Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Bounce Server Setup

gitlab.com

Post reply on HN
Print view View original

21–30 of 80 posts

Re: WireGuard Bounce Server Setup

#21

Post by aftbit »

ahnick wrote: post #3

I must be missing something. Why go through all of this when you can just buy a domain name, setup dynamic dns on the natted network (to keep the IP updated), and then setup wireguard to route to the domain name? If you have two different networks then just use two different domains or subdomains.

What if you live in a college dorm or use apartment wifi where they do not give you control of the port forwarding rules? Or what if you want to deploy devices into other peoples' networks (e.g. IoT)? What if you're sending someone a bootable USB image so you can do data recovery on their hard drive in situ without them having to ship it to you? What if you're behind a carrier-grade NAT and don't have a public IPv4 address at all? In these cases and many more, you might find a wireguard bounce host useful.

Re: WireGuard Bounce Server Setup

#22

Post by _hyn3 »

https://zerotier.com does a very nice job of NAT "bouncing", free (hosted) for up to 50 hosts, or you can run your own.

You end up with another "zt" interface, so you can apply firewall rules to that interface, separate from your main NIC(s), kinda like assigning your own VPC but for your laptop, etc. It only takes a few seconds to install the agent and join your private network, and it seems to reconnect quite nicely as well; if your network is private, you can force all new attempts to connect to be approved (where you can check the mac address first). Basically, it's exactly the right level of technical config traits with a simple interface.

(no affiliation, just a very happy user, but I will say that running your own seems to be a lot more difficult than it should be..)

Re: WireGuard Bounce Server Setup

#23

Post by 1vuio0pswjnm7 »

0xbadcafebee wrote: post #20
1vuio0pswjnm7 wrote: post #15

"If you have someplace to put more secure equipment on the open net, that would be better. A [your choice of HW] would do fine, if it runs only your code." Idea: "Colocation centres" for users' computers instead of data centres for users' data. As directed by the author here, users would store no data on these computers.1 1. By their nature, each user-owned supernode computer would provide some discoverable metadata,…

> Idea: "Colocation centres" for users' computers instead of data centres for users' data. As directed by the author here, users would store no data on these computers. This is basically AWS Workspaces. It can work, but it's annoying, expensive, and various latency and bandwidth issues are a killer.

Love how they market that: "Desktop as a Service". Contrast with tiny, self-served routers owned by users that store no user data and whose only access is via SSH. Who owns the computers in the "AWS Workspace". Need to see the terms the AWS customer must agree to (non-negotiable, no doubt) to get a better understanding of what this service is really about.

Re: WireGuard Bounce Server Setup

#24

Post by aftbit »

I've had basically this exact setup running on a cloud server for the past few months. It's pretty liberating to be able to open ports to 10.44.0.0/24 and have all of my different machines easily access them, regardless of what networks they're connected to. I've added in an instance of nsd that manages a zonefile so I can do:

ssh laptop.wg.mydomain.net

which resolves into 10.44.0.3 for example.

There are two major downsides with this approach:

(1) all of your traffic must go by way of the bounce server, even if your machines are on the same LAN.

(2) the bounce host can observe all of your traffic.

I've been considering adding a second layer of wireguard on top of this for end-to-end encryption between nodes. Each machine would have one interface configured like this article suggests simply to assign a stable NAT-traversing IP address. Then they'd each have a second interface using the first-level IP addresses as endpoints. This would result in 2x the encryption overhead, both in CPU and more importantly in MTU, but it would mean the bounce host was no longer able to intercept even unencrypted data. If you run a daemon on all of the hosts, they can play with the endpoints used on this second level network to avoid using the bounce host when they find they can directly connect to each other, but the default path would work (if somewhat slowly) by the double tunnel process even without this daemon.

For bonus points, run multiple bounce hosts, connect to all of them from each peer, then select the endpoint to use for each paired peer connection based on the total path latency.

Re: WireGuard Bounce Server Setup

#26

Post by aftbit »

_hyn3 wrote: post #22

https://zerotier.com does a very nice job of NAT "bouncing", free (hosted) for up to 50 hosts, or you can run your own. You end up with another "zt" interface, so you can apply firewall rules to that interface, separate from your main NIC(s), kinda like assigning your own VPC but for your laptop, etc. It only takes a few seconds to install the agent and join your private network, and it seems to reconnect quite nicel…

Is zerotier FLOSS? I have been looking for something to fulfill this need, but especially after the Solarwinds hack, I am unwilling to run a closed-source agent on any of my hosts.

Re: WireGuard Bounce Server Setup

#27

Post by aftbit »

lights0123 wrote: post #25

Doesn't Ubuntu 20.04 have a kernel with Wireguard built in? You shouldn't need to use DKMS.

Even on my 20.04 box, I seem to have wireguard-dkms auto-installed in response to "apt install wireguard". Perhaps they are doing this to allow for faster wireguard module updates? Or perhaps this is just a bug.

https://launchpad.net/bugs/1890201

https://launchpad.net/ubuntu/+source/wireguard/1.0.20200513-...

Re: WireGuard Bounce Server Setup

#29

Post by ahnick »

aftbit wrote: post #21
ahnick wrote: post #3

I must be missing something. Why go through all of this when you can just buy a domain name, setup dynamic dns on the natted network (to keep the IP updated), and then setup wireguard to route to the domain name? If you have two different networks then just use two different domains or subdomains.

What if you live in a college dorm or use apartment wifi where they do not give you control of the port forwarding rules? Or what if you want to deploy devices into other peoples' networks (e.g. IoT)? What if you're sending someone a bootable USB image so you can do data recovery on their hard drive in situ without them having to ship it to you? What if you're behind a carrier-grade NAT and don't have a public IPv4 a…

Honestly, I'd probably just use Tailscale for that, so I guess the bounce server solution occupies some middle ground where one doesn't have control over the network and either doesn't have the money for tailscale or likes owning their infra end-to-end.

Re: WireGuard Bounce Server Setup

#30

Post by evil-olive »

aftbit wrote: post #26
_hyn3 wrote: post #22

https://zerotier.com does a very nice job of NAT "bouncing", free (hosted) for up to 50 hosts, or you can run your own. You end up with another "zt" interface, so you can apply firewall rules to that interface, separate from your main NIC(s), kinda like assigning your own VPC but for your laptop, etc. It only takes a few seconds to install the agent and join your private network, and it seems to reconnect quite nicel…

Is zerotier FLOSS? I have been looking for something to fulfill this need, but especially after the Solarwinds hack, I am unwilling to run a closed-source agent on any of my hosts.

Looks like the Business Source License [0]. Which does not qualify under the Open Source Definition [1], but they claim it meets "most" of the OSI criteria.

0: https://github.com/zerotier/ZeroTierOne/blob/master/LICENSE....

1: https://mariadb.com/bsl-faq-adopting/#osl

Post reply on HN