Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Wag, MFA and Enrollment for WireGuard

github.com

Post reply on HN
Print view View original

51–60 of 68 posts

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#51

Post by Nullence »

zeotroph wrote: post #15
aragilar wrote: post #4

[flagged]

"Numerous others" which also support MFA, have some (Web)-UI and are also open source? I only know of DefGuard[1], which aspires to do a lot more. 1: https://github.com/DefGuard/defguard discussed at https://news.ycombinator.com/item?id=36056080

Man Deguard definitely looks slick and the UI looks really nice!

I'd be super interested to know how they track "session state" as their do seem to rely very heavily on adding proxies and other additional software layers in front of the wireguard connection itself (https://defguard.gitbook.io/defguard/admin-and-features/wire...)

With wag specifically it's all just wireguard and a tiny bit of ebpf to do the management, along with tracking the external IP to determine if its time to re-challenge a user.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#52

Post by Nullence »

aragilar wrote: post #45
zeotroph wrote: post #15

Earlier quoted context omitted.

"Numerous others" which also support MFA, have some (Web)-UI and are also open source? I only know of DefGuard[1], which aspires to do a lot more. 1: https://github.com/DefGuard/defguard discussed at https://news.ycombinator.com/item?id=36056080

https://github.com/netbirdio/netbird seems to be completely open source (BSD), https://github.com/gravitl/netmaker?tab=License-1-ov-file#re... uses Apache for the non-pro stuff, and both of those I found by simply looking at https://github.com/topics/wireguard This is why I asked, the phrase "I decided to reinvent the wheel which has honestly been quite fun with learning about eBPF, and recently clustering and HA wit…

Ah the readme is definitely more geared to "how can I use this" rather than "how does this work.

Primarily because I want people to have a reasonably good time setting it up, rather than having to go through my explanation on things!

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#53

Post by hnarn »

This sounds very similar to Head- or Tailscale, nice to see some alternatives to managing wireguard networks. Is there a comparison anywhere to understand what functionality overlaps, what is added, what differs and what will perhaps never be implemented?

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#54

Post by Nullence »

mbreese wrote: post #28
stavros wrote: post #7

Earlier quoted context omitted.

This is one of my pet peeves about HN. It's Entrepreneur News, not Hacker News. A hacker's first response would be "this is cool!" whereas here it's "what's the business case for this?".

I don’t know if the parent was edited or not, but that’s not how I read the parent post. I didn’t take it as malicious, but trying to understand more about this method. I’d love for the author to tell us a bit more about how it works. I’m curious about what obstacles the author hit and how they got around them. Note: re: the flagged sibling comment. Yeah, that one doesn’t get the benefit of the doubt and was out of b…

Welp, I have no idea if anyone will read this as its been a little while since it was put up and is in a flagged comment, but hey I'll do a lil explanation of some of the issues I ran in to, and how it works.

How it works:

In short, Wag adds an eBPF program to a WireGuard device that it instantiates. The eBPF program uses a number of hash maps and LPM (longest prefix matching trie) maps to determine the policies that are applied traffic coming in on the wireguard device. These policies based on the ACLs defined per user/group, and contain MFA/Allow/Deny rules which require mfa, allow without auth and deny always respectively.

Wag also watches all the wireguard peers ingress IP addresses, and when an address changes it deauthenticates the user and requires the user to complete a login challenge. This is done by basically setting a bit in the maps exposed to eBPF that says "unauthorised"

Challenges:

First and foremost with WireGuard there is no good way of determining if an "external ip" i.e where the user is connecting from has changed. There was a patch set submitted for review in 2022~ that was never actually added to the kernel that would have added netlink compatibility and thus event based notification that things had changed, but alas that was never reviewed by Jason Donenfeld and has quietly died the death.

Secondly was defining multiple policies per route was quite difficult as eBPF doesnt do dynamic memory even in userland exposed maps and I wanted multiple rules per route, i.e you might allow port 80/tcp when MFA has passed but otherwise always allow 22/tcp. So to do that I had to define a maximum number of rules that could be inserted as one memory blob into the LPM map that the ebpf program would then linearly search to make its decision.

Thirdly has been making everything highly available which has been a bit of an on-going battle with ETCd mainly around how it manages cluster certificates as they dont (as of 2024 but it may be coming soon) expose the right structures to allow for dyanmic certificate creation, so you have to kind of make a wrapper around that in order to get everything going.

Im sure there are other things that I've had struggles with, but these are what come to mind immediately!

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#55

Post by Nullence »

hnarn wrote: post #53

This sounds very similar to Head- or Tailscale, nice to see some alternatives to managing wireguard networks. Is there a comparison anywhere to understand what functionality overlaps, what is added, what differs and what will perhaps never be implemented?

Similar in terms of it uses wireguard definitely! I havent made a direct comparison in the documentation as it's not something I'm currently going toward. This project suits my needs and is quite fun!

But I'll try and give a basic run down on the differences/similarities.

Wag is good for hub and spoke design where you want to have a hard boundary, rather than a tailscale-esque mesh where everything touches everything and then the rules define the overlay.

Both wag and tailscale add SSO integrations and effectively 2FA for securing your users.

And both of us have a way to enroll and a web UI to manage things, although I'm sure TailScale is much more polished considering I'm one guy who doesnt like web development.

As for things Im definitely not going to implement, probably interception or a TLS proxy to redirect users once their session logs out. Primarily just because doing that in eBPF is a little bit beyond me right at this second, and I dont feel like writing the DNAT/SNAT components I'd probably have to in order to get it working

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#56

Post by Nullence »

Avicebron wrote: post #6
d-z-m wrote: post #3

Do you protect against bruteforcing the TOTP code? I.e. via rate-limiting or a set amount of retries? I took a quick glance at the code and couldn't find anything to this effect. The scenario I'm imagining is: someone opens the TOTP entry UI in their browser, opens devtools, and starts to loop through all possible TOTP codes.

I can't speak to the specifics of this particular implementation but usually if someone has the login (username + password) to get to totp that user has already been compromised..

Oh wag doesnt use username and password auth by default. Those are only available in the OIDC integration or if you use PAM auth.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#57

Post by Nullence »

20after4 wrote: post #41
ta1243 wrote: post #26

This looks nice, but a couple of things > curl http://public.server.address:8080/register_device?key=e83253... > The service will return a fully templated response It looks like the "registration" involves the server generating a private key then sending to the client, rather than the client generating a private key and sending the public key to the server. Not only that but your example is http! Probably worth repla…

> I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop u…

Ironically I've also been thinking about this on and off for a bit, as it is definitely one of the pain points of using Wag at the moment.

My only problem is that if you capture that route and then redirect it, or whatnot, your peers wont be able to log in to wifi in public areas like coffee-shops/libraries/etc because the route will be trying to go via a VPN which wont be returning any real data.

Such as where you should be going to log in haha

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#58

Post by baobun »

Nullence wrote: post #57
20after4 wrote: post #41

Earlier quoted context omitted.

> I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop u…

Ironically I've also been thinking about this on and off for a bit, as it is definitely one of the pain points of using Wag at the moment. My only problem is that if you capture that route and then redirect it, or whatnot, your peers wont be able to log in to wifi in public areas like coffee-shops/libraries/etc because the route will be trying to go via a VPN which wont be returning any real data. Such as where you s…

Should be doable using FwMark and routing policy / nft rule?

So you'd put a fwmark on the interface , allowing you to route the VPN traffic separate from the traffic that should go over it. Then you have some mechanism to trigger when VPN is down. Curl someplace dedicated which also has a routing exception to go outside the tunnel. Detect captive portal IP. Add route (and clean up, like when online or switching).

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#59

Post by lmz »

asimops wrote: post #9

Have you tackled the issue of session management or are you planning to do so? Essentially wireguard key are just eternal session keys. I would expect software that implements the wireguard transport layer to implement session management to be called a working VPN server solution. This means a second channel to the server for periodically rotating session keys, terminating sessions, changing IP addresses, configuring…

> This means a second channel to the server for periodically rotating session keys, terminating sessions, changing IP addresses, configuring new routes and repeating authentication if necessary.

So IPsec's IKE protocol? Why not just... use IPsec?

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#60

Post by Avicebron »

yonatan8070 wrote: post #44
yardstick wrote: post #37

Earlier quoted context omitted.

Unfortunately these days it’s even easier with password managers containing all three (user, pass, token)

I want to believe users who use a password manager are also technically literate enough to secure it properly

Me too, but my day job means I handle a bit of secops, password managers are rolled out as security tools to users operating in enterprises where things like mandating people don't keep their passwords on a sticky note on their monitor is usually step one...
Post reply on HN