(DIR) <- Back # Using Mullvad WireGuard VPN on OpenBSD Last modification on 2023-03-02 Recently I bought a ThinkPad X230 from a friend to use as a lightweight but robust travel laptop. I looked for a simpler and especially more battery-pleasing operating system than Qubes OS (which I use on my main machine) - but without compromising security on the run. So I went with installing OpenBSD (I have been using it on dozens of other machines, especially servers), as it seems to fit my usecases pretty well. To be suitable as a travel machine, a VPN is essential for my needs. The provider I am using at the moment is Mullvad[^1]. Easy I thought, download the WireGuard config files and go ... Nope, that just wasn't it. OpenBSD uses *ifconfig(8)* to configure WireGuard interfaces and a different syntax from Linux's *wg-quick* files. So, I translated the configs to the OpenBSD syntax, and... still no connection. Turns out OpenBSD needs some deluxe routing rules to correctly tunnel the VPN traffic. So I found a forum thread[^2], which proposed a fix and a blog post explaining a slightly different setup but still containing useful information[^3] - but still, it wasn't working for me. With a lot of route and WireGuard magic, and reading miles of OpenBSD man pages (which I love, btw), I got it to work finally. Here I want to show you my setup/configs so you won't have to spend an evening worth of time for route fixing too. ``` # hostname.wg0 description "Mullvad WireGuard (xx-xxx-wg-001)" inet <client ip>/32 wgkey foo wgpeer bar wgendpoint <endpoint ip> <port> wgaip 0.0.0.0/0 wgpka 20 wgrtable 1 wgrtable 1 up !route add default -net <client ip> ``` For each of your outgoing network interfaces (Wifi, Ethernet), add `rdomain 1` to the `hostname.if` file. ``` # resolv.conf nameserver 10.64.0.3 # mullvad lookup file bind ``` To skip the VPN route temporarily, one can use the following command: ``` $ route -T 1 exec <command> ``` When something does not work as expected using following command, debugging messages can be enabled on the WireGuard interface using `ifconfig wg0 debug` and read in `dmesg`. Edit: Somehow, reconnection after suspend or network reconnect is slow, maybe anyone knows a fix? [^1]: https://mullvad.net/ [^2]: https://www.unitedbsd.com/d/421-setting-up-a-wireguard-vpn-connection-on-openbsd-how-to/2 [^3]: https://dataswamp.org/~solene/2021-10-09-openbsd-wireguard-exit.html .