I used to run Synology’s built-in OpenVPN Server. I had a spare Raspberry Pi lying around and figured I’d stand up another VPN server and play with WireGuard at the same time. After trying it out, the speed, configuration and chaining to an internal DNS server all worked without issue, so I’ll probably make it my main connection method going forward.

Raspberry Pi Setting

Flash lite x64 with the official tool and drop in an ssh file so the SSH server starts automatically:

scoop install raspberry-pi-imager

A round of updates:

sudo apt-get update
sudo apt-get dist-upgrade
sudo apt-get autoremove
sudo apt-get autoclean

Use raspi-config to update the hostname, password + expand filesystem + time zone:

sudo raspi-config

Update the firmware:

sudo rpi-update

Install PiVPN

Install pivpn and choose WireGuard as the VPN server. Just fill in the prompts; for DNS you can set a custom IP. I use AdGuard Home for DNS rewrites of my internal services, so I fill in AdGuard’s IP.

curl -L https://install.pivpn.io | bash

Here you can check whether the service and the port you configured are up:

$ sudo wg

interface: wg0
  public key: ***********
  private key: (hidden)
  listening port: 5487

$ sudo netstat -tunlp

udp        0      0 0.0.0.0:5487           0.0.0.0:*                           -
udp6       0      0 :::5487                :::*                                -

To add a user, just run pivpn -a -n <name>:

$ pivpn -a -n test
::: Client Keys generated
::: Client config generated
::: Updated server config
::: WireGuard reloaded
======================================================================
::: Done! test.conf successfully created!
::: test.conf was copied to /home/pi/configs for easy transfer.
::: Please use this profile only on one device and create additional
::: profiles for other devices. You can also use pivpn -qr
::: to generate a QR Code you can scan with the mobile app.
======================================================================

For more commands and usage see the pivpn docs https://docs.pivpn.io/wireguard/, which cover removing, disabling and listing users, backup and restore, and other settings — for example how to configure it if you also have Pi-hole installed.

pivpn -qr shows a QR code in the terminal that you can scan with your phone; on a computer you can just copy the config file under configs and feed it to the computer’s client.

$ pivpn -qr
::  Client list  ::
1) test
Please enter the Index/Name of the Client to show: 1
::: Showing client test below
=====================================================================

For the WireGuard client, see the official site https://www.wireguard.com/install/ to download the right one.

If you use port forwarding, remember to open the UDP port and configure it.

Once everything is set up you should see the connected devices:

 $ pivpn -c
::: Connected Clients List :::
Name      Remote IP                 Virtual IP      Bytes Received      Bytes Sent      Last Seen
zet       114.136.***.**:35713      10.6.0.2        5.4MiB              36MiB           Apr 03 2022 - 17:57:05

Misc

A few files you may need to modify:

• /etc/wireguard/wg0.conf stores settings like PrivateKey and ListenPort; if you need to change the port or add other settings later, edit it here
• /etc/pivpn/wireguard/setupVars.conf holds settings such as port, dns and host addr, mainly the extra values used when generating configs and QR codes