The ungleich VPN infrastructure » History » Version 11
Nico Schottelius, 01/23/2019 04:00 PM
| 1 | 1 | Nico Schottelius | h1. The ungleich VPN infrastructure |
|---|---|---|---|
| 2 | |||
| 3 | 5 | Nico Schottelius | {{toc}} |
| 4 | |||
| 5 | 11 | Nico Schottelius | h2. Status |
| 6 | |||
| 7 | This document is *IN PRODUCTION*. |
||
| 8 | |||
| 9 | 1 | Nico Schottelius | h2. Wireguard on vpn-2a0ae5c1.ungleich.ch |
| 10 | |||
| 11 | * Server: vpn-2a0ae5c1.ungleich.ch |
||
| 12 | * Port: 51820 |
||
| 13 | * Requires a public key |
||
| 14 | 7 | Nico Schottelius | * Client network: 2a0a:e5c1:100::/40 |
| 15 | 1 | Nico Schottelius | * Client network size: /48 |
| 16 | |||
| 17 | 9 | Nico Schottelius | h3. How to add a new customer connection |
| 18 | 1 | Nico Schottelius | |
| 19 | 9 | Nico Schottelius | * Get the public key of the customer |
| 20 | * Edit dot-cdist/type/__ungleich_wireguard/manifest and add the new network definition at the end of the file |
||
| 21 | * Let the customer know their network |
||
| 22 | 1 | Nico Schottelius | |
| 23 | |||
| 24 | 9 | Nico Schottelius | h3. Sample clustomer client configuration |
| 25 | |||
| 26 | * "Install wireguard":https://www.wireguard.com/install/ |
||
| 27 | * Create your private key: @umask 077; wg genkey > privkey@ |
||
| 28 | * Get your public key: @wg pubkey < privkey@ |
||
| 29 | ** You need to send this pubkey to ungleich |
||
| 30 | * You will get your network definition after we have received your public key |
||
| 31 | * Create /etc/wireguard/wg0.conf |
||
| 32 | |||
| 33 | 1 | Nico Schottelius | <pre> |
| 34 | [Interface] |
||
| 35 | PrivateKey = YOURKEYHERE |
||
| 36 | ListenPort = 51280 |
||
| 37 | |||
| 38 | [Peer] |
||
| 39 | 9 | Nico Schottelius | PublicKey = hi60lGP+xEUQ+kVnqA7PlJAO1SVqTS1W36g0LhFP0xQ= |
| 40 | 1 | Nico Schottelius | Endpoint = vpn-2a0ae5c1.ungleich.ch:51820 |
| 41 | AllowedIPs = ::/0 |
||
| 42 | </pre> |
||
| 43 | |||
| 44 | Commands for setting it up |
||
| 45 | |||
| 46 | <pre> |
||
| 47 | MY_NET=2a0a:e5c1:XXXX::1/48 |
||
| 48 | |||
| 49 | ip link add dev wg0 type wireguard |
||
| 50 | |||
| 51 | # Replace with your range |
||
| 52 | ip addr add $MY_NET dev wg0 |
||
| 53 | |||
| 54 | # Add routing |
||
| 55 | ip route add 2a0a:e5c1:100::/40 dev wg0 |
||
| 56 | ip route add ::/0 via 2a0a:e5c1:100::1 |
||
| 57 | |||
| 58 | # Configure the interface |
||
| 59 | wg setconf wg0 /etc/wireguard/wg0.conf |
||
| 60 | |||
| 61 | # Bring it up |
||
| 62 | ip link set wg0 up |
||
| 63 | </pre> |
||
| 64 | |||
| 65 | Debugging |
||
| 66 | |||
| 67 | * wg show |
||
| 68 | * ping 2a0a:e5c1:100::1 |
||
| 69 | 6 | Nico Schottelius | |
| 70 | h3. Sample server configuration |
||
| 71 | 1 | Nico Schottelius | |
| 72 | 10 | Nico Schottelius | This is just for reference - as a client you don't need this configuration |
| 73 | |||
| 74 | 6 | Nico Schottelius | /etc/wireguard/wg0.conf: |
| 75 | |||
| 76 | <pre> |
||
| 77 | [Interface] |
||
| 78 | ListenPort = 51820 |
||
| 79 | 7 | Nico Schottelius | PrivateKey = SERVERKEYHERE |
| 80 | 6 | Nico Schottelius | |
| 81 | # Nico, 2019-01-23 |
||
| 82 | [Peer] |
||
| 83 | PublicKey = kL1S/Ipq6NkFf1MAsNRou4b9VoUsnnb4ZxgiBrH0zA8= |
||
| 84 | AllowedIPs = 2a0a:e5c1:101::/48 |
||
| 85 | |||
| 86 | # Customer networks below |
||
| 87 | # ... |
||
| 88 | </pre> |
||
| 89 | |||
| 90 | Sample server rc.local: |
||
| 91 | |||
| 92 | <pre> |
||
| 93 | ip link add dev wg0 type wireguard |
||
| 94 | ip addr add 2a0a:e5c1:100::1/40 dev wg0 |
||
| 95 | wg setconf wg0 /etc/wireguard/wg0.conf |
||
| 96 | ip link set wg0 up |
||
| 97 | |||
| 98 | 1 | Nico Schottelius | </pre> |
| 99 | |||
| 100 | h2. OpenVPN on openvpn.ungleich.ch |
||
| 101 | |||
| 102 | * Server: openvpn.ungleich.ch |
||
| 103 | * Port: 1195 |
||
| 104 | * Requires a certificate |
||
| 105 | * Address range: 2a0a:e5c0:3::/48 |
||
| 106 | ** Client networks are /64 |