|
WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It can be a useful replacement for IPSec or OpenVPN.
Official website: https://www.wireguard.com
On DebianBuster, wireguard is available from Backports. If your sources list contains the backports stanza, you can install wireguard from the Apps section of FreedomBox web interface.
WireGuard cannot be installed in FreedomBox on buster-backports yet, because a newer version of NetworkManager is required by the FreedomBox service to complete the setup.
Point-to-point tunnel
VPN client with default route
WireGuard has a user space implementation for mobile devices available via the WireGuard app - available for Android and iOS (a full list of supported operating systems is available here).
The client can be configured in several ways:
This is self-explanatory, you actually create the config on the mobile device then transfer the relevant keys to the server's config.
Here you have to create a .zip archive of the client configuration file, transfer it to the device then import it into the app.
The mobile client as of version 0.0.20180724 supports QR code based input.
DebianPackage:qrencode can be used to generate qr codes, even in a terminal/console using UTF8 characters.
The syntax is:
# qrencode -t ansiutf8 < client.conf
This will generate a QR code that is readable by the mobile client.
The advantage of this approach is that there is no need to transfer sensitive information via data channels that can potentially be compromised and there is no need for any additional software.