Wireguard

Wireguard VPN Server Settings

To configure the Wireguard VPN Server settings, perform the following steps.

Steps

1. Select VPN from the side menu bar. The Wireguard tab is selected by default. It has two sections: Wireguard Server (remote clients that connect to this system) and Wireguard Client (connections from this system to a remote Wireguard server), see Figure Wireguard.

2. Click the Pencil icon at the top right of the Wireguard Server section. The Wireguard Server Settings pop-up appears, see Figure Wireguard VPN Server Settings.

3. Enter the Hostname / IP Address of the server (for example, myoffice.com).

4. Enter the Port for the VPN server (for example, 2022).

5. Click Save. To close the pop-up without saving, click Cancel.

Note: The pop-up displays the message In case of any modifications to these settings, the client configurations will be regenerated. These will need to be downloaded again on the client. After changing the server settings, download the connection file of each client again and upload it on the client.

Adding a new Wireguard VPN Client

To add a new Wireguard VPN client, perform the following steps.

Steps

Note: The Add New Client button is enabled only after the Wireguard Server settings are configured. Until then, it is greyed out and its tooltip reads Server configuration is a pre-requisite to create a new client.

1. If client profiles have been created, they are listed in the Wireguard Server table with the columns Client Name, Timestamp, Subnet(s), Status and Actions.

2. Click Add New Client at the top right of the Wireguard Server section. The Add New Client pop-up appears, see Figure Add New Client Pop-up.

3. Enter the Client Alias Name, i.e., a name for the new client.

4. Enter the Subnet(s) for the new client. The user can enter one or more subnets, comma-separated without spaces. Onboard networks should be used for this purpose.

5. Click Save. The client is added to the Wireguard Server table.

6. To download the connection file of a client, click the Download icon in the Actions column.

7. To delete a client, click the Delete icon in the Actions column.

Configuring Static Routes for Peer Subnets

After a client has been added under Wireguard Server, the server also needs a static route so it knows to send return traffic for that client's subnet(s) back through the tunnel.

Steps

1. Select Routes from the side menu bar and click the Static Routes tab.

2. Click Add Static Routes. A new row is added to the table.

3. Enter the client's subnet(s) (as entered in the client's Subnet(s) field) as the Destination Address.

4. Enter the client's tunnel gateway IP as the Gateway IP.

5. Click the green tick icon to save the route.

6. Repeat for each additional client.

For details, see Static Routes.

Note: Do not remove these routes once the tunnel is up — they are required for traffic to reach the client's LAN, not just for initial setup.

Adding a new Wireguard VPN Connection

To add a new Wireguard connection, perform the following steps.

Steps

1. Click Add New Connection at the top right of the Wireguard Client section, see Figure Wireguard.

2. The Add New Connection pop-up appears, see Figure Add New Connection.

3. Enter the Wireguard Server Alias Name, i.e., a name for this client connection.

4. Optionally, select a WAN Profile to apply this connection to. As the ℹ tooltip states, the selected WAN Profile should not have bonded links.

5. Optionally, enter a SNAT IP Address (for example, 10.10.10.10). It is displayed in the SNAT IP Address column of the Wireguard Client table.

6. Click the Upload Configuration icon and upload the connection file obtained from the server.

7. Click Save. To close the pop-up without saving, click Cancel.

8. The connection is listed in the Wireguard Client table with the columns Server Connection Name, Timestamp, Subnet(s), Hostname / IP Address, Port, Server Public Key, WAN Profile, SNAT IP Address, Status and Actions.

9. An event is generated each time the WireGuard VPN connection is established or disconnected. These events appear under Alerts and are pushed to Kloud for monitoring and alerting. For details, see KonnectOS Alerts.

10. To edit a connection, click the Pencil icon. Only the Connection Name and WAN Profile are editable, see Figure Edit Client Connection. Click the green tick icon to save the changes, or the X icon to discard them.

11. To delete a connection, click the Delete icon.

Configuring a Policy Route for VPN Traffic

By default, a WAN profile's traffic does not automatically route over a Wireguard connection. If you want only traffic destined for the remote site's subnet to use the tunnel — while all other traffic continues over the normal WAN — add a policy route.

Steps

1. Select SD-WAN > Policy Routes from the side menu bar.

2. Click Add Policy Route.

3. Enter a Policy Name.

4. For WAN Profile / VPN, select the Wireguard connection created above.

5. Enter the local LAN subnet(s) as Source Network(s).

6. Enter the remote site's subnet as Destination.

7. Click Save.

For details, see Policy Routes.

This keeps general internet traffic on the existing WAN/bonded connection and sends only local-LAN <--> remote-LAN traffic over the tunnel.

Troubleshooting WireGuard

To check the status of WireGuard and view the WireGuard client logs, run the following command from the Web CLI (Tools/Diagnostics > CLI):

k4.debug.wireguard

The output shows whether WireGuard is currently running, along with the client logs, which help diagnose both current and past VPN connection issues. This command is available from KonnectOS 8.1.2 Build 142. For details, see CLI page.

Example: Two-Site (Vessel-to-Shore) Configuration

This example applies the sections above to a common deployment: two remote sites (“Vessel1” and “Vessel2”) connecting to a central gateway (“ShoreServer”) over Wireguard, with policy routing so only site <--> shore LAN traffic uses the tunnel and general internet traffic continues via the site's own WAN.

Configuration variables

Walkthrough

• On ShoreServer, follow Adding a new Wireguard VPN Client once for each vessel — Client Name “Vessel1” / “Vessel2”, Subnet(s) = <VESSEL1_LAN> / <VESSEL2_LAN>. Download each client's connection file; you'll need it in step 3.

• On ShoreServer, follow Configuring Static Routes for Peer Subnets for each vessel: Destination =
  <VESSEL1_LAN> / <VESSEL2_LAN>, Gateway = <VESSEL1_GW> / <VESSEL2_GW>.

• On each vessel, follow Adding a new Wireguard VPN Connection: Server Alias Name = “ShoreServer”, then upload that vessel's connection file from step 1. Do not generate a new key pair — the uploaded file already contains the matching keys.

• On each vessel, follow Configuring a Policy Route for VPN Traffic: Source Network(s) = that vessel's own LAN, Destination = <SHORE_LAN>, WAN Profile / VPN = the ShoreServer connection from step 3.