Experimenting with Wireguard VPN @Mullvad.net

[Chris Laprise]

Mullvad recently added trial Wireguard VPN support, so I wrote a howto
for setting it up on Qubes:

https://github.com/tasket/Qubes-vpn-support/wiki/Wireguard-VPN-connections-in-Qubes-OS

This is Debian-oriented but easy to adapt for Fedora.

--

Chris Laprise, tas...@posteo.net
https://github.com/tasket
https://twitter.com/ttaskett
PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886

[awokd]

On Mon, November 6, 2017 16:51, Chris Laprise wrote:
> Mullvad recently added trial Wireguard VPN support, so I wrote a howto
> for setting it up on Qubes:
>
> https://github.com/tasket/Qubes-vpn-support/wiki/Wireguard-VPN-connections-in-Qubes-OS
>
> This is Debian-oriented but easy to adapt for Fedora.

Nice writeup, thank you.

[Grogins]

Sent with ProtonMail Secure Email.

-------- Original Message --------

Subject: [qubes-users] Experimenting with Wireguard VPN @Mullvad.net

Local Time: November 6, 2017 4:51 PM

UTC Time: November 6, 2017 4:51 PM

From: tas...@posteo.net

To: qubes-users <qubes...@googlegroups.com>

Mullvad recently added trial Wireguard VPN support, so I wrote a howto

for setting it up on Qubes:

https://github.com/tasket/Qubes-vpn-support/wiki/Wireguard-VPN-connections-in-Qubes-OS

This is Debian-oriented but easy to adapt for Fedora.

Chris Laprise,tas...@posteo.net

https://github.com/tasket

https://twitter.com/ttaskett

PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886

You received this message because you are subscribed to the Google Groups "qubes-users" group.

To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users...@googlegroups.com.

To post to this group, send email to qubes...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/58ea7822-448d-e745-e6f7-1a1fb3a2f927%40posteo.net.

For more options, visit https://groups.google.com/d/optout.

> Have tried to get Wireguard up on multiple occasions with both Debian

> and Fedora I get similar results every time. i.e. at step 3:

>

> [root@wireguardtey)mp ~]# qvm-copy-to-vm vpn /lib/modules/$(uname

> -r)/extra/wireguard.ko

> qfile-agent: Fatal error: stat wireguard.ko (error type: No such file or

> directory

>

> I've searched for file "wireguard.ko" but no results.

> Any ideas?

[Chris Laprise]

On 11/11/2017 10:44 AM, Grogins wrote:
>
>
>
> Sent with ProtonMail <https://protonmail.com> Secure Email.

>
>> -------- Original Message --------
>> Subject: [qubes-users] Experimenting with Wireguard VPN @Mullvad.net
>> Local Time: November 6, 2017 4:51 PM
>> UTC Time: November 6, 2017 4:51 PM
>> From: tas...@posteo.net
>> To: qubes-users <qubes...@googlegroups.com>
>>
>>
>> Mullvad recently added trial Wireguard VPN support, so I wrote a
>> howto
>> for setting it up on Qubes:
>>
>> https://github.com/tasket/Qubes-vpn-support/wiki/Wireguard-VPN-connections-in-Qubes-OS
>>
>> This is Debian-oriented but easy to adapt for Fedora.
>>
>>
>>

>> Chris Laprise,tas...@posteo.net <mailto:tas...@posteo.net>

>> https://github.com/tasket
>> https://twitter.com/ttaskett
>> PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886
>>
>> You received this message because you are subscribed to the Google
>> Groups "qubes-users" group.
>> To unsubscribe from this group and stop receiving emails from it,
>> send an email to qubes-users...@googlegroups.com

>> <mailto:qubes-users...@googlegroups.com>.

>> To post to this group, send email to qubes...@googlegroups.com

>> <mailto:qubes...@googlegroups.com>.

>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/qubes-users/58ea7822-448d-e745-e6f7-1a1fb3a2f927%40posteo.net.
>> For more options, visit https://groups.google.com/d/optout.
>>
> > Have tried to get Wireguard up on multiple occasions with both Debian
> > and Fedora I get similar results every time. i.e. at step 3:
> >
> > [root@wireguardtey)mp ~]# qvm-copy-to-vm vpn /lib/modules/$(uname
> > -r)/extra/wireguard.ko
> > qfile-agent: Fatal error: stat wireguard.ko (error type: No such file or
> > directory
> >
> > I've searched for file "wireguard.ko" but no results.
> > Any ideas?
>

You could search the different kernel versions under the /lib/modules
dir, as the wg installer sometimes makes an erroneous decision that the
kernel version you're running is not really the kernel that will be used.

Alternately, on Qubes 3.2:
https://www.qubes-os.org/doc/managing-vm-kernel/#using-kernel-installed-in-the-vm

--

Chris Laprise, tas...@posteo.net

[Chris Laprise]

On 11/11/2017 10:44 AM, Grogins wrote:
>

> > Have tried to get Wireguard up on multiple occasions with both Debian
> > and Fedora I get similar results every time. i.e. at step 3:
> >
> > [root@wireguardtey)mp ~]# qvm-copy-to-vm vpn /lib/modules/$(uname
> > -r)/extra/wireguard.ko
> > qfile-agent: Fatal error: stat wireguard.ko (error type: No such file or
> > directory
> >
> > I've searched for file "wireguard.ko" but no results.
> > Any ideas?

It must have failed to build the .ko during install. Probably the best
way around this in Qubes 3.2 is to switch to the in-template kernel, per
the link I sent. If you're using Qubes 4.0 the kernel switch process is
simpler: qvm-prefs vmname kernel ''

--

Chris Laprise, tas...@posteo.net

[grogins]

grogins:
> Chris Laprise:

>> Mullvad recently added trial Wireguard VPN support, so I wrote a howto
>> for setting it up on Qubes:
>>
>> https://github.com/tasket/Qubes-vpn-support/wiki/Wireguard-VPN-connections-in-Qubes-OS
>>
>>
>> This is Debian-oriented but easy to adapt for Fedora.
>>

[kereke...@gmail.com]

Hey! I also tried your method but can't get it to work. Dkms just can't build wireguard.ko neither on 3.2 nor 4.0rc4. Tried debian8/9, fedora25/26. Should I use a baremetal machine with the same kernel stuff and copy wireguard.ko into the vm? Is there any new information here on wireguard? Thanks!

[Chris Laprise]

I think the wiki needs to be updated with info about using VM internal
kernel. On R3.2 see
https://www.qubes-os.org/doc/managing-vm-kernel/#using-kernel-installed-in-the-vm

On R4.0 you should only need to set kernel to blank:
$ qvm-prefs vmname kernel ''

[awokd]

On Mon, February 12, 2018 5:38 pm, Chris Laprise wrote:

> I think the wiki needs to be updated with info about using VM internal
> kernel. On R3.2 see
> https://www.qubes-os.org/doc/managing-vm-kernel/#using-kernel-installed-i
> n-the-vm
>
> On R4.0 you should only need to set kernel to blank:
> $ qvm-prefs vmname kernel ''

Not sure if it's relevant to what you guys are doing, but I have an update
pending for R3.2 for that document.
https://github.com/QubesOS/qubes-doc/pull/584

[kereke...@gmail.com]

Thanks for the response. I tried the grub method on 3.2 but couldn't boot the fedora-26 vm. Installed every kernel part (4.14-16.200) and set the kernel in vm settings to pvgrub2 but it wont boot ("Cannot execute qrexec-daemon!"). 4.0rc4 same result. Any tips?

[kereke...@gmail.com]

Finally solved the issue by reinstalling all kernel modules! (3.2, fedora-26, 4.14.16-200)

[lit...@gmail.com]

On Tuesday, February 13, 2018 at 12:16:29 AM UTC, kereke...@gmail.com wrote:
> Finally solved the issue by reinstalling all kernel modules! (3.2, fedora-26, 4.14.16-200)

Hi.

I got the wireguard.ko in a fedora-25 vm, but it wont work on debian, saying that it needs to use the same kernel that it was compiled on. Plus the wireguard-dkms gives an error because it doesn't have a version for the qubes kernel so it installs 4.9.0-6.
So I decided to do it in fedora-26.
I am very new to all this, please excuse my lack of knowledge.

I have the same problem as kereke... I have been trying for a week to get it to work.Can you please post instructions and download links?
I could not find the packages for 4.14.16 , and I am not sure what files I need and what to do with them.Did i miss a step here? I did:
dkms autoinstall -k 4.14.16-200
grub-mkconfig -o /boot/grub2/grub.cfg
set the qvm-prefs to 'pvgrub2' and then to '', but neither worked
Please help.thanks.

[get]

Very useful, thanks Chris. But it works only on HVM template + qvm-prefs kernel 'none' for me.

понедельник, 6 ноября 2017 г., 19:51:43 UTC+3 пользователь Chris Laprise написал:

[John S.Recdep]

On 07/29/2018 09:24 AM, get wrote:
> Very useful, thanks Chris. But it works only on HVM template + qvm-prefs kernel 'none' for me.
>
> понедельник, 6 ноября 2017 г., 19:51:43 UTC+3 пользователь Chris Laprise написал:
>> Mullvad recently added trial Wireguard VPN support, so I wrote a howto
>> for setting it up on Qubes:
>>
>> https://github.com/tasket/Qubes-vpn-support/wiki/Wireguard-VPN-connections-in-Qubes-OS
>>
>> This is Debian-oriented but easy to adapt for Fedora.
>>
>> --
>>

>> Chris Laprise, tasket-VwIFZPTo/vqsTnJ...@public.gmane.org

>> https://github.com/tasket
>> https://twitter.com/ttaskett
>> PGP: BEE2 20C5 356E 764A 73EB 4AB3 1DC4 D106 F07F 1886
>

just curious , whats the downside of setting the kernel to 'none" "" ,
if any ?

[Ivan Mitev]

I don't see any downsides if your VM boots and works properly with its
distro supplied kernel (kernel=''), provided the kernel is up to date.

Qubes ships tweaked VM kernels to work around problems with distribution
supplied kernels - see this reply by Marek on qubes-devel:

https://www.mail-archive.com/qubes...@googlegroups.com/msg03128.html

[lit...@gmail.com]

Wireguard works in fedora-28 without kernel mods