WireGuard Bounce Server Setup • Hacker News Board

Re: WireGuard Bounce Server Setup

#31

Post by aftbit » Wed, Dec 16, 2020, 10:49 PM UTC

ahnick wrote: post #29

aftbit wrote: post #21

Earlier quoted context omitted.

What if you live in a college dorm or use apartment wifi where they do not give you control of the port forwarding rules? Or what if you want to deploy devices into other peoples' networks (e.g. IoT)? What if you're sending someone a bootable USB image so you can do data recovery on their hard drive in situ without them having to ship it to you? What if you're behind a carrier-grade NAT and don't have a public IPv4 a…

Honestly, I'd probably just use Tailscale for that, so I guess the bounce server solution occupies some middle ground where one doesn't have control over the network and either doesn't have the money for tailscale or likes owning their infra end-to-end.

For me, it's indeed about FLOSS and owning the system end-to-end. Plus, I want to be able to build things like Tailscale, and I can't very well do that just using the existing tools. :)

Re: WireGuard Bounce Server Setup

#32

Post by mbreese » Wed, Dec 16, 2020, 10:52 PM UTC

aftbit wrote: post #19

yokem55 wrote: post #4

I was hoping this was some kind of stun mechanism for wireguard. No, it's just setting up a cheap wireguard server on AWS. Anyone have anything like an introduction server to help wg peers behind nat find each other?

This[1] is the best post I've seen on that _outside_ of the Tailscale writeup linked below. The clever bit is that the introduction server uses wireguard tunnels to find your endpoint information, then shares it out via DNS. Of course it still requires you to be able to run custom code on all of the endpoints, which requires supporting many different platforms. I'm still looking for a FLOSS mesh network built on top…

I can't see how the post you linked actually does the NAT traversal...

Alice finds Bob's external IP:port using the registry. That makes sense. But doesn't Bob need to send a packet to Alice to setup the NAT traversal on his side? More accurately, Alice uses the SRV field to populate the wg peer information on her side -- but how does Bob know that he needs to update the peer information on his side?

I think this is really close, but maybe using a custom DNS server for this might be trying to be a little too clever?

Re: WireGuard Bounce Server Setup

#33

Post by IncludeSecurity » Wed, Dec 16, 2020, 11:01 PM UTC

This is a great FOSS tool if you don't want to deal with all of the low level stuff. https://github.com/StreisandEffect/streisand

We did an audit of it and they fixed lots of configuration problems, it's now pretty solid security defaults wise. And the WG integration works well.

They support the following setups: OpenSSH Tinyproxy OpenConnect / Cisco AnyConnect Stunnel Shadowsocks Obfsproxy WireGuard,

Running on: Amazon Web Services (AWS) Microsoft Azure Digital Ocean Google Compute Engine (GCE) Linode Rackspace

Re: WireGuard Bounce Server Setup

#34

Post by ncmncm » Wed, Dec 16, 2020, 11:16 PM UTC

lights0123 wrote: post #25

Doesn't Ubuntu 20.04 have a kernel with Wireguard built in? You shouldn't need to use DKMS.

Belt-and-suspenders... I assumed some readers might choose a different distro that needs a little more setup.

Re: WireGuard Bounce Server Setup

#35

Post by anderspitman » Wed, Dec 16, 2020, 11:20 PM UTC

If you're interested in tunneling in general (such as ngrok and other ways to get through to private networks), I've been maintaining a list here:

https://github.com/anderspitman/awesome-tunneling

Always on the lookup for tools I may have missed.

Re: WireGuard Bounce Server Setup

#36

Post by naggie » Wed, Dec 16, 2020, 11:20 PM UTC

Nice article. I had been maintaining a few servers doing a similar thing, but found the peer management, address allocation and key creation to be a bit tedious after some time so I created a command, https://github.com/naggie/dsnet/ -- adds peers in one command with IPv6 and PSK support.

Re: WireGuard Bounce Server Setup

#37

Post by aftbit » Wed, Dec 16, 2020, 11:24 PM UTC

mbreese wrote: post #32

aftbit wrote: post #19

Earlier quoted context omitted.

This[1] is the best post I've seen on that _outside_ of the Tailscale writeup linked below. The clever bit is that the introduction server uses wireguard tunnels to find your endpoint information, then shares it out via DNS. Of course it still requires you to be able to run custom code on all of the endpoints, which requires supporting many different platforms. I'm still looking for a FLOSS mesh network built on top…

I can't see how the post you linked actually does the NAT traversal... Alice finds Bob's external IP:port using the registry. That makes sense. But doesn't Bob need to send a packet to Alice to setup the NAT traversal on his side? More accurately, Alice uses the SRV field to populate the wg peer information on her side -- but how does Bob know that he needs to update the peer information on his side? I think this is…

I also haven't fully groked this to be fair, but my understanding is:

(1) Alice and Bob both connect to coordination server

(2) Alice sets Bob's endpoint to bob_ip:bob_port

(3) Bob sets Alice's endpoint to alice_ip:alice_port

(4) Both try to ping each other, which makes both of them originate outbound packets from the wireguard socket.

IF Alice and Bob have the same public IP:port pair in their NAT with each other as they do with the coordination server (which turns out to be true in tests on my EdgeRouter X NAT, but certainly isn't true 100% of the time), then I believe this process will result in a working connection.

If you're asking how Bob & Alice know that the information in the coordination server has changed and that they need to reconfig their endpoints, then I'm not sure. Perhaps they could just re-query the coordination server on a timeout or whenever their connection went down.

I agree - using DNS as a transport seems orthogonal to the NAT punching process, and maybe too clever. If you're going to need to write custom endpoint code either way, I don't see a huge advantage. If wireguard supported DNS-based endpoint information by default (automatically re-resolving IP and detecting port from SRV), then it'd make a lot more sense.

Re: WireGuard Bounce Server Setup

#38

Post by aftbit » Wed, Dec 16, 2020, 11:27 PM UTC

lights0123 wrote: post #28

I'm looking at doing something similar: does the server actually need an IP address assigned to its wg0 interface, or can it work without one? I only need peer-to-peer.

Yes, because of Cryptokey routing[1]. Wireguard works at the IP level and determines which keys to use for encryption and authentication based on the destination IP. That said, if you only need peer-to-peer, you could pick any two RFC-1918 addresses like 10.0.0.1 and 10.0.0.2.

1. https://www.wireguard.com/#cryptokey-routing

Re: WireGuard Bounce Server Setup

#39

Post by stock_toaster » Wed, Dec 16, 2020, 11:40 PM UTC

A self hosted "TURN like" server seems like it would be simpler and more secure -- yet achieve similar goals, and yet still more robust vs funky NAT layers than a dynamic dns solution alone would provide.

Re: WireGuard Bounce Server Setup

#40

Post by d33lio » Wed, Dec 16, 2020, 11:43 PM UTC

_hyn3 wrote: post #22

https://zerotier.com does a very nice job of NAT "bouncing", free (hosted) for up to 50 hosts, or you can run your own. You end up with another "zt" interface, so you can apply firewall rules to that interface, separate from your main NIC(s), kinda like assigning your own VPC but for your laptop, etc. It only takes a few seconds to install the agent and join your private network, and it seems to reconnect quite nicel…

This is also my go-to. It's dead simple and just works. Tbh, the last thing I want to spend my time doing is tinkering with my personal "network architecture". I'm sure I'd manage to fuck it up at some point when I just want to reach my plex server and watch a movie.