Generating QR codes for Wireguard

calendar June 12, 2022 nav_categories Tech nav_categories Application nav_tags qr nav_tags wireguard nav_tags qrencode nav_tags networking

I've been a big fan of using Wireguard since I started using it at the beginning of this year.

Wireguard has the ability to scan a QR code to read the Wireguard tunnel configuration, which makes setting up a mobile device (phone, tablet, etc) much easier.

A QR code (Quick Response code) is a type of matrix barcode (or two-dimensional barcode). A barcode is a machine-readable optical label that can contain information about the item to which it is attached.

Mobile devices can then scan the QR code, and based on the information in the code, take appropriate action, such as open a web browser, connect to wifi, or configure a VPN tunnel endpoint on a client.

Generating a QR code for a Wireguard client

There are two ways of generating a QR code: Generate the code to scan on screen, and generate the code and output it to a file, in order to send it to the end user.

In this example, our wireguard-client.conf file looks like this:

[Interface]
PrivateKey = +Dq6JSGNqpGE3nqdjXqkpSOgBYEnDiS435/QbqRHQms=
Address = 10.0.0.2/24
DNS = 192.168.1.5, 192.168.1.6

[Peer]
PublicKey = 5ifRv4mFRho36V65zq3QOc/YUebQzGF6fsRccJWVSnc=
AllowedIPs = 0.0.0.0/0
Endpoint = example.com:51820
PersistentKeepalive = 25
  1. Generate a QR code to scan on screen.
qrencode -t ansiutf8 < wireguard-client.conf

█████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████████
████ ▄▄▄▄▄ █▀█▀▀▄ █▀█ ▀▀▀▄█  ▄▄▄█▀▀ ▀  ▀▄█▀ ▄▄  █▀▄ ██ ▄▄▄▄▄ ████
████ █   █ █▀ ▄█▄█▀▄▄█▄▀▀█▄███▄ █▄█ ▄▀ ▀ █  ▄▄ ▀▄█▄ ██ █   █ ████
████ █▄▄▄█ █▀▄ ▄██▄▄█ █▄█▄ ▄█  ▄▄▄ ▀ ▄  ▀   █ ▀▀█ ▀▄██ █▄▄▄█ ████
████▄▄▄▄▄▄▄█▄█ █▄█▄▀▄█▄█▄▀▄█▄█ █▄█ █▄▀ █▄█ █▄█▄▀ ▀ █ █▄▄▄▄▄▄▄████
████▄▄ ▄▄█▄▄ ▄▀▄▄ ▀▄█▄█ ▀▀▄ ▄█  ▄▄▄▄▄▄▄▄ ▀▀▀▄▀▀▄█▄▀█▀ █ ▀▄█▄▀████
████▄ ██▀█▄  ██ █▄ ▄▄███▀ █▀▀ ▄  █▄██▄   █▀ ▀▀ █▀   ▄█▄ ▀ ▀▄█████
████ ▄█▀  ▄ ▀▀▄ ▄▄▄▀█▄ ▄█▀▄▄█ ▄██▀██▄▄▄▄▄ ▄▀█  █▄▄▄█ ▀▄▀▀▀▄ ▄████
████▄ █▀█▄▄▄█ ▄█ █     ▀████▄▀▄ ▀█▀ ▀▀ ▄ ███▄█ ▄▄▀█ ▄▀▀▄█▄ ▄▄████
████   █▄█▄ ▄▄▄█▀▄█▄██▄▄▄▀▀  ▀▄▀   ▄█▄▄▄▀▀▄▀██▀█▀ █▀▄▀▄▀██▄ ▀████
████ ██▄ ▀▄ ▀▄ ▄█▀█ ▄▄▄▀█▄▀█▀▀ ▀▀▀█▄  ▄█  ▄ ▀▄ ▀ █▀▀▄▀▄▄▀▀▄▀▀████
████▀█▀▄ ▀▄█ ▄█  ▀█▄▀██▀█▀ ▀▄█▀  ▄  ▀   ▄▀▀▄█▀▄ █ ▀ ▄▀▄▀ ▄ ▀█████
████▄▀▀█  ▄▄█▄█ ▄██▄ ▄██ ▀▀██▀ ▀█▀▄█▀ ▄▀▄█ ▀ ▄ ██ ▄██▀▄▄ ▀  ▀████
████  ▀ ▀▀▄█ ▀▀▄▀█ ▄ ▄▀ ▀█▀██▄█▄▀▀ █▄▄▄▄▄▀▄▀ ▀▄▄█▄▀▄▀ █▀█▄▄ ▄████
████▄  ▄ ▄▄▄ ▀█▀▀▀█ ██ █▀ ▀▀▄█ ▄▄▄  ▀▀▄█▀ █  █▄█▄▀██ ▄▄▄   ▄█████
████▀ ▄▀ █▄█ ██▀ █▄▀ ▄▄▄██▄▀▄▀ █▄█ ▄ ██▄█▀█▀█ ▀█ ▄██ █▄█ ████████
██████ ▄ ▄▄▄▄▄█▄█▀▀▄█ █▀ ▀ █▄█   ▄▄█▀█▄▄▀▄▄█ ▀▀█ ▀ ▄▄  ▄▄▀▀▄ ████
█████ ▀▀▀ ▄▄█▀▀▀▄ ███  ▄▄▀█▀ █ █▄▄ ▄ █▀▀ █  ██ ██▀▀█████▄█ ▀ ████
██████▀ █ ▄ ▄▄▀   ▀▀██ ▄▄█▄ ▀█  ▀▄█ ▀▀ ▀▀▄█▄▀▀██▀████ ▀██▀█ █████
███████▄██▄▀▀▀▄▀▀██ █▄▀▀▀ █▀▄ ▄▄ ▄ ▀█▄ ▄▄▀▄ █▀▀▄▀▄▀  ██▄▄▀▄▄▄████
████ ▀▄█▀ ▄▄ ▀▄▄▄  ▄███▀▀  ▀▀▀▀ ▄▄▄ █ █▀▀▀ ▄███▄▀▄  ▄▀█▄▀▀ ▄█████
█████▄▄ █ ▄▀▀▄▄▀▀▀█  ▄▀ ▀▄███▀▄▄ █ ██▄█▄█▀▀▀ ▀█▄▄▄ █ ▀█▄▀▀██▀████
█████ ▄▄▀ ▄  ▄▀███▀ ▄▄ █▄ ▄▀█▄▄▄▀█ █▀ ▄ ▀██ ▀ ▀ ▄▀█▀ ▄▀▄▄▀▀▄█████
████▀█▀▄  ▄▄▀ ▀  ██▄ ▄▄▄██▄ ▄▄▀▄█▄▀█▄▄███▄█ ▄  ▄▄▄▄▀▀▀▀▄▄▄▀█▀████
████ ▀ ▀▀▄▄██▀█▀▀ ▄  ▀ ▄█▀█ ██▄ █▄▀ █ ▀█▄▄ ▀▄ █▀▄▄▄▀▄ ▀▄█  ▄▄████
██████████▄█▀▄   ▄▀█▄▄▄ █▀▀▀▀▀ ▄▄▄ ▀█▀▄ ▀▄█ █▄▀ ███▀ ▄▄▄ ▀▀█▀████
████ ▄▄▄▄▄ █▄▄▄▀ █  ▄██▄▀ ▄ █▄ █▄█ █▄▀▀█ ▀█ ▀▀▀▀▀▄▀▄ █▄█ ██ █████
████ █   █ █ ▄█▀▀▄█▀█▄▀▀  █▄▄█ ▄▄   ▀▄ ▄▄█ ▄█▀▀ █▄██ ▄   ▄ ██████
████ █▄▄▄█ █ ▀▄▀ ▀▄  █▀█▄▀██▄▄█▀▀▀█▄▀▄█  ▀▄ ▄█▀▀▄ ▄█▀▀▄▀█▀ ██████
████▄▄▄▄▄▄▄█▄█▄▄██▄██████▄▄███▄▄▄▄▄ █▄█▄██▄█▄█▄▄▄▄▄▄▄▀███▄▄▄▀████
█████████████████████████████████████████████████████████████████
█████████████████████████████████████████████████████████████████
  1. Generate the QR code, output it to a file, in order to send the QR code to the end user.
qrencode -t png -o wireguard-qr.png < example.conf

You can then send the resulting wireguard-qr.png file to the end user to scan and load the VPN tunnel config.

Differences in qrencode versions

In step #2 above, I generated the QR encode on my UDP Pro, which has an older version of qrencode.

On my UDP Pro, the correct syntax is qrencode -t png -o wireguard-qr.png < example.conf

However, on an Ubuntu 20.04 box, the correct syntax would be qrencode -t png -o wireguard-qr.png -r example.conf

Notice the < on the UDM Pro vs the -r on Ubuntu.

Versions of qrencode:

Ubuntu 20.04

qrencode --version qrencode version 4.0.2 Copyright (C) 2006-2017 Kentaro Fukuchi

UDM Pro

qrencode --version qrencode version 3.4.2 Copyright (C) 2006-2012 Kentaro Fukuchi

References

Github - tusc / wireguard-kmod FAQ https://github.com/tusc/wireguard-kmod#faq

Linux man page - qrencode https://linux.die.net/man/1/qrencode