How to setup WireGuard
Assuming you have a block producer setup and relay node setup, this guide helps you secure and encrypt your network traffic between the two nodes with WireGuard. This minimizes the chances that your block producer is attacked or hacked. Only the relay node is public facing online and the block producer can only communicate with the relay node.
sudo apt install linux-headers-$(uname -r)sudo add-apt-repository ppa:wireguard/wireguardsudo apt-get updatesudo apt-get install wireguard -y
sudo sucd /etc/wireguardumask 077wg genkey | tee blockproducer-privatekey | wg pubkey > blockproducer-publickeywg genkey | tee relaynode1-privatekey | wg pubkey > relaynode1-publickey
Create a wg0.conf configuration file in /etc/wireguard directory. Update your Private and Public Keys accordingly. Change the Endpoint to your RelayNode's public IP or DNS address.
# blockproducer WireGuard Configuration[Interface]# blockproducer addressAddress = 10.0.0.1/32# blockproducer private keyPrivateKey = SJ6ygM3csa36...+pO4XW1QU0B2M=# blockproducer wireguard listening portListenPort = 51820SaveConfig = true# RelayNode1[Peer]# relaynode1's publickeyPublicKey = Rq7QEe2g3qIjDftMu...knBGS9mvJDCa4WQg=# relaynode1's public ip address or dns addressEndpoint = relay.mydomainname.com:51820# relaynode1's interface addressAllowedIPs = 10.0.0.2/32# send a handshake every 21 secondsPersistentKeepalive = 21
# RelayNode1 WireGuard Configuration[Interface]Address = 10.0.0.2/32PrivateKey = cF3OjVhtKJAY/rQ...LFi7ASWg=ListenPort = 51820SaveConfig = true# BlockProducer[Peer]# blockproducer's public keyPublicKey = rZLBzslvFtEJ...JdfX4XSwk=# blockproducer's public ip address or dns addressEndpoint = 12.34.56.78:51820# blockproducer's interface addressAllowedIPs = 10.0.0.1/32PersistentKeepalive = 21
ufw allow 51820/udp# check the firewall rulesufw verbose
ufw allow 51820/udp# check the firewall rulesufw verbose
Setup systemd on both your block producer and relaynode.
Add the service to systemd.
sudo systemctl enable wg-quick@wg0.servicesudo systemctl daemon-reload
Start wireguard.
sudo systemctl start wg-quick@wg0
Check the status.
sudo systemctl status wg-quick@wg0
Check the status of the interfaces by running wg
sudo wg## Example Output# interface: wg0# public key: rZLBzslvFtEJ...JdfX4XSwk=# private key: (hidden)# listening port: 51820#peer:# endpoint: 12.34.56.78:51820# allowed ips: 10.0.0.2/32# latest handshake: 15 seconds ago# transfer: 500 KiB received, 900 KiB sent# persistent keepalive: every 21 seconds
Verify ping works between nodes.
ping 10.0.0.2
ping 10.0.0.1
Update and/or review your topology.json file to ensure the "addr" matches this new tunneled IP address, and not the usual public node IP address.
Example: topology.json on blockproducer { "addr": "10.0.0.2", "port": 6000, "valency": 1 },
topology.json on relaynode1 { "addr": "10.0.0.1", "port": 6000, "valency": 1 },
Congrats! Wireguard is working!
sudo systemctl stop wg-quick@wg0sudo systemctl disable wg-quick@wg0.servicesudo systemctl daemon-reload
