@@ -0,0 +1,168 @@
+---
+title: Wireguard OpenWRT Travel Router Tutorial
+author_profile: false
+toc: true
+toc_label: "Table of Contents"
+toc_icon: "cog"
+tags: openwrt wireguard vpn travel-router
+categories: self-hosted
+header:
+  teaser: /assets/images/travelRouter.PNG
+---
+{% include video id="" provider="youtube" %}
+
+# OpenWRT Wireguard Travel Router
+
+# Pre-Requisite
+The travel router will be a Wireguard Peer, so you will need an existing Wireguard server setup.
+Any of the previous examples will work as the Wireguard server. This tutorial will only cover setting up the Peer, not the server, since those steps were covered in other tutorials on the site.
+
+You will also need:
+ - Raspberry Pi
+ - Wireless Adapter Compatible with OpenWRT
+ - Micro-SD card for OpenWRT
+ - OpenWRT
+ - Wi-Fi
+ - Ethernet cable
+
+# Setup
+ Download OpenWRT for your Raspberry Pi. Install it onto the sd card and then follow the next steps.
+
+1. Power on your Raspberry Pi and connect a LAN cable to the ethernet port and connect your computer to that LAN cable.
+
+2. The router should give out a DHCP address. If not, you will have to set your IP to 192.168.1.
+OpenWRT uses 192.168.1.1 by default
+
+
+# OpenWRT
+Once you are able to access the admin gui interface on the Raspberry Pi navigate to the wireless section.
+
+# Radio0
+Network -> Wireless
+
+![Radio0](/assets/images/radio0.png)
+
+1. Radio0 is the on-board wifi of the Rpi. Enable this device and then scan for wifi.
+2. Find your home network and connect to it.
+
+![Radio0 Connection](/assets/images/joinNetwork.png)
+
+3. After you’ve found your network select “Replace wireless configuration”
+4. Set the name to wwan
+5. Enter the WPA passphrase of your network and then click submit.
+6. You will be brought to another config page, but just click save and do not make changes
+7. This will give the Rpi network access.
+
+
+# Update and Install Packages
+After you’ve connected the RPi to your local wifi you can update and install packages.
+
+You will need to SSH into the Raspberry Pi and then run these commands.
+
+To ssh run the following `ssh root@<rpi-IP>`. Repace `<rpi-IP>` with your actual IP. Usually it's `192.168.1.1`
+
+Run 
+```bash
+opkg update
+``` 
+to download the package repository list.
+
+Then install wireguard.
+```bash
+opkg install wireguard-tools luci-app-wireguard
+```
+
+Both these commands can be run in the GUI. 
+
+## Install USB Drivers
+After you’ve installed Wireguard you will also need to install USB Drivers.
+
+Run: 
+```bash
+opkg install kmod-rt2800-lib kmod-rt2800-usb kmod-rt2x00-lib kmod-rt2x00-usb kmod-usb-core kmod-usb-uhci kmod-usb-ohci kmod-usb2 usbutils
+```
+
+# Radio1
+
+![lsusb before](/assets/images/lsusb%20before.png)
+Run `lsusb` in the console to see what devices are connected to the RPi. After you have the list connect your wifi card to the USB port on your RPi.
+
+![lsusb after](/assets/images/lsusbafter.png)
+Run `lsusb` again to see if a new device has been discovered. In this case the `Ralink 802.11 n WLAN` device has been found. Now you can switch back to the GUI
+
+## Radio1 Config
+Under Network→Wireless you should now see a second radio device (radio1). Click Edit to bring up the config menu.
+![radio1](/assets/images/radio1.png)
+
+![radio1Config](/assets/images/raido1.PNG)
+1. Mode: Access Point
+2. ESSID: Anything you want (default OpenWRT)
+3. Network: wwan
+
+Select Wireless Security.
+![radio1 Security](/assets/images/radio1ConfigSecurity.png)
+
+1. Encryption: WPA2-PSK/WPA3-SAE Mixed Mode
+2. Key: This should be no less than 16 characters
+3. Click Save
+4. Then on the main Wireless Screen click save and apply
+5. Also be sure to enable the device
+
+# Wireguard Setup
+Network → Interfaces
+1. Select Add new interface
+
+![Create new Interface](/assets/images/createNewInt.png)
+
+1. Name: wg0
+2. Protocol: WireGuard VPN
+
+**NOTE**: If `WireGuard VPN` does not show in the protocol list you may have to reboot your raspberry pi.
+![wg0 interface](/assets/images/wg0Interface.png)
+
+## General Settings
+**NOTE You will need to create a peer on your Wireguard server prior to completing this step. The tutorial assumes you have already done so.**
+
+1. Generate new Key Pair
+2. Ip Addresses: This will be the IP of the Peer you configure on your WG server.
+
+The Public Key here will also go on your WG server as the Peer Public Key.
+![wg0 Config](/assets/images/wg0Config.png)
+
+## wg0 Peer
+![wg0 Peer Config](/assets/images/peerConfig.png)
+
+1. Description: Anything you want
+2. Public Key: Server’s public key
+3. Private key: leave blank
+4. Preshared Key: PSK generated from server (do not generate here)
+5. Allowed IP’s: `0.0.0.0/0,::/0` (allow all IPv4 & IPv6 Traffic)
+6. Route Allowed IPs: `Check`
+7. Endpoint Host: Public IP of your server
+8. Enpoint Port: Port that wireguard is running on your server.
+
+Once this has been completed. Click save and then click save and apply on the main Interface Page. You may have to restart the `wg0` interface to establish a connection.
+# Firewall
+Next we have to move back to the terminal to setup the firewall rules.
+
+I reccommend copying the commands 1 by 1 to ensure everything is correct.
+```bash
+uci rename firewall.@zone[0]="lan"
+uci rename firewall.@zone[1]="wan"
+uci del_list firewall.wan.network="wg0"
+uci add_list firewall.wan.network="wg0"
+uci commit firewall
+/etc/init.d/firewall restart
+```
+
+1. Set zone 0 to lan
+2. Set zone 1 to wan
+3. Remove wg0 from wan network
+4. Add wg0 to wan network
+5. commit changes
+6. restart the firewall
+
+# Verify
+After committing firewall changes you may have to reboot the RPi to get successful connection.
+
+Once the device comes back online you should see traffic on the Network→Interfaces page under the wg0 interface. Rx & Tx should have numbers.
@@ -0,0 +1,144 @@
+---
+title: PfSense Wireguard Server Tutorial
+author_profile: false
+toc: true
+toc_label: "Table of Contents"
+toc_icon: "cog"
+tags: pfsense wireguard vpn travel-router
+categories: self-hosted
+header:
+  teaser: /assets/images/pfsense.PNG
+---
+{% include video id="" provider="youtube" %}
+
+# Install Wireguard Package
+Go to System → Package Manager → Available Packages.
+
+Search for “Wireguard”
+
+![Wireguard Package](/assets/images/wgpkg.PNG)
+At the time of making this, version 0.1.6_2 is the most up to date.
+# Tunnel Config
+
+From the menu at the top, select VPN → Wireguard.
+
+Select [+ Add Tunnel]
+
+![Tunnel](/assets/images/tunnel.PNG)
+
+![Tunnel Config](/assets/images/tunnelConfig.PNG)
+
+1. Enable tunnel
+2. Set a description for the tunnel
+3. Set the port to anything. (Default is 51820)
+4. Click “Generate”  to create your public and private keys. 
+5. Create interface addresses.
+
+Interface addresses can be any internal IP address range. Here I chose the `10.0.0.1/24` subnet.
+
+Meaning I can use `10.0.0.2-10.0.0.255`
+See [RCF1918](https://www.rfc-editor.org/rfc/rfc1918).
+
+Once finished, click save. Then go to Peers.
+
+# Peer Config
+
+![Wireguard Peer](/assets/images/wgpeer.PNG)
+1. Enable peer.
+2. Select the tunnel you created (in this case tun_wg0).
+3. Set a Description.
+4. Keep the endpoint dynamic.
+5. Keep Alive: leave blank.
+6. Public Key* this will be generate from your app.
+7. Pre-Shared Key (optional but can provide quantum protection) Click [Generate] to create one.
+8. Allowed IP’s: Set this to an address that has not been used in your subnet yet. 
+Ex: 10.0.0.2/32 (means only 10.0.0.2)
+
+
+# App Config: Android
+![Pfsense Peer](/assets/images/pfSensePeer.png)
+
+1. Interface Name: Pfsense or any name you prefer 
+2 Click the refresh icon in the Private Key section to generate a public and private key.
+3. The addresses should be the address you gave to the peer. In this case it is 10.0.0.2/32.
+4. DNS Servers: You can set the DNS server to the upstream DNS on your network (usually 192.168.0.1 or 10.0.0.1) if you created a DNS for the tun0 interface, or leave this blank.
+5. MTU leave empty.
+6. Copy the Public Key and paste it into the Public Key section for the Peer on the server. See Slide 7, #6.
+
+Then select “Add Peer” at the bottom
+![PfSense Config](/assets/images/pfSenseConfig.png)
+1. Public Key: Copy the public from the server. (Slide 6 #4)
+2. Pre-shared key: Copy the pre-shared key from the server. (Slide 7 #7)
+3. Persistent keepalive: Leave Blank
+4. Enpoint: This should be the public IP of your server. In my case my PFsense box is a VM on my local net so the IP is 192.168.0.44. Also :51820 is the port specification we configured.
+5. Allowed IPs: 0.0.0.0/0 means any IP address on IPv4 and ::/0 means any IP address on IPv6. Setting it up this way means we created a Full-Tunnel. All traffic on the device will be routed through the wireguard VPN.
+
+# Firewall Config
+Select Firewall → Rules from the main menu.
+
+![Firewall Wan Default](/assets/images/FirewallRulesWANDefault.PNG)
+By default your WAN should only have 1 rule.
+
+Block bogon networks.
+
+Mine has an additional rule since I do not have a LAN address on this VM. Ignore this rule.
+
+Select “Add \/”
+
+![Firewall Rule Settings](/assets/images/FirewallRuleSetting.PNG)
+1. Action: Pass
+2. Interface: WAN
+3. Address Family: IPv4
+4. Protocol: UDP
+5. Source: any
+6. Destination: WAN address
+7. Destination Port Range: Custom: 51820 to Custom: 51820
+8: Log Packets: Optional (can create a lot of spam)
+9. Description: Wireguard – Allow WAN 51820
+
+Then click Save. You may have to click appy changes after you save.
+
+## Wireguard Firewall
+By default there are no rules to allow Wireguard traffic anywhere. We need to create 1 rule to allow all traffic. But be warned, this tutorial does not cover how to properly segment your network and add additional security to your wireguard interface. VLANs, proper firewall rules, and network segmentation is important.
+
+![WG Rules](/assets/images/wgRules.PNG)
+
+Select Add to create a new rule
+
+
+![Allow All](/assets/images/AllowAll.PNG)
+1. Action: Pass
+2. Interface: Wireguard
+3. Address Family: IPv4
+4. Protocol: Any
+5. Source: Any
+6. Destination: Any
+7. Log: Optional
+8. Description: Allow all
+9. Save
+
+
+Apply Changes after saving
+
+## NAT Rules
+Select Firewall → NAT and then Outbound to arrive at this page.
+![NAT Default](/assets/images/HybridNAT.PNG)
+
+In order to route Wireguard traffic back out the WAN we need to configure a few things in the NAT settings.
+
+Set Outbound NAT Mode to Hybrid.
+
+![NAT Default](/assets/images/FirewallNATOutbound.PNG)
+Select “Add /\” under Mappings to create a new NAT Outbound Mapping.
+
+![NAT Settings](/assets/images/NAT-settings.PNG)
+1. Interface: WAN
+2. Address Family: IPv4
+3. Protocol: any
+4. Source: Network – 10.0.0.1/24
+
+Then click save. You may need to apply the changes after clicking save.
+
+# Verify
+![Verify](/assets/images/VerifyStatus.PNG)
+After saving and reloading the firewall go back to VPN → Wireguard → Status. Click the down arrow on the tun_wg0 tunnel. You should see that the peer you created has successfully been created.