Option to install Wireguard as Service #270

mortwein commented 2025年06月25日 10:33:49 +02:00

Is there a possibility to make an option in the Windows Client to install the Wireguard as Service so it will be connected at boot time and it would be possible to disconnect from the VPN after login (not like the wireguard service as allways on vpn).

This would be a simple possibility to achieve pre-logon on Windows devices and to disconnect the clients from VPN if they are On-Site.

Is there a possibility to make an option in the Windows Client to install the Wireguard as Service so it will be connected at boot time and it would be possible to disconnect from the VPN after login (not like the wireguard service as allways on vpn). This would be a simple possibility to achieve pre-logon on Windows devices and to disconnect the clients from VPN if they are On-Site.

fkooman commented 2025年06月25日 12:36:04 +02:00

Context: https://lists.geant.org/sympa/arc/eduvpn-deploy/2025-06/msg00007.html

Context: https://lists.geant.org/sympa/arc/eduvpn-deploy/2025-06/msg00007.html

rozmansi commented 2025年07月02日 19:05:18 +02:00

This is the main reason I am not using eduVPN client myself. 😳

I said many times:

VPNs connect computers, not users.

But, the eduVPN team didn't listen to me when we started this project. Jason of the WireGuard did. Hence, the architecture of eduVPN client does not allow this, but the Windows WireGuard client does.
Your option is to go to your eduVPN server portal, get a WireGuard config file, and use stock WireGuard client on your Windows.

This would also solve #195, but would require a complete eduVPN Client for Windows redesign. Like "starting a new product" kind of redesign.

This is the main reason I am not using eduVPN client myself. 😳 I said many times: > VPNs connect computers, not users. But, the eduVPN team didn't listen to me when we started this project. Jason of the WireGuard did. Hence, the architecture of eduVPN client does not allow this, but the Windows WireGuard client does. Your option is to go to your eduVPN server portal, get a WireGuard config file, and use stock WireGuard client on your Windows. This would also solve #195, but would require a complete eduVPN Client for Windows redesign. Like "starting a new product" kind of redesign.

mortwein commented 2025年08月06日 09:31:18 +02:00

For our purpose, we need to have a connection on boot to log into Microsoft AD oder ZENWorks and after login the VPN Should be disconnected and the regular EduVPN Clinet should be used. So we though about using a special profile in eduvpn for connecting to AD/ZEN. This profile will be used to generate a wireguard config via AdminAPI.

For starting and stopping the wireguard service windows Scheduled Tasks could be used. I created a POC using "Inno Setup" for installing Wireguard, the profile and the service and tasks. The Profile has to be shipped with the installer.

 [Setup]
AppName=EduVPN-Pre-Logon
AppVersion=1.5
WizardStyle=modern
DefaultDirName={autopf}\EduVPN-Pre-Logon
DefaultGroupName=EduVPN-Pre-Logon
OutputDir=userdocs:Inno Setup Examples Output
PrivilegesRequired=admin
[Files]
Source: "{tmp}\wireguard-installer.exe"; DestDir: "{app}"; Flags: external;
Source: "{src}\profile\evpn.conf"; DestDir: "{app}"; Flags: external
;[Icons]
;Name: "{group}\My Program"; Filename: "{app}\MyProg.exe"
[Run]
Filename: "{app}\wireguard-installer.exe"; Flags: waituntilterminated
Filename: "C:\Program Files\WireGuard\wireguard.exe"; Parameters: "/uninstallmanagerservice"; Flags: waituntilterminated runascurrentuser
Filename: "C:\Program Files\WireGuard\wireguard.exe"; Parameters: "/installtunnelservice ""{app}\evpn.conf"""; Flags: runascurrentuser
Filename: "schtasks"; \
 Parameters: "/Create /SC ONSTART /TN ""StartVPN"" /TR ""sc start WireGuardTunnel$evpn"" /RL HIGHEST"
Filename: "schtasks"; \
 Parameters: "/Create /SC ONLOGON /TN ""StopVPN"" /TR ""sc stop WireGuardTunnel$evpn"" /RL HIGHEST"
[Code]
var
 DownloadPage: TDownloadWizardPage;
function OnDownloadProgress(const Url, FileName: String; const Progress, ProgressMax: Int64): Boolean;
begin
 if Progress = ProgressMax then
 Log(Format('Successfully downloaded file to {tmp}: %s', [FileName]));
 Result := True;
end;
procedure InitializeWizard;
begin
 DownloadPage := CreateDownloadPage(SetupMessage(msgWizardPreparing), SetupMessage(msgPreparingDesc), @OnDownloadProgress);
 DownloadPage.ShowBaseNameInsteadOfUrl := True;
end;
function NextButtonClick(CurPageID: Integer): Boolean;
begin
 if CurPageID = wpReady then begin
 DownloadPage.Clear;
 // Use AddEx to specify a username and password
 DownloadPage.Add('https://download.wireguard.com/windows-client/wireguard-installer.exe?dontcount=1', 'wireguard-installer.exe', '');
 DownloadPage.Show;
 try
 try
 DownloadPage.Download; // This downloads the files to {tmp}
 Result := True;
 except
 if DownloadPage.AbortedByUser then
 Log('Aborted by user.')
 else
 SuppressibleMsgBox(AddPeriod(GetExceptionMessage), mbCriticalError, MB_OK, IDOK);
 Result := False;
 end;
 finally
 DownloadPage.Hide;
 end;
 end else
 Result := True;
end; 

There are some tests left. And we need a solution how to get the profile in a user friendl way from the API and ship it with a personalized installer.

For our purpose, we need to have a connection on boot to log into Microsoft AD oder ZENWorks and after login the VPN Should be disconnected and the regular EduVPN Clinet should be used. So we though about using a special profile in eduvpn for connecting to AD/ZEN. This profile will be used to generate a wireguard config via AdminAPI. For starting and stopping the wireguard service windows Scheduled Tasks could be used. I created a POC using "Inno Setup" for installing Wireguard, the profile and the service and tasks. The Profile has to be shipped with the installer. ``` [Setup] AppName=EduVPN-Pre-Logon AppVersion=1.5 WizardStyle=modern DefaultDirName={autopf}\EduVPN-Pre-Logon DefaultGroupName=EduVPN-Pre-Logon OutputDir=userdocs:Inno Setup Examples Output PrivilegesRequired=admin [Files] Source: "{tmp}\wireguard-installer.exe"; DestDir: "{app}"; Flags: external; Source: "{src}\profile\evpn.conf"; DestDir: "{app}"; Flags: external ;[Icons] ;Name: "{group}\My Program"; Filename: "{app}\MyProg.exe" [Run] Filename: "{app}\wireguard-installer.exe"; Flags: waituntilterminated Filename: "C:\Program Files\WireGuard\wireguard.exe"; Parameters: "/uninstallmanagerservice"; Flags: waituntilterminated runascurrentuser Filename: "C:\Program Files\WireGuard\wireguard.exe"; Parameters: "/installtunnelservice ""{app}\evpn.conf"""; Flags: runascurrentuser Filename: "schtasks"; \ Parameters: "/Create /SC ONSTART /TN ""StartVPN"" /TR ""sc start WireGuardTunnel$evpn"" /RL HIGHEST" Filename: "schtasks"; \ Parameters: "/Create /SC ONLOGON /TN ""StopVPN"" /TR ""sc stop WireGuardTunnel$evpn"" /RL HIGHEST" [Code] var DownloadPage: TDownloadWizardPage; function OnDownloadProgress(const Url, FileName: String; const Progress, ProgressMax: Int64): Boolean; begin if Progress = ProgressMax then Log(Format('Successfully downloaded file to {tmp}: %s', [FileName])); Result := True; end; procedure InitializeWizard; begin DownloadPage := CreateDownloadPage(SetupMessage(msgWizardPreparing), SetupMessage(msgPreparingDesc), @OnDownloadProgress); DownloadPage.ShowBaseNameInsteadOfUrl := True; end; function NextButtonClick(CurPageID: Integer): Boolean; begin if CurPageID = wpReady then begin DownloadPage.Clear; // Use AddEx to specify a username and password DownloadPage.Add('https://download.wireguard.com/windows-client/wireguard-installer.exe?dontcount=1', 'wireguard-installer.exe', ''); DownloadPage.Show; try try DownloadPage.Download; // This downloads the files to {tmp} Result := True; except if DownloadPage.AbortedByUser then Log('Aborted by user.') else SuppressibleMsgBox(AddPeriod(GetExceptionMessage), mbCriticalError, MB_OK, IDOK); Result := False; end; finally DownloadPage.Hide; end; end else Result := True; end; ``` There are some tests left. And we need a solution how to get the profile in a user friendl way from the API and ship it with a personalized installer.