guide-wireguard(7): WireGuard on the whyred NetHunter kernel with the signed module

DESCRIPTION

Since v1.1.0 the AnyKernel3 zip carries a second signed module: wireguard.ko, built from wireguard-linux-compat with the same proton-clang toolchain as the kernel and signed with the same key. This matters because the kernel enforces CONFIG_MODULE_SIG_FORCE: an unsigned WireGuard module simply refuses to load, and the ROM-side userspace implementations (slow transports, userspace tunnels) are the workaround people used before. With the signed module you get the real kernel dataplane: wg-quick and the WireGuard app are just clients on top.

SETUP

After flashing the v1.1.0 zip (guide-install(7)), check the module is present and loadable:

$ adb shell su -c insmod /system/lib/modules/wireguard.ko
$ adb shell su -c dmesg | grep -i wireguard

No signature complaint in the log means the key matched. Prove the interface type exists:

$ adb shell su -c "ip link add dev wg0 type wireguard"
$ adb shell su -c "ip link del wg0"

If this fails with Operation not permitted even under su, the running kernel is older than v1.1.0. Check uname -a first, flash the right zip second.

CONFIG

Bring a config from wherever tunnels normally come from: your own server, a provider export, the WireGuard app QR. Standard /etc/wireguard/wg0.conf format:

[Interface]
PrivateKey = <your private key>
Address = 10.66.66.5/32
DNS = 10.66.66.1

[Peer]
PublicKey = <server public key>
Endpoint = 203.0.113.10:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

wg-quick comes from wireguard-tools inside the Kali chroot (installed from the NetHunter app). From the chroot as root:

$ wg-quick up /etc/wireguard/wg0.conf
$ wg show
interface: wg0
  public key: ...
  peer: ...
  endpoint: 203.0.113.10:51820
  transfer: 1.2 KiB received, 4.8 KiB sent

A growing transfer with a recent latest handshake line is the proof of life. Stop with wg-quick down wg0.

TWO WAYS TO RUN IT

Chroot side: the path above, full control, scripts and hooks work like any Linux box. Right choice for pentest workflows where the phone routes the team.
Android side: the official WireGuard app speaks to the same kernel module, so you can keep a tunnel up during normal daily use without touching the chroot. Import the same config, one tunnel at a time unless you like routing puzzles.

BUGS

AllowedIPs = 0.0.0.0/0 routes EVERYTHING through the tunnel, including adb over network. Local adb over USB survives, wireless debugging does not.
Deep sleep can pause keepalives on aggressive battery savers. Exclude the chroot or the WireGuard app from battery optimization if the handshake goes quiet.
The module is built against this exact kernel tree, vermagic locked. A module from another whyred kernel will not load, by design.

guide-wireguard(7)

DESCRIPTION

SETUP

CONFIG

TWO WAYS TO RUN IT

BUGS

SEE ALSO