator]

I've followed this guide up to the public/private key generation. I already have a wireguard server running elsewhere and that server has already generated a config for my raspberry pi (I used this script to install wireguard on my server https://github.com/Nyr/wireguard-install; my RPI is not the server, it's the client). On all my computers, I'm able to connect to my wireguard server via:

Code: Select all

$wg-quick up conf-file-generated-by-server

When I try the above on my RPI, however, it gives me an error(Too few arguments) and I'm unable to access the internet:

Code: Select all

(RPI is the conf file generated by the server)
$wg-quick up RPI
[#] ip link add RPI type wireguard
[#] wg setconf RPI /dev/fd/63
[#] ip -4 address add 10.7.0.3/24 dev RPI
[#] ip link set mtu 1420 up dev RPI
[#] resolvconf -a RPI -m 0 -x
Too few arguments.
Too few arguments.
[#] wg set RPI fwmark 51820
[#] ip -6 route add ::/0 dev RPI table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip6tables-restore -n
[#] ip -4 route add 0.0.0.0/0 dev RPI table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
[#] iptables-restore -n

This method has worked on all my machines except on my RPI. How come?

[kevmayer123]

Hi, I've set up a Wireguard VPN on my Raspberry Pi 3B+. It works great. I set it up so my friend who lives part-time in Spain can watch BBC iPlayer. He was using ExpressVPN but the BBC recognized it was being used by a VPN service and cut off the link, hence, no more iPlayer in Spain. But, wireguard VPN on my Raspberry Pi now works a treat. I also used the QR code to set up my iPhone and can now annoy my wife over Alexa.

The only problem is I now need to get a second Raspberry Pi to do other projects.

I have a question. In the wg0.conf file the line '#PersistentkeepAlive = 60' is a statement.

I sometimes fail to connect to the VPN from work on my iPhone and wondered if the 'PersistentkeepAlive' function would help if it were enabled?

Regards
Kevin

[BenoitSvB]

I suppose '#PersistentkeepAlive = 60' means it IS enabled with a DEFAULT 60 seconds interval.

[kevmayer123]

Hi, that's correct. set at 60 seconds, but the # at the beginning of the line means the code isn't used. The line is just a 'comment'.

To enable 'PersistentkeepAlive = 60' we need to remove the '#'.

[BenoitSvB]

You are right, I wrongly supposed a self-documentary style.
From man wg: "...
PersistentKeepalive — a seconds interval, between 1 and 65535 inclusive, of how often to send an authenticated empty packet to the peer for the purpose of keeping a stateful firewall or NAT mapping valid persistently. For example, if the interface very rarely sends traffic, but it might at anytime receive traffic from a peer, and it is behind NAT, the interface might benefit from having a persistent keepalive interval of 25 seconds. If set to 0 or "off", this option is disabled. By default or when unspecified, this option is off. Most users will not need this. Optional.
..."

[smiffyb]

A few days ago both my Pi 3b's stopped running wireguard. Turns out it was down to allowing unattended updates. So i have spent the last few days trying to get them up and running again. Not sure why but your method brought them both back. Thanks

[jelbo]

Good instructions that got it up and running here a while back, but now an update broke it.

How can I update this install? A new git clone and make give errors.

How can I uninstall this version?

[BenoitSvB]

... A new git clone and make give errors...

What error and doesn't the error give a clue?