Wireguard - Revision history

ViciousCarnivore: /* owrt to debian */

2025-09-18T02:14:01Z

owrt to debian

2025-09-18T02:11:35Z

2025-04-16T20:04:31Z

Forwarding on Windows

2025-04-12T07:21:08Z

Forwarding on Windows

2025-04-12T07:08:10Z

Forwarding on Windows

2025-04-12T06:59:58Z

Forwarding on Windows

2025-04-12T06:37:14Z

Forwarding on Windows

2025-04-12T05:37:59Z

2025-04-12T05:36:49Z

Basics

2025-04-12T05:36:04Z

Windows Firewall for SMB Shares

← Older revision		Revision as of 02:14, 18 September 2025
Line 280:		Line 280:
	default forwarding policy of accept. (makes it reject).		default forwarding policy of accept. (makes it reject).
	</pre>		</pre>
		+
		+	==Wireguard Flaws==
		+
		+	Wireguard is considered mature software (i.e. it doesn't have updates), but it has flaws. For example:
		+	* If a windows user is not admin, they can't see the interface in the taskbar. Other VPNs are able to do this, so this is a Wireguard fault.

@@ Line 1: / Line 1: @@
-Wireguard is a godsend to IT admins trying to manage VPNs.
+Wireguard is a simple and lite VPN for IT admins.
 It is just as complex as it needs to be, to be a practical vpn, but no more.
 Much faster than any other VPN I've ever used (roadwarrior scripts and things like sonicwalls global vpn client don't count, as they
-just hide the underlying functionality from the admin, making it impossible to fix if things don't 'just work'.).
+just hide the underlying functionality from the admin, making it difficult to fix if things don't 'just work'.).
 Wireguard has a few setup scenarios depending upon the OS.

← Older revision		Revision as of 20:04, 16 April 2025
Line 122:		Line 122:

	A thing about computers, is that sometimes things don't work. And that's why I don't use Windows much. Because a lot of the time, it doesn't work.		A thing about computers, is that sometimes things don't work. And that's why I don't use Windows much. Because a lot of the time, it doesn't work.
		+
		+	===Routing Individual IPs Only===
		+	A neat thing you can do (this is likely possible with OpenVPN as well, but I have not tried it.) is to have individual routes to different networks that use the same subnet address. So, say for example you have two different networks that are both 192.168.1, but you want to access a different machine on each, you can do individual RouteAllowedIps and AllowedIps that are only /32. This ends up being that you can cheat the subnets sort of. Where the intention of the subnets was to make it not possible to access two 192.168.1 networks, but with a VPN, you can, as long as you are routing specific ips or ranges. Useful.

	==todo==		==todo==

@@ Line 120: / Line 120: @@
   https://www.procustodibus.com/blog/2024/07/forwarding-wireguard-on-windows/
 For the equivalent to the Masquerade command on Windows. Though this doesn't work as easily as described. He 'neglects to mention' that you need hyper-v installed to run the new-netnat command or you will get an invalid class result. And while ping will work to remote hosts without doing the procustodialbus post, once you install hyper-v it does not work. There is also very little documentation online about accessing hosts behind a windows wireguard client, compared to Linux. Complete disaster on Windows.
 ==todo==

@@ Line 119: / Line 119: @@
 There is also:
   https://www.procustodibus.com/blog/2024/07/forwarding-wireguard-on-windows/
-For the equivalent to the Masquerade command on Windows. Though this doesn't work as easily as described. He 'neglects to mention' that you need hyper-v installed to run the new-netnat command or you will get an invalid class result. There is also very little documentation online about accessing hosts behind a windows wireguard client, compared to Linux.
+For the equivalent to the Masquerade command on Windows. Though this doesn't work as easily as described. He 'neglects to mention' that you need hyper-v installed to run the new-netnat command or you will get an invalid class result. And while ping will work to remote hosts without doing the procustodialbus post, once you install hyper-v it does not work. There is also very little documentation online about accessing hosts behind a windows wireguard client, compared to Linux. Complete disaster on Windows.
 ==todo==

@@ Line 117: / Line 117: @@
   Reference:
   https://serverfault.com/questions/1103674/set-up-wireguard-tunnel-in-windows-10-with-ip-forwarding
 ==todo==

@@ Line 4: / Line 4: @@
 just hide the underlying functionality from the admin, making it impossible to fix if things don't 'just work'.).
-wireguard has a few setup scenarios. each are unique.
+Wireguard has a few setup scenarios depending upon the OS.
 ==windows client to owrt split tunnel==

@@ Line 55: / Line 55: @@
 Imagine doing this on one of those intern designed tacked on guis from sophos or sonicwall. Pure torture. Literally
-a layer of dogshit painted over the 'actually useful' command line tools. There is a reason starlink uses
+a layer of garbage painted over the 'actually useful' command line tools. There is a reason starlink uses
-Owrt, and not some busywork web gui bullshit. Trying to use the molasses packet capture on a sonicwall or sophos through the
+Owrt, and not some busywork web gui trash. Trying to use the molasses packet capture on a sonicwall or sophos through the
 web gui is demonic firewall design. "Some things exist on earth as an example of how it is 'not' supposed to be done".
 ===Windows Firewall for SMB Shares===
 Windows and wireguard will set it as a public network where smb doesn't always work.

@@ Line 68: / Line 68: @@
 the samba error in mount.cifs in linux (if testing an smb share) is
 mount error(115): Operation now in progress.
-the smb error in windows. haha. there's no fucking error # in windows. just a
+the smb error in windows. haha. there's no f*&@%$* error # in windows. just a
 generic error message.