search
www.mikopbx.comTelegram communityForum
githubEdit

WireGuard - VPN

Example of connecting two PBX systems into a private WireGuard network.

circle-info

WireGuard configuration is available on MikoPBX version 2024.2.301-dev and newer builds.

WireGuard allows you to connect two MikoPBX systems into a single private network over the internet. This is useful when offices are in different locations and you need to set up direct SIP communication or configuration synchronization between them.

Conenction diagram

hashtag
Setting Up the Connection

  1. Connect to the PBX via SSH. Download the WireGuard configuration script to both the server and the client:

  1. On the "Client" PBX, run:

  1. Copy the public key, which looks like: "bnJTY0HZwO6OzDrnmHKxQ"

  2. On the "Server" PBX, assign an IP address to the key using the following command:

The output will look similar to this:

  1. Start the server:

Add a call to this script in cron via "System files customization":

circle-info

Adding this to cron is required for automatic tunnel recovery — after a PBX reboot or connection drop, WireGuard does not come back up on its own. The script runs every minute and re-establishes the connection when needed.

  1. Next, on the "Server" PBX, run:

Copy the public key, which looks like: "C82txdP8wh8pBztQ4Usyxw="

  1. On the "Client" PBX, connect to the server using the following command:

Replace:

  • 192.168.100.2 — with your client address assigned on the server by the add-peer command

  • "C82txdP8wh8pBztQ4Usyxw=" — with your server's public key

  • "pbx.test.ru" — with the public address of the server; the port is always 51820

Similarly to the "Server" PBX, add this command to cron via "System files Customization":

This ensures the connection is re-established automatically after a PBX reboot or connection drop.

hashtag
Verification

Run the following command on both the "Client" and "Server" PBX:

Expected output on the "Client" PBX:

Expected output on the "Server" PBX:

hashtag
Firewall Configuration

On the "Server" PBX, open the file /etc/firewall_additional for editing via "System files customization" and allow connections to the WireGuard port:

  • "0.0.0.0/0" — replace with a specific subnet or address for better security.

In the "Firewall" section, define the subnet 192.168.100.0/24 as local.

Last updated

Was this helpful?