cmc/cleberg.net

  1#+date:        [2023-01-23 Mon 00:00:00]
  2#+title:       Random Mullvad WireGuard on Startup
  3#+description: A startup script to connect to a random Mullvad WireGuard server.
  4#+slug:        random-wireguard
  5#+filetags:    :linux:security:self-hosting:
  6
  7* Mullvad Wireguard
  8
  9If you're using an OS that does not support one of Mullvad's apps,
 10you're likely using the Wireguard configuration files instead.
 11
 12If not, the first step is to visit Mullvad's
 13[[https://mullvad.net/en/account/#/wireguard-config][Wireguard
 14configuration files]] page and download a ZIP of the configuration files
 15you want to use.
 16
 17Personally, I downloaded all configuration files across the world and
 18chose my connections using the script below.
 19
 20Once the files are downloaded, unzip them and move them to your
 21preferred location:
 22
 23#+begin_src sh
 24cd Downloads
 25unzip mullvad_wireguard_linux_all_all.zip
 26mkdir ~/mullvad && mv ~/Downloads/*.conf ~/mullvad/
 27#+end_src
 28
 29*** Creating a Script to Connect to a Random Host
 30
 31Once you have a folder of Wireguard configuration files from Mullvad,
 32you can create a script to randomly connect to any one of the locations.
 33
 34Start by creating a shell script - mine is called =vpn.sh=.
 35
 36#+begin_src sh
 37nano ~/vpn.sh
 38#+end_src
 39
 40Within this script, you can paste the following info. Note that I
 41specify =us-*= in my script, which means that it will only consider
 42US-based VPN locations. You can alter this or simply change it =*= to
 43consider all locations.
 44
 45#+begin_src sh
 46#!/bin/sh
 47
 48ls /home/$USER/mullvad/us-** |sort -R |tail -n 1 |while read file; do
 49    # Replace `doas` with `sudo` if your machine uses `sudo`,
 50    # or remove `doas` if users don't need to su to run wg-quick
 51    doas wg-quick up $file;
 52    printf "\nCreated Mullvad wireguard connection with file: $file";
 53    printf "\n\nPrinting new IP info:\n"
 54    curl https://am.i.mullvad.net/connected
 55done
 56#+end_src
 57
 58Once you've modified the script to your liking, add executable
 59permissions and run the script:
 60
 61#+begin_src sh
 62chmod +x ~/vpn.sh
 63~/vpn.sh
 64#+end_src
 65
 66The output should look like the following:
 67
 68#+begin_src txt
 69doas (user@host) password:
 70
 71# ... The script will process all of the iptables and wg commands here
 72
 73Created Mullvad wireguard connection with file: /home/user/mullvad/us-nyc-wg-210.conf
 74
 75Printing new IP info:
 76You are connected to Mullvad (server country-city-wg-num). Your IP address is 12.345.678.99
 77#+end_src
 78
 79That's all there is to it. You can see your new location and IP via the
 80=printf= and =curl= commands included in the script.
 81
 82You can also go to the [[https://mullvad.net/en/check/][Connection Check
 83​| Mullvad]] page to see if you are fully connected to Mullvad and if any
 84leaks exist.
 85
 86* Disconnecting from the Wireguard Connection
 87
 88If you forget which connection you're using, you can execute the
 89following command to see where Wireguard is currently connected:
 90
 91#+begin_src sh
 92wg show
 93#+end_src
 94
 95This command will show you the Wireguard interfaces and should output a
 96connection like so: =interface: us-lax-wg-104=.
 97
 98Once you have this, just disconnect using that files' full path:
 99
100#+begin_src sh
101wg-quick down /home/user/mullvad/us-lax-wg-104.conf
102#+end_src
103
104I have a TODO item on figuring out how to easily export an environment
105variable that contains the configuration file's full name, so that I can
106just execute the following:
107
108#+begin_src sh
109# Ideal situation if I can export the $file variable to the environment
110wg-quick down $file
111#+end_src
112
113If you have an idea on how to do this, email me!