On most laptops I use
wg-quick to setup my WireGuard tunnels, but recently I got a bit curious about using
systemd-networkd to the the same.
In particular I want the same split-tunnel setup that I’ve used before to work also with systemd-networkd.
Worth noticing is that the setup I describe here will automatically start the tunnel when launching the computer. I haven’t really investigated if it is possible to do it on demand.
You need to create two different files to get this to work:
Description=Wireguard tunnel wg0
PublicKey=<PUBLIC KEY OF REMOTE ENDPOINT>
Endpoint=<IP ADDRESS:PORT OF REMOTE ENDPOINT>
Note that the captalization of
WireGuard is important! (Spent quite some time on this…)
Since I’m setting up a split tunnel, I set AllowedIPs to the IP-ranges I want to reach through the tunnel, in CIDR-notation. In this case
10.0.0.0/20 which translates to 10.0.0.0 – 10.0.15.255, which covers the relevant parts of my local network.
# ~zozs.se causes dns lookups for domains ending in .zozs.se to be routed
# to the DNS servers of this link, but doesn't affect other domains.
In this file, routes and DNS is setup. This is only relevant if you also use
systemd-resolved for DNS. In this example, it will cause all DNS requests for
zozs.se and subdomains to use a DNS server on the WireGuard tunnel, instead of the system’s regular DNS. This ensures my split-tunnel DNS works correctly, but doesn’t affect any other DNS requests.
Remember that you need to reload the configuration. I do this by using
systemctl restart systemd-networkd.service.
After this, you can check the status with
networkctl. It should show an output similar to this:
IDX LINK TYPE OPERATIONAL SETUP
1 lo loopback carrier unmanaged
2 enp1s0f0 ether no-carrier configuring
3 wg0 wireguard routable configured
5 wlan0 wlan routable configured
4 links listed.