VPN
Server
Note
When creating the VPN server, prefix the host name with vpn-
so
the Salt states pick up the correct defaults.
Client (Linux)
Run the salt-minion-setup
script (to add the server to the KB VPN)
(should be in the ~/Private/scripts/src
folder):
The
salt-minion-setup
script creates the private and public keys on the client and displays the public key on the screen.These need to be added to the
sites/vpn-my.sls
pillar file on the Salt master.Apply the states.
Restart the interface (
wg-quick down wg0 && wg-quick up wg0
).
Tip
Don’t forget to setup the Wireguard - Configuration
Client (Windows)
Download and install Wireguard https://www.wireguard.com/install/
Log in as an administrator and Create a new connection (Add empty tunnel) This will create an ini file with a public and private key.
Copy the Public key to your Salt master and configure the pillar for your VPN server e.g:
cd /srv/pillar
vim sites/vpn-my.sls
Add the IP address to the dns
, zones
and vpn
sections e.g:
server_meta:
dns:
zones:
- name: db.my.vpn
entries:
- { name: '', type: A, value: 10.10.3.1 }
- { name: my-test-laptop, type: A, value: 10.10.3.101 }
vpn:
peers:
my-test-laptop:
PublicKey: <public key of your windows workstation>
AllowedIPs: 10.10.3.101/32
Apply the salt state…
Back to the Wireguard Windows client…
Add the following to the connection (adjusting to match your network):
Address = 10.10.3.<Free node number>/32
DNS = 10.10.3.1
[Peer]
PublicKey = <public key of your VPN server>
AllowedIPs = 10.10.3.0/24
Endpoint = vpn-my.hatherleigh.info:51820
PersistentKeepalive = 25

Save and Activate

Troubleshooting
Connection issues
The PublicKey
in the Peer
section of the configuration is the public
key of the server, not the workstation:
[Peer]
PublicKey = abc123...
DNS
Restart the laptop or:
sudo -i
wg-quick down wg0 && wg-quick up wg0
Tip
Does sudo wg show
display more than VPN tunnel?
MD is running 22.04 and name resolution has changed since 20.04
(systemd-resolve
no longer exists - it’s been replaced with
resolvectl
) (perhaps there are other changes under the hood
that helps with having multiple tunnels).
Unstable connection
Check to make sure you are not using the configuration in two (or more) places!
Malcolm says:
Yes the vpn configuration file specifies the IP address - so two vpn connections using the same config will constantly break each other