WireGuard

Goal Samjho Pehle (Important for Clarity):

Problem:

• Tujhe rocky@135.125.203.81 server pe SSH karna hai.

• Lekin directly SSH allowed nahi hai, kyunki ye production-level server hai.

Solution:

• WireGuard VPN lagayenge.

• VPN ke through secure private tunnel banayenge.

• Tunnel banne ke baad SSH karege private IP ke through.

• Isse public IP se SSH avoid hoga = security increase.

---

STEP 1: SSH into the Server (for now, public IP se)

Tujhe abhi WireGuard install karna hai, isliye pehle SSH kar:

bashCopyEditssh rocky@135.125.203.81

Agar SSH allowed hai abhi ke liye, toh andar chale ja server ke.

Agar nahi jaa pa raha, toh shayad kisi ne VPN already setup kar diya hai — us case me VPN se connect karna padega pehle.

Tu bata de kya SSH ho raha hai ya nahi — fir agla step doon.

---

Assuming tu SSH kar paya — chalte hain next step pe:

STEP 2: Install WireGuard on Rocky Linux

Run this on the Rocky server:

bashCopyEditsudo dnf install epel-release -y
sudo dnf install wireguard-tools -y

Verify install:

bashCopyEditwg --version

Agar version dikha raha, to install ho gaya.

---

STEP 3: Generate WireGuard Keys (on server)

WireGuard ko key pair chahiye (private + public):

bashCopyEditwg genkey | tee privatekey | wg pubkey > publickey

Ab ye 2 files ban gayi:

• privatekey = secret

• publickey = share with client

Check:

bashCopyEditcat privatekey
cat publickey

Copy both outputs (we’ll need them).

---

STEP 4: Configure WireGuard server

Create config file:

bashCopyEditsudo nano /etc/wireguard/wg0.conf

Paste this config:

iniCopyEdit[Interface]
PrivateKey = <server-private-key>
Address = 10.0.0.1/24
ListenPort = 51820
SaveConfig = true

# Allow traffic forwarding
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT

Replace <server-private-key> with the output of cat privatekey.

---

STEP 5: Enable & Start WireGuard

bashCopyEditsudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Check status:

bashCopyEditsudo systemctl status wg-quick@wg0

If running = success.

---

STEP 6: Firewall Open Karo 51820

bashCopyEditsudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --reload

---

STEP 7: SE Linux Disable Karna (if needed)

Check status:

bashCopyEditsestatus

Disable (only if needed):

bashCopyEditsudo setenforce 0

Permanent disable:

bashCopyEditsudo nano /etc/selinux/config
# set SELINUX=disabled

---

[STEP 1] – Install WireGuard on Rocky Linux

bashCopyEditsudo dnf install epel-release -y
sudo dnf install wireguard-tools -y

Check installation:

bashCopyEditwg --version

Agar output me version aaya toh WireGuard install ho gaya.

[STEP 2] – Generate WireGuard Keys (on the server)

WireGuard ko private-public key pair chahiye for secure connection.

Run this:

bashCopyEditwg genkey | tee privatekey | wg pubkey > publickey

Ab 2 files ban gayi:

• privatekey → server ka secret

• publickey → client ke config me use hoga

Check key values:

bashCopyEditcat privatekey
cat publickey

Note: In keys ko kahin safe rakh le (abhi manually copy kar le Notepad me).

---

[STEP 3] – Create WireGuard Config File

bashCopyEditsudo nano /etc/wireguard/wg0.conf

Paste this config (modify accordingly):

iniCopyEdit[Interface]
PrivateKey = <paste_your_private_key_here>
Address = 10.0.0.1/24
ListenPort = 51820
SaveConfig = true

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT

Replace <paste_your_private_key_here> with output of:

bashCopyEditcat privatekey

Save and exit (Ctrl + X, then Y, then Enter).

---

[STEP 4] – Enable and Start WireGuard

bashCopyEditsudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Check status:

bashCopyEditsudo systemctl status wg-quick@wg0

---

[STEP 5] – Open Port 51820 on Firewall

bashCopyEditsudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --reload

---

[STEP 6] – (If Needed) Disable SELinux Temporarily

Check if enforcing:

bashCopyEditsestatus

If status = enforcing, run:

bashCopyEditsudo setenforce 0

(For permanent disable, we'll do it later if needed)

[STEP 7] – Client Side Setup (Tera Laptop/Windows Machine)

1. WireGuard Install ho chuka hai (GUI based)

Tu pehle hi bola tha ki WireGuard GUI Windows pe install hai — perfect!

---

2. Client Keys Generate Karo (inside GUI)

1. Open WireGuard GUI

2. Click "Add Tunnel" → "Add empty tunnel"

3. It’ll auto-generate:

    iniCopyEdit[Interface]
    PrivateKey = <generated-client-private-key>
    Address = 10.0.0.2/24
   
    [Peer]
    PublicKey = <server-public-key>
    Endpoint = 135.125.203.81:51820
    AllowedIPs = 0.0.0.0/0
   

4. Replace PublicKey with the output of cat publickey from server (server’s public key).

5. Save tunnel with name like RockyVPN.

---

3. Server pe Client ka Public Key Add Karo

Client config ban gaya, ab uska PublicKey server ko dena hoga.

Client GUI me Copy karo public key (visible on top of [Interface] section), fir server pe yeh add karo:

bashCopyEditsudo wg set wg0 peer <client-public-key> allowed-ips 10.0.0.2/32

Example:

bashCopyEditsudo wg set wg0 peer dT8xgH1kpz1+u3HFn5Rc4zQ… allowed-ips 10.0.0.2/32

Phir changes save karo:

bashCopyEditsudo wg-quick save wg0

---

4. Start VPN on Client

1. Open WireGuard GUI

2. Select tunnel RockyVPN

3. Click "Activate"

---

5. Test Connection – Ping Server ke Private IP se

Server config me tu Address = 10.0.0.1/24 diya tha — so ping kar:

bashCopyEditping 10.0.0.1

Agar ping ho gaya → VPN working perfectly.

---

6. SSH Server via Private IP

bashCopyEditssh rocky@10.0.0.1

Quick Recap of IPs:

---

Official WireGuard GUI (for Windows):

https://www.wireguard.com/install/

Download the Windows installer → Install it normally like any app → Fir tu ye kaam karega:

---

Tunnel Create Karne ke Steps (Once GUI is Installed)

1. Open "WireGuard" app (Start Menu se).

2. Click "Add Tunnel" → "Add empty tunnel"
   Ye automatic ek private-public key pair generate karega.

3. Fill ye config:[Interface]

4. ill ye config:

    [Interface]
    PrivateKey = yAN/JVhVqII5PPj/SK6x/hLpieaePdYn0U6GUKA1Vms=
    Address = 10.0.0.2/24
    DNS = 8.8.8.8
   
    [Peer]
    PublicKey = ok9V9Oe8ZAH2SIohJgyI4jgvTLPZkJ6Z5oct4aIqiF4=
    Endpoint = 135.125.203.81:51820
    AllowedIPs = 10.0.0.0/8, 192.168.1.0/24
    PersistentKeepalive = 25
   

   • PrivateKey → Automatically aata hai

     • PublicKey (peer ka) → Server se le (jo tu cat publickey se nikaalega)

     • Endpoint → Server ka IP aur WireGuard port

   • Tunnel ko naam de jaise: rockyVPN

   • Click Save

Phir Activate karega aur tu VPN se connect ho jayega.