Samu Saukkonen Implementing WireGuard to a home office environment Metropolia University of Applied Sciences Bachelor of Engineering Information Technology Bachelor’s Thesis 23 October 2020 Abstract Author Samu Saukkonen Title Implementing WireGuard to a home office environment Number of Pages 31 pages + 1 appendices Date 23 October 2020 Degree Bachelor of Engineering Degree Programme Information Technology Professional Major IoT and Cloud Computing Instructors Marko Uusitalo, Principal Lecturer A Virtual Private Network (VPN) extends a private network across the public network and therefore allows devices to interact with each other as if they were directly connected. A VPN connection is commonly used in organizations to interconnect geographically varying networks as well as to offer remote work capabilities. The goal of the thesis was to implement WireGuard VPN-software into a home office envi- ronment and to take a look into common VPN protocols and self-hosted VPN solutions. Based on the VPN-protocols, it could be concluded that some VPN-protocols use very heavy technologies compared to more recent solutions. WireGuard-tunnel was implemented between a laptop acting as a host device and a virtual cloud server. The same tunnel was also implemented and tested on a mobile device acting as the host device. The connection was initially established via the terminal a command at a time and then moved to a separate configuration file. Moving the configuration to a single separate file allowed for a quicker connection establishment as the tunnel could be brought online with a single command. As a result of the thesis, a working VPN-solution for a home office environment was created that allowed the end users to encrypt their network traffic and circumvent restriction based on geographical location. The performance of the implementation was tested with and with- out the tunnel being active. Additionally, the encryption was verified by inspecting single packets of network traffic. Keywords Information security, VPN, WireGuard, remote work Tiivistelmä Tekijä Samu Saukkonen Otsikko Implementing WireGuard to a home office environment Sivumäärä 31 sivua + 1 liite Aika 23.10.2020 Tutkinto insinööri (AMK) Tutkinto-ohjelma Tieto- ja viestintätekniikka Ammatillinen pääaine IoT and Cloud Computing Ohjaajat Tutkintovastaava Marko Uusitalo Virtuaalinen erillisverkko eli VPN (Virtual Private Network) on teknologia, jonka tarkoituk- sena on tarjota tapa yhdistää kaksi tai useampi verkko Internetin ylitse näennäisesti yksi- tyisen verkon muodostamiseksi. VPN-yhteyttä käytetään useimmiten yrityksissä erillisten toimistorakennusten verkkojen yhdistämiseksi sekä etätyön mahdollistamiseksi. Tämän opinnäytetyön tavoitteena oli implementoida WireGuard VPN -ohjelmisto kotitoimis- toympäristöön sekä tutustua muihin itse hallittuihin VPN-ratkaisuihin ja yleisiin VPN-proto- kolliin. VPN-protokollista voitiin päätellä, että useat protokollissa käytetyt teknologiat ovat suorituskyvyltään raskaampia kuin tuoreemmat vaihtoehdot. Työssä implementoitiin WireGuard-tunneli päätelaitteena toimivan kannettavan tietoko- neen ja virtuaalisen pilvipalvelimen välille. Sama tunneli asennettiin ja testattiin myös mo- biililaitteella. Yhteys toteutettiin ensin manuaalisesti terminaalissa komento kerrallaan, ja lopulta asetukset siirrettiin erilliseen konfiguraatiotiedostoon. Yksittäiseen tiedostoon siirtä- minen nopeutti yhteyden muodostamista, sillä yhteys saatiin aktiiviseksi yksittäisellä ko- mennolla. Työn lopputuloksena syntyi kotitoimistossa toimiva VPN-ratkaisu, jolla käyttäjät pystyivät salaamaan tietoliikenteensä sekä kiertämään maantieteelliseen sijaintiin liittyviä rajoituksia. Implementaation suorituskyky testattiin vertaamalla yhteyden nopeutta VPN-yhteyden kanssa sekä ilman sitä. Lisäksi ohjelmiston salausalgoritmin toimivuus varmistettiin tutki- malla yksittäisten pakettien sisältöä. Avainsanat Tietoturva, VPN, WireGuard, etätyöskentely Contents List of Abbreviations 1 Introduction 1 2 Virtual Private Networks 1 2.1 What is a VPN 1 2.2 VPN connection types 2 2.2.1 Site-to-Site 2 2.2.2 Host-to-Site 3 2.2.3 Host-to-Host 4 2.3 Common VPN protocols 5 2.3.1 IPsec 5 2.3.2 IKEv2/IPsec 6 2.3.3 L2TP/IPsec 6 2.3.4 SSL/TLS 6 2.3.5 SSTP 6 3 Open-source VPN options 7 3.1 WireGuard 7 3.2 OpenVPN 8 3.3 SoftEther VPN 8 3.4 OpenConnect 9 3.5 strongSwan 9 3.6 Shadowsocks 9 4 Home office environment 10 5 Implementing WireGuard 11 5.1 Network topology 11 5.2 Server 12 5.3 Client 13 5.4 Mobile device 13 5.5 Installing WireGuard 13 5.5.1 Server-side installation 14 5.5.2 Client-side installation 15 5.5.3 Adding peers 16 5.5.4 Testing the VPN tunnel 17 5.6 Routing traffic through the VPN-tunnel 18 5.7 Simplifying the configuration 19 5.7.1 Configuration file on server-side 20 5.7.2 Configuration file on client-side 21 5.7.3 Activating the tunnel with wg-quick 22 5.8 Use on mobile device 23 5.9 Verifying the encryption with Wireshark 24 5.10 Performance 26 6 Conclusions 28 References 29 Appendices Appendix 1. WireGuard configuration files List of Abbreviations AWS Amazon Web Services. Subsidiary of Amazon that provides cloud computing platforms and services. EC2 Elastic Compute Cloud. Service by Amazon Web Services that allows users to rent virtual computers. HTTP Hypertext Transfer Protocol. Application layer protocol for hypermedia systems. HTTPS Hypertext Transfer Protocol Secure. Extension of HTTP used for secure communication over a network. ICMP Internet Control Message Protocol. Supporting protocol in Internet Protocol suite and used for operational information about success and failure while communicating. Protocol used by the applications like ping. IETF Internet Engineering Task Force. Open standards community concerned with the evolution and smooth operation of the Internet. IKE Internet Key Exchange. Protocol used for setting up security associations in the IPsec protocol suite. IPsec Internet Protocol Security. Secure network protocol suite that provides features for encrypted communication between two hosts over the internet. L2TP Layer 2 Tunneling Protocol. Tunneling protocol used to support Virtual Private Networks. LAN Local Area Network. Computer network that connects computers within a limited area. OSI Open Systems Interconnection model. Conceptual model that enables diverse communications systems to communicate using standard protocols. PPP Point-to-Point Protocol. Communications protocol that provides method for transporting datagrams over point-to-point links. SOCKS5 SOCKS protocol version 5. Protocol that exchanges network packets between a host and a server through a proxy server. SSTP Secure Socket Tunneling Protocol. Protocol that provides a mechanism to transport PPP traffic over TLS/SSL. SSL Secure Sockets Layer. Security technology for establishing an encrypted link between a server and client. TLS Transfer Layer Security. Successor of SSL. Protocol designed to facilitate privacy and encryption for communications over the Internet. VPN Virtual Private Network. Private network extended across a public network. 1 1 Introduction The spring of 2020 reimagined the future for remote work, especially for information workers. With more employees going remote, companies need to tackle information se- curity challenges that might have not been relevant in the past for them. The objective of this thesis was to implement WireGuard into a home office environment with multiple client devices. The thesis also takes a look into open-source and self-hosted options for VPN solutions as well as some of the most common VPN protocols. The implementation was done with an Ubuntu laptop acting as the client device and a virtual Ubuntu Server acting as the VPN gateway. The tunnel was also implemented and tested using a mobile device as the host device. The end result was planned to act as an eve- ryday VPN solution to add an additional layer of security for remote work. The subject was selected due to my personal interest in WireGuard. I’ve been following its development for a while and it created an interest for self-hosted VPN solutions. Cur- rent VPN solutions provided by VPN service providers are often closed systems with no visibility in how they’ve been implemented. Therefore, the user has no other option than accept the claims of these service providers while a self-hosted solution gives the power and responsibility to the user. 2 Virtual Private Networks 2.1 What is a VPN A Virtual Private Network (VPN) extends a private network across the public network and therefore allows devices to interact with each other as if they were directly connected. The data to be sent is encrypted for confidentiality, encapsulated for routing and sent through the public network. If a packet would be captured while in transit, the contents of the packet are incomprehensible without encryption keys. [1.] 2 One of the biggest problems that VPN was designed to solve is the fact that most organ- izations are divided into multiple locations across the globe and access to all company material within a network is often difficult due to strict network security measures. Creat- ing an encrypted virtual tunnel regardless of the location of the employee or the com- pany, allows for higher levels of efficiency and security. [2.] One must always consider the real use-case for their VPN use. One common miscon- ception about VPN’s is that they make you invisible on the Internet. Commonly, a VPN offers the user an increased, but not complete privacy. A lot of VPN service providers are logging all