Would you be kind enough to share more about your FreeBSD VPS ? What service / fees and are you happy with it ?

I'm renting a couple of VPSes from Vultr that I run FreeBSD on. Very low cost, and decent for my current use which include self-hosting email, hosting a couple of websites that receive little traffic, as well as to host the mentioned VPN, and for testing of some backend services that I am developing.

I hope to afford racks of beefy bare-metal servers one day that can sit in colocation data centers and that I can host backend services for others on. But for the time being I do not have the funds for that so a couple of small VPSes for my own use it is :)

Is your grandfather on a VPN you share with him?

Is he on static IP?

Yes, his computer is on my VPN and has a static IPv4 address inside of the VPN, 10.42.42.4, as well as a static IPv6 address inside of the VPN, fc42:4242:4242:4242::4.

I updated my comment above to note that I use my VPN for connectivity between hosts only, but across the Internet. So I can connect to any host in the VPN from anywhere in the world, but all of the hosts still send all of their other traffic via the same interface that they would if they were not part of the VPN.

So when he browses the Internet, his traffic is routed by his ISP directly and the VPN is not involved, and the same goes for my own computers and other devices.

Can you point me to some docs on how to accomplish this? I'm currently using Slack Nebula to achieve similar goals but every time I looked up WireGuard tutorials, it was to tunnel traffic through a VPS, which I didn't want to do.

On my VPS that runs FreeBSD I am using wireguard installed via

    doas pkg install wireguard

I set up WireGuard server on the FreeBSD VPS with /usr/local/etc/wireguard/wg0.conf that looks like the following:

    [Interface]
    Address = 10.42.42.1/24, fc42:4242:4242:4242::1/64
    PrivateKey = nbCsCf5Dq48ZCnCgziYoDN/E65XDVQOz7pIXGbD4Lwg=
    ListenPort = 443

    # iPhone X
    [Peer]
    PublicKey = CyHJgqaKgejt0qzHqAnFFAUJV/eNKeWoxrYNPsKQif0=
    AllowedIPs = 10.42.42.3/32, fc42:4242:4242:4242::3/128

    # stuegris
    [Peer]
    PublicKey = j2W3ocwBIYhv/fpk8T9dIh2qPWe7TfJmOprDrqu+cFU=
    AllowedIPs = 10.42.42.4/32, fc42:4242:4242:4242::4/128

    # nova
    [Peer]
    PublicKey = 3mn/IobmsopC2UrqXyIQfBoH9reWZnHiJvTk/yoFWXY=
    AllowedIPs = 10.42.42.7/32, fc42:4242:4242:4242::7/128

    # schumberry
    [Peer]
    PublicKey = 0o4aWdhGYya/FZz0jwQhTFztdwX7tmHdoyxlbjbg3D4=
    AllowedIPs = 10.42.42.10/32, fc42:4242:4242:4242::10/128

To generate the public and private keys I used

    wg genkey | tee server.private | wg pubkey > server.public

    wg genkey | tee iphone.private | wg pubkey > iphone.public

    wg genkey | tee stuegris.private | wg pubkey > stuegris.public

    wg genkey | tee nova.private | wg pubkey > nova.public

    wg genkey | tee schumberry.private | wg pubkey > schumberry.public

And then I printed the values of each of the files to the terminal simply by cat'ing them to the terminal and copying the values into the respective places. For the server, only the private key is used in the config and the server config likewise contains only the public keys for the clients. For each of the clients, as we will see below, the config contains the private key of the client in question and the public key of the server.

The names "server.private", "server.public", "iphone.private", "iphone.public", "stuegris.private", "stuegris.public", etc are just corresponding to the different hosts and devices. Likewise I have comments in the config file corresponding to which host or device each entry is for.

All of theses files "server.private", "server.public", "iphone.private", "iphone.public", and so on are just temporary. After you've created the config files for the server (above) and the clients (below) you can delete these files.

In /etc/rc.conf on the same FreeBSD server I have added

    wireguard_enable="YES"
    wireguard_interfaces="wg0"

If your server is running Linux then the setup will be different in terms of how to enable the service. For example if your server is running a disto that uses systemd, then you'd typically create a WireGuard config similar to mine but place it at /etc/wireguard/wg0.conf and then you'd run

    sudo systemctl enable --now wg-quick@wg0

On each of the clients I have corresponding configurations.

Here is what the configuration of WireGuard client for my MacBook Pro M1 looks like:

    [Interface]
    PrivateKey = 97l4pAqRXZasXU2k5S8BNp7yTa6ZyAWyNVtF3wqTpds=
    Address = 10.42.42.7/32, fc42:4242:4242:4242::7/128

    [Peer]
    PublicKey = B+nP9X0dij38FpF5/lbXe53ua7nl0fk7YMUxuTuKi20=
    AllowedIPs = 10.42.42.0/24, fc42:4242:4242:4242::/64
    Endpoint = wg.example.com:443
    PersistentKeepalive = 25

Here is what the configuration file /etc/wireguard/wg0.conf of WireGuard client on my Linux desktop looks like:

    [Interface]
    PrivateKey = sj5p3T3TdVfD567++cyyv3ChSnkzIuQlHLNgzLEPXpE=
    Address = 10.42.42.10/32, fc42:4242:4242:4242::10/128

    [Peer]
    PublicKey = B+nP9X0dij38FpF5/lbXe53ua7nl0fk7YMUxuTuKi20=
    AllowedIPs = 10.42.42.0/24, fc42:4242:4242:4242::/64
    Endpoint = wg.example.com:443
    PersistentKeepalive = 25

And I do similarily for the other client hosts and devices.

Obviously I've replaced all of the PrivateKey and PublicKey values with other values here. Other than that this is exactly how the setup is like.

Likewise, where it says "wg.example.com:443" you put the actual DNS name and UDP port (still UDP port 443 if you follow my setup) of the host that runs WireGuard server. Alternatively you could put an IP address instead of a DNS name. But in either case it needs to resolve to a static IP address, and the UDP port needs to be open to incoming traffic from the internet. In many cases you can open ports in your router if you want to host the server on your home computer. But I found it simpler to run my WireGuard server on a VPS for several reasons; VPS can be rebooted remotely, IP address is static, and also I don't need to make any changes to my setup even when moving houses and changing ISP because the server is not running from my home but from a VPS provider.

On my MacBook Pro M1 I am using Wireguard with GUI, which has a tray icon. Installed via App Store.

On my grandfather's desktop I am using Wireguard installed via Homebrew with no GUI, and with a custom launchd config file to have it connect and run always and as soon as the computer is booted. I will omit this file for brevity and clarity but can post the contents of that file as well if you would like me to do so.

On iOS I am using the WireGuard app installed via App Store.

On KDE Neon Linux I am using wireguard installed via apt from the default repositories of KDE Neon Linux.

In the above text I have omitted parts of the setup. Let me know if the details that I have included above are sufficient or if you would like to see a full writeup about the whole thing from start to finish. Note however that I do not have time to make a fully detailed writeup about it at present time so in that case it will need to be something that I write at a later point.

It doesn’t need to be. If his grandfathers computer is connecting to a “hub” server and is always connected, it will work.

Alternatively, if @codetrotter need to do the connecting, you can also setup wire guard to use a dns name, which could be dynamic.

On the VPN side, it would be a static IP though…