Lukas Stancik
8176e71b81
Basic working code that is capable of establishing the Wireguard tunnel given that there is properly configured `.psk` file for at least one known wifi network (see README.md for more details)
38 lines
2.0 KiB
Markdown
38 lines
2.0 KiB
Markdown
# Wireguard Road Warrior setup for RaspberryPi 4
|
|
|
|
Code in this repository produces files for bootable Micro-SD card for RaspberryPi 4. During the boot it creates `entropi_nomap` WIFI access point (hotspot) that clients can connect to. It then encrypts all client traffic through Wireguard tunnel via any known WIFI network in reach. This is supposed to be a headless Alpine Linux router essentially. There is no web admin interface - only SSH access from the client side using public keys (or, you know, physical access with keyboard and monitor attached to the RaspberryPi).
|
|
|
|
## Requirements
|
|
|
|
- RaspberryPi
|
|
- WIFI over USB dongle
|
|
- USB-C cable for powering RaspberryPi (could be plugged directly into a laptop)
|
|
- Micro-SD card (I use 2GB and that's plenty big) - Formatted with single FAT32 partition named `entropi`
|
|
- Properly set up machine running Wireguard peer instance reachable from the Internet
|
|
|
|
## Usage
|
|
|
|
1. Clone this repository
|
|
1. Edit `.env` file
|
|
1. Create `.vault_password_file` and put a plain text password inside (used for decrypting/encrypting wireguard keys and other stuff)
|
|
1. Replace all files listed as `FILES_IN_VAULT` inside the `vault` script with appropriate contents
|
|
1. Create known networks files (see below)
|
|
1. Insert MicroSD card into your computer and make sure it is mounted under /media/{user}/entropi (edit the Makefile if necessary)
|
|
1. Run `make card`
|
|
1. Eject the card and use it to boot RaspberryPi (after a minute or two you should see it provides your wifi)
|
|
|
|
### Known WIFI networks setup
|
|
|
|
Create `secrets` folder and put plain text files inside named `{KNOWN_WIFI_SSID}.psk` where `{KNOWN_WIFI_SSID}` is the name of each wifi you want to be used to tunnel through (coffee shops, your ISP etc.). Contents of each file needs to be following:
|
|
|
|
```
|
|
[Security]
|
|
Passphrase={KNOWN_WIFI_PASSWORD}
|
|
AlwaysRandomizeAddress=true
|
|
|
|
[Settings]
|
|
AutoConnect=true
|
|
```
|
|
|
|
All the files will be automatically picked up by the wifi daemon after the RaspberryPi finishes boot process
|