diff --git a/docs/guides/wireguard/faq.md b/docs/guides/wireguard/faq.md index 0ec039b..916cd2d 100644 --- a/docs/guides/wireguard/faq.md +++ b/docs/guides/wireguard/faq.md @@ -2,12 +2,12 @@ ## Issues with dynamic server IP -Host names cannot be resolved during startup. This may lead to a five minutes delay during boot. A solution to this is to disable the automatic start of the `wg` interface during start and connect only later (manually) when you are sure that you can resolve host names. +Hostnames cannot be resolved during startup. This may lead to a five minutes delay during boot. A solution to this is to disable the automatic start of the `wg` interface during start and connect only later (manually) when you are sure that you can resolve hostnames. 1. Disable `auto wg0` in `/etc/network/interfaces` (put `#` in front, like `#auto wg0`) 2. Start `wireguard` manually using `sudo ifup wg0` -If the IP changes while the connection is running, resolving the new IP address fails otten. Reconnect using +If the IP changes while the connection is running, resolving the new IP address fails often. Reconnect using ```bash sudo ifdown wg0 && sudo ifup wg0 @@ -63,7 +63,7 @@ unmanaged-devices=interface-name:wg* ## Broken DNS resolution -When tunneling all traffic through a WireGuard interface, the connection can become seemingly lost after a while or upon new connection. This could be caused by a network manager or DHCP client overwriting `/etc/resolv.conf`. +When tunneling all traffic through a WireGuard interface, the connection can become seemingly lost after a while or upon a new connection. This could be caused by a network manager or DHCP client overwriting `/etc/resolv.conf`. By default, `wg-quick` uses `resolvconf` to register new DNS entries (from the DNS keyword in the configuration file). This will cause issues with network managers and DHCP clients that do not use `resolvconf`, as they will overwrite `/etc/resolv.conf` thus removing the DNS servers added by `wg-quick`. The solution is to use networking software that supports `resolvconf`. @@ -75,7 +75,7 @@ The solution is to use networking software that supports `resolvconf`. ## Low MTU -Due to too low MTU (lower than 1280), `wg-quick` may fail to create the WireGuard interface. This can be solved by setting the MTU value in WireGuard configuration in Interface section on client: +Due to too low MTU (lower than 1280), `wg-quick` may fail to create the WireGuard interface. This can be solved by setting the MTU value in WireGuard configuration in the Interface section on the client: ```toml [Interface] diff --git a/docs/guides/wireguard/overview.md b/docs/guides/wireguard/overview.md index babbd8d..b24eefe 100644 --- a/docs/guides/wireguard/overview.md +++ b/docs/guides/wireguard/overview.md @@ -1,11 +1,11 @@ ### Remote accessing Pi-hole using WireGuard -WireGuard is an ***extremely simple yet fast and modern VPN*** that utilizes state-of-the-art cryptography. Comparing to other solutions, such as OpenVPN or IPsec, it aims to be **faster, simpler and leaner** while avoiding the massive overhead involved with other VPN solutions. +WireGuard is an ***extremely simple yet fast and modern VPN*** that utilizes state-of-the-art cryptography. Comparing to other solutions, such as OpenVPN or IPsec, it aims to be **faster, simpler, and leaner** while avoiding the massive overhead involved with other VPN solutions. A combination of extremely high-speed cryptographic primitives and the fact that WireGuard lives inside the Linux kernel means that secure networking can be very high-speed. It intends to be considerably more performant than OpenVPN. -WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many circumstances. +WireGuard is designed as a general-purpose VPN for running on embedded interfaces and super computers alike, fit for many circumstances. There is no need to manage connections, be concerned about state, manage daemons, or worry about what's under the hood. WireGuard presents an extremely basic yet powerful interface. diff --git a/docs/guides/wireguard/route-everything.md b/docs/guides/wireguard/route-everything.md index cd578a5..7008234 100644 --- a/docs/guides/wireguard/route-everything.md +++ b/docs/guides/wireguard/route-everything.md @@ -1,6 +1,6 @@ # Route the entire Internet traffic through the WireGuard tunnel -Routing your entire Internet traffic is **optional**, however, it can be advantageous in cases where you are expecting eavesdropping on the network. This may not only happen in unsecure open Wi-Fi networks (airports, hotels, trains, etc.) but also in encrypted Wi-Fi networks where the creator of the network can monitor client activity. +Routing your entire Internet traffic is **optional**, however, it can be advantageous in cases where you are expecting eavesdropping on the network. This may not only happen in insecure open Wi-Fi networks (airports, hotels, trains, etc.) but also in encrypted Wi-Fi networks where the creator of the network can monitor client activity. Rerouting the Internet traffic through your Pi-hole will furthermore cause all of your Internet traffic to reach the Internet from the place where your WireGuard server is located. This can be used to obfuscate your real location as well as to be allowed to access geo-blocked content, e.g., when your Pi-hole is located in Germany but you are traveling in the United States. If you want to access a page only accessible from within Germany (like the live-broadcast of Tagesschau, etc.), this will typically not work. However, if you route your entire Internet through your Pi-hole, your network traffic will originate from Germany, allowing you to watch the content. @@ -25,6 +25,6 @@ AllowedIPs = 0.0.0.0/0, ::/0 Do **not** set this on the server in the `[Interface]` section. WireGuard will automatically take care of setting up [correct routing](https://www.wireguard.com/netns/#routing-all-your-traffic) so that networking still functions on all your clients. -That's all you need to do. You should use an online check (e.g. www.wieistmeineip.de) to check if your IP changed to the public IP address of your WireGuard server after this change up. It is possible to add this change only for a few clients, leaving the others without a full tunnel for all traffic (e.g., where this is not necessary or not desired). +That's all you need to do. You should use an online check (e.g. www.wieistmeineip.de) to check if your IP changed to the public IP address of your WireGuard server after this change. It is possible to add this change only for a few clients, leaving the others without a full tunnel for all traffic (e.g., where this is not necessary or not desired). {!abbreviations.md!} diff --git a/docs/guides/wireguard/server.md b/docs/guides/wireguard/server.md index af539bc..9ffb926 100644 --- a/docs/guides/wireguard/server.md +++ b/docs/guides/wireguard/server.md @@ -4,7 +4,7 @@ !!! info "The terms "server" and "client"" Usage of the terms `server` and `client` were purposefully chosen in this guide specifically to help both new users and existing OpenVPN users become familiar with the construction of WireGuard's configuration files. - WireGuard itself simply refers to all connected devices as `peers`. It consitutes a connection between computers. + WireGuard itself simply refers to all connected devices as `peers`. It constitutes a connection between computers. ## Installing the server components @@ -181,11 +181,11 @@ interface: wg0 listening port: 47111 ``` -Your public key will be different to ours. This is expected (you just created your own key above). +Your public key will be different from ours. This is expected (you just created your own key above). ## Set your Pi-hole to listen on all interfaces -On your [Settings page (tab DNS)](http://pi.hole/admin/settings.php?tab=dns), ensure you set the listing mode of your Pi-hole to one of the `Listen of all interfaces` settings. The top one is perferred as it adds a bit of additional safety. Your WireGuard peers/clients will be correctly recognized as being only one hop away. +On your [Settings page (tab DNS)](http://pi.hole/admin/settings.php?tab=dns), ensure you set the listing mode of your Pi-hole to one of the `Listen of all interfaces` settings. The top one is preferred as it adds a bit of additional safety. Your WireGuard peers/clients will be correctly recognized as being only one hop away. You can now continue to add clients.