I wrote a simple script that helps me create Surfshark's wireguard connection on my OpenWRT.
I'm sharing it with you in a hope that it hopefully will help someone else.
Please see
It needs curl and jq because it calls Surfshark API in order to get server's information and submit generated public key to Surfshark.
Right now it generates normal wireguard config file and the next step is to generate/emit set of uci commands to actually add it OpenWRT.
I think I evaluated Surfshark a year or so ago. If I remember right, I didn't go with them because they do not provide the WG configs to users so they can set it up themselves. Hence the need for this script, is that correct? Nice to see this is an option.
Right now they still don't officially provide WG configs.
I saw in github that there are some repositories in other languages that say they generate wireguard configs, and what I've done is just converting them to shell scripts so we can run/use it on OpenWRT.
I tried your script and I’m having the same problem where my public key is not registered with the Surfshark servers. Do you mind sharing what you did to make it work? Thanks in advance for your help and for making this script! Cheers!
I find myself in a similar situation here as well - Peer One handshake, Peer Two never sees a handshake.
I added some echo commands to the script to allow me to track function returns and variables, and added -v switch to the curl calls to track what might be failing here.
Everything runs fine until the script hits the
VALIDATE PUBKEY Function - output below
< HTTP/1.1 404 Not Found <------------
.
.
S N I P
.
.
The script populates the .conf files absolutely correctly. Correct public/private keys, IP's,MTU, and required peer values. It works as advertised.
EDIT: My apologies to @yazdan. I mistakenly misconstrued the logic between the wg_check_pubkey and wg_reg_pubkey functions.
@RuralRoots It's recommended that you delete all files in the directory except for config.json and wg_gen_config.sh
Also, the script will populate the .conf files (and include private keys) even if the username and password are incorrect in config.json. I tried running the script with username: user and password: pass in the config.json and the script completed successfully along with a private key and a directory of .conf files. Of course, these .conf files will not successfully establish a connection in the Wireguard client.
For me, the failure is occurring at /v1/account/users/public-keys/validate but the API response is different.
Hi guys, this sounds really super interesting. Is there any chance this will make it into part of the openwrt software list, so i can install it like openvpn? wireguard is so much faster than openvpn...
i would be very grateful as i am always happy if sth with openwrt starts working, but with this scripts here, i feel overwhelmed.
wg.json contains MY valid Private/Public keys generated from the standard wg genkey function - no need to regenerate another key pair.
True, but irrelevant. If SS username/password authentication fails it creates an empty authentication token.json file OR a properly signed and correctly populatedtoken.json file if authentication passes. A proper token.json file must be valid for success. The recent commit adding set -e and unset delimiting the login function appears to address this.
Same place I noted. If the function validatefails ie (HTTP/1.1 404 Not Found/code":400,"message":"Bad Request"), your wgpub key will never be registered with SS. wg_reg_key () function just essentially verifies your token key hasn't expired.
Provided:
Your SS username/password is configured correctly and authenticated you will get your token.json file.
You have your valid wg genkey - you can use the script to generate a new pair, or keep your existing key pair
the script works as advertised. No changes to the SS API.
My problem came back to ISP issues and my attempts to trace through the script logic.
If you have a SS account it will work with Wireguard on OpenWrt. You will need to install: opkg update ; opkg install wireguard-tools ; opkg install kmod-wireguard ; luci-app-wireguard ; luci-proto-wireguard ; jq ; curl as a prerequisite.
No worries, the thread title is accurate. Go the the first post by @yazdan and click on the github link. Click on the green "Code" button and select "Download ZIP" and extract gen_wg_config.sh and config.json.sample. Read the read.me as well.
Hi I'm in trip and I tried the script my self and it is not also working for me. I think Surfshark has changed something in its API. I need to investigate more after I got back to home
Public and Private keys are generated locally and we just register public key, so they are somehow local and are not related to Surfshark's usename and password
It was my first try and the error handling is not there. I updated the repo and just add set -e so it will fail if something goes wrong. It still needs improvement regarding error handling
