CyberGhost: WireGuard Static IP for Seedbox

Configuring a seedbox with a static IP from CyberGhost via WireGuard allows for consistent remote access and port forwarding. This setup requires manual configuration but offers enhanced control.

Prerequisites

• Active CyberGhost VPN subscription with a static IP add-on.

• Seedbox with root access.

• Basic knowledge of Linux command line.

• WireGuard tools installed (apt install wireguard or equivalent).

WireGuard Configuration

1. Generate Key Pair:

2. wg genkey | tee privatekey | wg pubkey > publickey

3. CyberGhost Configuration: Obtain the following from CyberGhost support or account panel:

   • Your assigned static IP.

   • CyberGhost WireGuard server public key.

   • CyberGhost WireGuard server endpoint (IP address or hostname).

   • Allowed IPs for the tunnel (typically 0.0.0.0/0).

   • DNS server addresses.

4. Create WireGuard Interface Configuration (wg0.conf):

5. [Interface]

6. PrivateKey = <YourPrivateKey>
   Address = <YourStaticIP>/32
   DNS = <CyberGhost_DNS_1>, <CyberGhost_DNS_2>
   ​
   [Peer]
   PublicKey = <CyberGhost_Server_PublicKey>
   AllowedIPs = 0.0.0.0/0
   Endpoint = <CyberGhost_Server_Endpoint>:<Port>
   PersistentKeepalive = 25

   • Replace placeholders with actual values.

   • The port is usually 443 or 51820.

7. Bring Up the Interface:

8. wg-quick up wg0

Firewall Configuration (nftables)

1. Install nftables:

2. apt install nftables

3. systemctl enable nftables
   systemctl start nftables

4. Configure nftables (/etc/nftables.conf):

5. table inet filter {

6.        chain input {
                   type filter hook input priority 0; policy drop;
                   iifname "lo" accept comment "loopback"
                   ct state established,related accept comment "established/related"
                   iifname "wg0" accept comment "wireguard"
                   tcp dport { 22, 80, 443, <your_seedbox_port> } accept comment "specific ports"
                   icmp type echo-request limit rate 10/second accept comment "ping rate limit"
           }
   ​
           chain forward {
                   type filter hook forward priority 0; policy drop;
                   iifname "wg0" oifname != "wg0" accept comment "forward from wg0"
           }
   ​
           chain output {
                   type filter hook output priority 0; policy accept;
           }
   }

   • Replace <your_seedbox_port> with the port used by your seedbox application.

   • Adjust ports as needed.

7. Apply nftables Configuration:

8. nft -f /etc/nftables.conf

Port Forwarding (if needed)

• If your seedbox requires specific ports to be open for incoming connections, ensure these ports are forwarded through the CyberGhost WireGuard server.  This usually requires contacting CyberGhost support.

Quick Checks

• Interface Status: wg show wg0 – Verify that the interface is active and showing transferred data.

• Routing Table: ip route – Confirm that the default route is via the WireGuard interface.

• Connectivity: ping 8.8.8.8 – Test basic internet connectivity through the tunnel.

• External IP: curl ifconfig.me – Verify your IP address matches your assigned static IP.

Pitfalls

• Incorrect Keys: Double-check the public and private keys.

• Firewall Conflicts: Ensure nftables rules are correctly configured and do not block necessary traffic.

• DNS Leaks: Verify DNS queries are routed through the VPN.

• CyberGhost Restrictions: Some static IP addresses may have limitations on allowed ports or traffic types.

Checklist

• Generated WireGuard key pair.

• Obtained CyberGhost WireGuard server details.

• Configured wg0.conf with correct parameters.

• Activated the WireGuard interface.

• Configured nftables firewall rules.

• Verified connectivity and IP address.