From cd606b24e27988a61b8b0df2409dca53b6cbd411 Mon Sep 17 00:00:00 2001 From: XhmikosR Date: Mon, 19 Oct 2020 08:19:29 +0300 Subject: [PATCH] Remove redundant spaces after fenced codeblocks --- docs/guides/wireguard/client.md | 32 +++++++++++++-------------- docs/guides/wireguard/faq.md | 12 +++++------ docs/guides/wireguard/internal.md | 14 ++++++------ docs/guides/wireguard/server.md | 36 +++++++++++++++---------------- 4 files changed, 47 insertions(+), 47 deletions(-) diff --git a/docs/guides/wireguard/client.md b/docs/guides/wireguard/client.md index 49bdddc..cc476e3 100644 --- a/docs/guides/wireguard/client.md +++ b/docs/guides/wireguard/client.md @@ -6,7 +6,7 @@ For each new client, the following steps must be taken. For the sake of simplici ??? info "All commands described below at once" - ``` bash + ```bash sudo -i cd /etc/wireguard umask 077 @@ -40,7 +40,7 @@ For each new client, the following steps must be taken. For the sake of simplici We generate a key-pair for the client `NAME` (replace accordingly everywhere below): -``` bash +```bash sudo -i cd /etc/wireguard umask 077 @@ -52,7 +52,7 @@ wg genkey | tee "${name}.key" | wg pubkey > "${name}.pub" We furthermore recommend generating a pre-shared key (PSK) in addition to the keys above. This adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography and is mainly for post-quantum resistance. A pre-shared key should be generated for each peer pair and *should not be reused*. -``` bash +```bash wg genpsk > "${name}.psk" ``` @@ -60,7 +60,7 @@ wg genpsk > "${name}.psk" Add the new client by running the command: -``` bash +```bash echo "[Peer]" >> /etc/wireguard/wg0.conf echo "PublicKey = $(cat "${name}.pub")" >> /etc/wireguard/wg0.conf echo "PresharedKey = $(cat "${name}.psk")" >> /etc/wireguard/wg0.conf @@ -74,13 +74,13 @@ echo "AllowedIPs = 10.100.0.2/32, fd08:4711::2/128" >> /etc/wireguard/wg0.conf Restart your server to load the new client config: -``` bash +```bash systemctl restart wg-quick@wg0 ``` After a restart, the server file should look like: -``` toml +```toml [Interface] Address = 10.100.0.1/24, fd08::1/128 ListenPort = 47111 @@ -97,13 +97,13 @@ AllowedIPs = 10.100.0.2/32, fd08:4711::2/128 The command -``` bash +```bash wg ``` should tell you about your new client: -``` plain +```plain interface: wg0 public key: XYZ123456ABC= ⬅ Your server's public key will be different private key: (hidden) @@ -118,7 +118,7 @@ peer: F+80gbmHVlOrU+es13S18oMEX2g= ⬅ Your peer's public key will be differen Create a dedicated config file for your new client: -``` bash +```bash echo "[Interface]" > "${name}.conf" echo "Address = 10.100.0.2/32, fd08:4711::2/128" >> "${name}.conf" # May need editing echo "DNS = 10.100.0.1" >> "${name}.conf" # Your Pi-hole's IP @@ -126,13 +126,13 @@ echo "DNS = 10.100.0.1" >> "${name}.conf" # Your Pi-hol and add the private key of this client -``` bash +```bash echo "PrivateKey = $(cat "${name}.key")" >> "${name}.conf" ``` Next, add your server as peer for this client: -``` toml +```toml [Peer] AllowedIPs = 10.100.0.0/24, fd08::/64 Endpoint = [your public IP or domain]:47111 @@ -141,7 +141,7 @@ PersistentKeepalive = 25 Then add the public key of the server as well as the PSK for this connection: -``` bash +```bash echo "PublicKey = $(cat server.pub)" >> "${name}.conf" echo "PresharedKey = $(cat "${name}.psk")" >> "${name}.conf" exit @@ -158,7 +158,7 @@ That's it. When this option is enabled, a keepalive packet is sent to the server endpoint once every interval seconds. A sensible interval that works with a wide variety of firewalls is `25` seconds. Setting it to 0 turns the feature off, which is the default. Handshakes are not the same as keep-alives. A handshake establishes a limited-time session of about 3 minutes. So, for about 3 minutes your client is able to send its keep-alive packets without requireing a new session. Then, when the session expires, sending a new keep-alive requires a new session for which you should see a new handshake. In practice, the client initiates a handshake earlier. - + **TL;DR** If you're behind NAT or a firewall and you want to receive incoming connections long after network traffic has gone silent, this option will keep the "connection" open in the eyes of NAT. @@ -166,7 +166,7 @@ That's it. You can now copy the configuration file to your client (if you created the config on the server). If the client is a mobile device such as a phone, `qrencode` can be used to generate a scanable QR code: -``` bash +```bash sudo qrencode -t ansiutf8 -r "/etc/wireguard/${name}.conf" ``` @@ -180,13 +180,13 @@ After creating/copying the connection information over to your client, you may u You can check if your client successfully connected by, once again, running -``` plain +```plain sudo wg ``` on the server. It should show some traffic for your client if everything works: -``` plain +```plain interface: wg0 public key: XYZ123456ABC= ⬅ Your server's public key will be different private key: (hidden) diff --git a/docs/guides/wireguard/faq.md b/docs/guides/wireguard/faq.md index e92e3ec..0ec039b 100644 --- a/docs/guides/wireguard/faq.md +++ b/docs/guides/wireguard/faq.md @@ -9,13 +9,13 @@ Host names cannot be resolved during startup. This may lead to a five minutes de If the IP changes while the connection is running, resolving the new IP address fails otten. Reconnect using -``` bash +```bash sudo ifdown wg0 && sudo ifup wg0 ``` To achieve a permanent solution, one can install a `cron` job which restarts the connection automatically whenever a change is detected. This avoids excessive restarts of the interface. Example script (taken from [Ubuntuusers Wiki](https://wiki.ubuntuusers.de/WireGuard)): -``` bash +```bash #!/bin/bash # Check state of wg0 interface wgstatus=$(wg) @@ -42,11 +42,11 @@ fi Store this file as `/home/[user name]/wg-restart.sh` and add it to your `crontab`: -``` bash +```bash sudo crontab -e ``` -``` plain +```plain */10 * * * * bash /home/[user name]/wg-restart.sh # Runs the script every 10 minutes ``` @@ -54,7 +54,7 @@ sudo crontab -e Users of NetworkManager should make sure that it is not managing the WireGuard interface(s). For example, create the configuration file `/etc/NetworkManager/conf.d/unmanaged.conf` with content -``` toml +```toml [keyfile] unmanaged-devices=interface-name:wg* ``` @@ -77,7 +77,7 @@ The solution is to use networking software that supports `resolvconf`. Due to too low MTU (lower than 1280), `wg-quick` may fail to create the WireGuard interface. This can be solved by setting the MTU value in WireGuard configuration in Interface section on client: -``` toml +```toml [Interface] MTU = 1500 ``` diff --git a/docs/guides/wireguard/internal.md b/docs/guides/wireguard/internal.md index cbecca0..8884cf6 100644 --- a/docs/guides/wireguard/internal.md +++ b/docs/guides/wireguard/internal.md @@ -4,7 +4,7 @@ Enable IP forwarding on your server by removing the comments in front of -``` toml +```toml net.ipv4.ip_forward = 1 net.ipv6.conf.all.forwarding = 1 ``` @@ -13,13 +13,13 @@ in the file `/etc/sysctl.d/99-sysctl.conf` Then apply the new option with the command below. -``` bash +```bash sudo sysctl -p ``` If you see the options repeated like -``` plain +```plain net.ipv4.ip_forward=1 net.ipv6.conf.all.forwarding = 1 ``` @@ -35,7 +35,7 @@ A properly configured firewall is ***highly*** recommended for any Internet-faci On your server, add the following to the `[INTERFACE]` section of your `/etc/wireguard/wg0.conf`: -``` toml +```toml PostUp = iptables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE ``` @@ -55,14 +55,14 @@ In our standard configuration, we have configured the clients in such a way that Change the allowed addresses in your `/etc/wireguard/wg0.conf` from -``` toml +```toml [Peer] AllowedIPs = 10.100.0.1/32, fd08:4711::1/64 ``` to -``` toml +```toml [Peer] AllowedIPs = 10.100.0.0/24, fd08:4711::/64, 192.168.2.0/24 ``` @@ -73,7 +73,7 @@ assuming your internal network is in the IP range `192.168.2.1` - `192.168.2.254 Do the same you did above for the server also in the `[Interface]` section of all clients you want to have this feature: -``` toml +```toml [Peer] AllowedIPs = 10.0.0.0/24, fd08:4711::/64, 192.168.2.0/24 ``` diff --git a/docs/guides/wireguard/server.md b/docs/guides/wireguard/server.md index 6e74b52..af539bc 100644 --- a/docs/guides/wireguard/server.md +++ b/docs/guides/wireguard/server.md @@ -11,13 +11,13 @@ Installing everything we will need for a `wireguard` connections is as simple as running: -``` bash +```bash sudo apt-get install wireguard wireguard-tools wireguard-dkms ``` For Ubuntu 18.04 and lower, you need to do some extra steps: -``` bash +```bash sudo add-apt-repository ppa:wireguard/wireguard sudo apt update sudo apt install wireguard wireguard-tools wireguard-dkms @@ -32,7 +32,7 @@ If there is no `wireguard` package available for your system, you can follow the ### Update your local system - ``` bash + ```bash sudo apt update && sudo apt upgrade -y ``` @@ -40,19 +40,19 @@ If there is no `wireguard` package available for your system, you can follow the === "Raspberry Pi" - ``` bash + ```bash sudo apt install -y raspberrypi-kernel-headers libelf-dev build-essential pkg-config git ``` === "Linux" - ``` bash + ```bash sudo apt install -y linux-headers-$(uname -r) libelf-dev build-essential libmnl-dev git ``` ## Download and compile the `wireguard` module - ``` bash + ```bash git clone https://git.zx2c4.com/wireguard-linux-compat make -C wireguard-linux-compat/src -j$(nproc) sudo make -C wireguard-linux-compat/src install @@ -60,7 +60,7 @@ If there is no `wireguard` package available for your system, you can follow the You can ignore messages like - ``` plain + ```plain Warning: modules_install: missing 'System.map' file. Skipping depmod. ``` @@ -68,7 +68,7 @@ If there is no `wireguard` package available for your system, you can follow the Run - ``` bash + ```bash sudo modprobe wireguard ``` @@ -76,7 +76,7 @@ If there is no `wireguard` package available for your system, you can follow the ## Download and compile the `wireguard` tools (`wg`, etc.) - ``` bash + ```bash git clone https://git.zx2c4.com/wireguard-tools make -C wireguard-tools/src -j$(nproc) sudo make -C wireguard-tools/src install @@ -91,7 +91,7 @@ Each network interface has a private key and a list of peers. Each peer has a pu First, we create the folder containing our `wireguard` configuration: -``` bash +```bash sudo -i cd /etc/wireguard umask 077 @@ -101,7 +101,7 @@ umask 077 Inhere, we generate a key-pair for the server: -``` bash +```bash wg genkey | tee server.key | wg pubkey > server.pub ``` @@ -109,13 +109,13 @@ wg genkey | tee server.key | wg pubkey > server.pub Create a config file -``` bash +```bash sudo nano /etc/wireguard/wg0.conf ``` and put the following into it: -``` toml +```toml [Interface] Address = 10.100.0.1/24, fd08:4711::1/64 ListenPort = 47111 @@ -123,7 +123,7 @@ ListenPort = 47111 Then run -``` bash +```bash echo "PrivateKey = $(cat server.key)" >> /etc/wireguard/wg0.conf exit # Exit the sudo session ``` @@ -138,7 +138,7 @@ If the server is behind NAT, be sure to forward the specified port on which Wire Register your server `wg0` as: -``` bash +```bash sudo systemctl enable wg-quick@wg0.service sudo systemctl daemon-reload sudo systemctl start wg-quick@wg0 @@ -150,7 +150,7 @@ If successful, you should not see any output. ??? warning "Error: RTNETLINK answers: Operation not supported" In case you get an error like - ``` plain + ```plain RTNETLINK answers: Operation not supported Unable to access interface: Protocol not supported ``` @@ -168,13 +168,13 @@ If successful, you should not see any output. With the following command, you can check if your `wireguard` server is running: -``` bash +```bash sudo wg ``` The output should look like the following: -``` plain +```plain interface: wg0 public key: XYZ123456ABC= ⬅ Your public key will be different private key: (hidden)