WireGuard Connection Wizard

First, provision a server at the cloud site to use as the WireGuard gateway at the site. Make sure it has a publicly-accessible IP address (we’ll use 203.0.113.2 for example), and that the server and site’s firewalls allow public access to some UDP port (we’ll use 51822). For convenience, you may want to set up a DNS entry for the IP address (like vpn.example.com). Install WireGuard on the server.

Next, log into https://pro.custodib.us/, navigate to the Hosts page, and click the Add icon:

Enter a display name for the host, like “VPN Server”, into the Name field. For the Configuration options, select the “Create new WireGuard configuration to push to host” radio button. Then click the Add button:

This will create a new host record for the server on Pro Custodibus, and launch you into the Connection Wizard.

On the first step of the Connection Wizard, select the “Point-to-Site, as Site” radio button from the Type option list (many of the options will be customized with the host name you chose on the previous page, eg “Point-to-Site, VPN Server as Site”). Then click the Next button:

On the second step, click the New button next to the Site Peer field on the left side of the page:

In the Add Peer dialog, enter a name for the WireGuard peer identity of the server, like “VPN Server”, into the Name field. Then click the Generate button to generate a new WireGuard key pair:

Click the Add button to add the new peer identity:

Then click the New button next to the Point Peer field on the right side of the page:

In the Add Peer dialog, enter a name for the peer identity of first workstation, like “Alice’s Laptop”, into the Name field. Then click the Generate button to generate a new key pair for it:

Click the Add button to add the new peer identity:

Next, click the New button next to the Point Host field on the right side of the page:

In the Add Host dialog, enter a display name for the first workstation, like “Alice’s Laptop”, into the Name field. Then click the Add button:

The wizard will auto-generate an interface name of wg0 for both site and point (in the Site Interface and Point Interface fields). The interface name is the host’s identifier for the interface; if you want a fuller description of an interface for your own memory (eg “cloud site network”), enter it into the optional Interface Description field. Click the Next button to continue:

Based on the typical point-to-site arrangement, on the transport step the wizard will automatically check the “Site host has a public IP address” checkbox, and uncheck the “Point host has as public IP address” checkbox. This matches the arrangement in our scenario, too; so leave the checkboxes as is, and enter the public IP address (203.0.113.2) or DNS name (vpn.example.com) of the VPN server in the Public IP Address or DNS Name field on the left side of the page:

The wizard will also auto-generate a listen port of 51820 for the VPN server. We’ve already arranged to open up UDP port 51822 through the firewall for our example, however, so change the port to 51822, and then click the Next button:

On the previous step, we had to enter the external public IP and port information for the connection transport. On the tunnel step, we enter the internal WireGuard IP addresses and routing we will use within the WireGuard tunnel. The first part of this is deciding on some internal network address space to use for our WireGuard network. If you already have a network address in mind (eg 10.0.0.0/24), enter it into the WireGuard Network Addresses field; otherwise, click the Generate button next to it:

If you clicked the Generate button, in the Generate Network Address dialog, select a one of the primary private-use address blocks to use (like the “10.0.0.0/8” block), and then click the Generate button:

Adjust the generated network address (or generate a new one) as you like. If you want to enable the WireGuard connection to use both IPv4 and IPv6, click the Add icon next to the WireGuard Network Addresses field:

Then enter or generate a second address (an IPv4 address if the first address was IPv6, or IPv6 if the first was IPv4):

Notice that the wizard will automatically generate an individual WireGuard address on both sides of the connection (in this case labeled VPN Server WireGuard Address and Alice’s Laptop WireGuard Address) for each network address we selected in the WireGuard Network Addresses fields; and it will also add a route for each network address to both sides of the connection (labeled Route via VPN Server and Route via Alice’s Laptop):

Click the Generate button next to each WireGuard address if you want to generate a random address within the network address space (or directly enter a different address of your choosing). If you change an address, the wizard may re-generate its suggested routes to match the change.

For our scenario, we’re going to use just IPv4, so we’ll remove the IPv6 network address we added, by clicking the Remove icon next to it:

In most cases, you’ll want to keep the routes auto-generated by the wizard (but you may adjust, remove, or add to them if you want something different). In a point-to-site scenario like this one, you’ll always want to add at least one route on the site side, for the LAN in use at the site — which is why the wizard has automatically added a blank route on the left side for us. We’ll fill in this field with our example site LAN network, 192.168.200.0/24:

When setting up the site side of a point-to-site connection, the wizard will automatically select the “Turn on packet forwarding Linux kernel parameter” and “Add packet masquerading iptables rule” checkboxes for you. If the VPN server is running Linux (and won’t be running WireGuard in a container), and you haven’t explicitly turned on its net.ipv4.conf.all.forwarding (or net.ipv4.ip_forward) kernel parameters, leave the first checkbox checked; otherwise, uncheck it. Similarly, if the VPN server is running Linux, and you haven’t explicitly configured its firewall settings, leave the second checkbox checked; otherwise, uncheck it.

In our example, the VPN server is running Linux, and we haven’t configured any of its kernel parameters or firewall settings, so we’ll leave those two checkboxes checked:

When setting up the point side of a point-to-site connection, the wizard will give you the option to configure custom DNS settings to apply to the point when the WireGuard tunnel is up. We don’t have a private DNS server at our example site, so we’ll leave the “Use custom DNS settings when tunnel is up” checkbox unchecked:

Click the Next button to continue on to the review step:

On the final step, you can review the WireGuard config settings that the wizard will generate, and go back and fix anything you want to do differently (or click the Cancel button to avoid setting up the connection entirely). On the left side of the page, the wizard will display the configuration it will generate for the VPN server; and on the right side of the page, the wizard will display the configuration it will generate for Alice’s laptop. Click the Apply button to save and apply it:

The wizard will send to you to the Complete Set-Up page, where the status of each side of the connection will be displayed:

In order to apply the pending WireGuard changes to the VPN server, we have two options:

We’ll choose option 1: Set up the agent on the server. Click the Set Up Agent icon in the Site panel on the left side of the page:

Download the procustodibus.conf and procustodibus-setup.conf files, as well as the Pro Custodibus Agent tarball:

Copy the procustodibus.conf and procustodibus-setup.conf files, along with the procustodibus-agent-latest.tar.gz tarball, to the VPN server. On the VPN server, move the procustodibus.conf and procustodibus-setup.conf files to the /etc/wireguard/ directory:

Then extract the procustodibus-agent-latest.tar.gz tarball, change to the procustodibus-agent-*/ directory it creates, and run the install.sh script:

Return to the Pro Custodibus UI, and navigate to the main page for the VPN server:

You should see that the agent has connected to the Pro Custodibus servers successfully, that its new WireGuard interface is up but inactive, and that its endpoint to Alice’s laptop is available:

However, Alice cannot use the connection yet, since the WireGuard configuration on her side of the connection has not yet been applied.

To apply the pending WireGuard changes to the Alice’s laptop, we’ll set up the Pro Custodibus agent on it. Click the Hosts link at the top of the page:

Then click the link to Alice’s Laptop in the Hosts panel:

On the main page for Alice’s laptop, click the Set Up icon in the Agent panel:

From the Set Up Alice’s Laptop page, click the procustodibus.conf and procustodibus-setup.conf files (as well as the Pro Custodibus Agent tarball if you already deleted the copy used to set up the VPN server above):

Copy the procustodibus.conf and procustodibus-setup.conf files, along with the procustodibus-agent-latest.tar.gz tarball, to Alice’s laptop. On Alice’s laptop, move the procustodibus.conf and procustodibus-setup.conf files to the /etc/wireguard/ directory:

Then extract the procustodibus-agent-latest.tar.gz tarball, change to the procustodibus-agent-*/ directory it creates, and run the install.sh script:

Return to the Pro Custodibus UI, and navigate to the main page for Alice’s laptop:

You should see that the agent has connected to the Pro Custodibus servers successfully, and that its new WireGuard interface is up and active (sending keepalive packets to the VPN server):

Now Alice can access any of the other computers in the VPN server’s LAN (in the 192.168.200.0/24 network). For example, if there was a web server running at 192.168.200.22, Alice can run the following cURL command on her laptop to access it:

Now that we have a working connection between the VPN server and Alice’s laptop, it will be easy to duplicate it for additional connections. To do so, in the Pro Custodibus web UI, click the Hosts link at the top of the page:

Click the VPN Server link in the Hosts panel:

And click the wg0 link in the Interfaces panel:

Now click the Add icon in the Endpoints panel to add a new endpoint for Bob’s workstation:

For Configuration, select the “Use guided set-up wizard” radio button, and then click the Next button to launch the Connection Wizard:

On the first step of the Connection Wizard, select the “Point-to-Site, as Site” radio button from the Type option list (many of the options will be customized with the VPN server’s name, eg “Point-to-Site, VPN Server as Site”). Then click the Next button:

On the second step, click the New button next to the Point Peer field on the right side of the page:

In the Add Peer dialog, enter a name for the WireGuard peer identity of second workstation, like “Bob’s Workstation”, into the Name field. Then click the Generate button to generate a new WireGuard key pair:

Click the Add button to add the new peer identity:

Next, click the New button next to the Point Host field on the right side of the page:

In the Add Host dialog, enter a display name for the second workstation, like “Bob’s Workstation”, into the Name field. Then click the Add button:

The wizard will auto-generate an interface name of wg0 for the new point. Click the Next button to continue:

On the next step the wizard will automatically check the “Site host has a public IP address” checkbox, and uncheck the “Point host has as public IP address” checkbox; leave the checkboxes as is. The wizard will also automatically fill in the Public IP Address or DNS Name field on the left side of the page, using the DNS name (vpn.example.com) of the VPN server that we used when we set up the first workstation. It will also do the same for the Listen Port field (51822). Click the Next button to use these settings for the second workstation:

On the tunnel step the wizard will also automatically fill in all the fields we need, based on the settings we used when we set up the first endpoint. The wizard fill in the same WireGuard Network Adresses, VPN Server WireGuard Address, and Route via VPN Server values used with the first endpoint on the left side of the page:

On the right side of the page, for the Bob’s Workstation WireGuard Address field, the wizard will automatically fill in the lowest available IP address in the WireGuard network address space (10.12.34.3). It will use that same address for the Route via Bob’s Workstation field:

Enter a different address if you like (or click the Generate button next to the Bob’s Workstation WireGuard Address field to generate a random address within the WireGuard network address space), then click the Next button:

On the final step, review the WireGuard config changes that will be made. Notice that on the left side, only the bottom part of the config is highlighted with a green background — this is part that will be added (the top gray part shows the unchanged core interface settings). Click the Apply button to save and apply the changes:

The wizard will send to you to the Complete Set-Up page, where the status of each side of the connection will be displayed:

Since we have already installed the Pro Custodibus agent on the VPN server, the config changes to the VPN server will automatically be applied by the agent momentarily. But we have not (and will not) installed the agent on Bob’s workstation. Instead, click the Download Interface Config icon in the Point panel on the right side of the page:

Then click the Download button on the wg0 interface configuration page:

Install WireGuard on Bob’s workstation, copy the wg0.conf file you just downloaded over to it, and move the file into the /etc/wireguard directory (or use the WireGuard app on Windows or macOS to import the wg0.conf file).

Start up the new WireGuard interface on Bob’s workstation, and now Bob can access any of the other computers in the VPN server’s LAN (in the 192.168.200.0/24 network). For example, if there was a web server running at 192.168.200.22, Bob can access it by entering http://192.168.200.22 into the address bar of his web browser.

Finally, go back to Pro Custodibus, and navigate to the main wg0 interface page for Bob’s laptop:

Scroll down, and click on the last link in the Queued column of the Change Queue panel:

Click the Applied Manually icon in the Queued Change panel:

This will notify Pro Custodibus that you applied this change manually, so it will stop listing the change as pending:

Go back and do the same for the other pending changes, so that each change is listed as Executed:

Doing this will ensure that if you use the Connection Wizard in the future to add another connection to Bob’s laptop, Pro Custodibus will know what settings have been applied to Bob’s laptop, so the wizard will be able to make appropriate suggestions for the new connection.