Some lesser known WireGuard settingsThings I will probably forget in an important moment
I extensively use WireGuard to keep various devices connected across foreign and unstable networks. Over the past few years of doing this, I've discovered a few handy configuration tricks that can help in weirdly specific situations. The following is a short overview to be used as reference in the future.
When configuring a client, you can specify DNS servers to use. This is useful for sending people config files that automatically point to your own DNS server.
[Interface] # ... DNS = 2606:4700:4700::1111, 184.108.40.206
While manually setting DNS servers may not be a huge deal, it is important to note that this also works for search domains.
Thus, if you had records for the clients on your network in
laptop.example.com) and added the following to your
DNS = example.com
The devices would become resolvable by just their hostname. For example,
ping phone would do the same as
Disabling the routing table
Anyone who has tried using a dynamic routing protocol over WireGuard knows that it is a pain to get traffic to go where you want. Luckily, you can force WireGuard to not touch the routing table at all, allowing you to use your own routing protocol instead.
[Interface] # ... Table = off [Peer] # ... AllowedIPs = ::/0, 0.0.0.0/0
AllowedIPs line is still required for WireGuard to send traffic to the peer.
Playing nice with the firewalld
In my own experimentation, I've noticed that WireGuard interfaces on Fedora will by default take the most lax firewall policy on the device. This is sub-optimal for many reasons.
To fix this, you can make
wg-quick also configure the firewall for you during interface setup.
[Interface] # ... PostUp = firewall-cmd --zone public --add-interface %i PostDown = firewall-cmd --zone public --remove-interface %i
Now, the interface will be governed by the
public zone, which is generally the strictest zone on the system.