Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Bounce Server Setup

gitlab.com

Post reply on HN
Print view View original

51–60 of 80 posts

Re: WireGuard Bounce Server Setup

#51

Post by jlgaddis »

evil-olive wrote: post #30
aftbit wrote: post #26

Earlier quoted context omitted.

Is zerotier FLOSS? I have been looking for something to fulfill this need, but especially after the Solarwinds hack, I am unwilling to run a closed-source agent on any of my hosts.

Looks like the Business Source License [0]. Which does not qualify under the Open Source Definition [1], but they claim it meets "most" of the OSI criteria. 0: https://github.com/zerotier/ZeroTierOne/blob/master/LICENSE.... 1: https://mariadb.com/bsl-faq-adopting/#osl

> ... but they claim it meets "most" of the OSI criteria.

As Frank Robinson [0] once said:

> "[...] Close only counts in horseshoes [1] and hand grenades."

--

[0]: https://en.wikipedia.org/wiki/Frank_Robinson

[1]: https://en.wikipedia.org/wiki/Horseshoes (for the uninitiated)

Re: WireGuard Bounce Server Setup

#52

Post by iampims »

anderspitman wrote: post #35

If you're interested in tunneling in general (such as ngrok and other ways to get through to private networks), I've been maintaining a list here: https://github.com/anderspitman/awesome-tunneling Always on the lookup for tools I may have missed.

https://github.com/cloudflare/cloudflared would be one I didn’t see on your list.

Re: WireGuard Bounce Server Setup

#53

Post by artificialLimbs »

jacob019 wrote: post #48

I use wireguard on a cheap VPS that comes with an IPV6 /64. Connecting devices get a public IPV6 address. Most of which are assigned a subdomain so I can remember them. It works wonderfully.

Do you have a writeup or know where one is that could be of use in setting this up? I don't know much about v6...

Re: WireGuard Bounce Server Setup

#54

Post by jlgaddis »

aftbit wrote: post #24

I've had basically this exact setup running on a cloud server for the past few months. It's pretty liberating to be able to open ports to 10.44.0.0/24 and have all of my different machines easily access them, regardless of what networks they're connected to. I've added in an instance of nsd that manages a zonefile so I can do: ssh laptop.wg.mydomain.net which resolves into 10.44.0.3 for example. There are two major d…

I'm not certain I grok all of that correctly, but the last bit sounds kinda like DMVPN [0].

--

[0]: https://en.wikipedia.org/wiki/Dynamic_Multipoint_Virtual_Pri...

Re: WireGuard Bounce Server Setup

#55

Post by jacob019 »

artificialLimbs wrote: post #53
jacob019 wrote: post #48

I use wireguard on a cheap VPS that comes with an IPV6 /64. Connecting devices get a public IPV6 address. Most of which are assigned a subdomain so I can remember them. It works wonderfully.

Do you have a writeup or know where one is that could be of use in setting this up? I don't know much about v6...

No, I just cobbled it together with standard Linux routing tools.

  echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
The trickiest part is making sure that the VPS answers NDP requests for the routed addresses:

  echo 1 > /proc/sys/net/ipv6/conf/all/proxy_ndp
  for i in `seq 0x0010 0x001f`; do
   ip=2001:1111:2222:3333::$(printf '%x' $i)
   ip neigh add proxy $ip dev ens3
  done
Assign the routed address range to the wireguard interface:

  ip addr add 2001:1111:2222:3333::10/124 dev wg0
That's the gist of it. I might do a proper writeup next week if I can find time.

Re: WireGuard Bounce Server Setup

#56

Post by ncmncm »

jlgaddis wrote: post #49

> NOTE: Systemd has a nasty habit of delaying logins for 25 - 100 seconds while it waits for some service you never asked for to time out and fail, before it lets you have a prompt. If you experience this when logging in to a host via SSH, the delays are almost certainly due to either missing or non-functional forward/reverse DNS (the SSH server will perform these lookups when connections are received). You've got at…

Thank you. I haven't seen any apparent DNS problems; I fixed it, on a Debian host, by deleting the gnupg packages; probably deleting just gpgconf would have sufficed. That said, the IP addresses I used really would not show up in a DNS lookup. If I see it again, I will look for DNS lookup attempts.

  Dec 15 22:23:14 ip-99-99-99-100 sshd[1995]: pam_unix(sshd:session): session opened for user admin by (uid=0)
  Dec 15 22:23:14 ip-99-99-99-100 systemd[1]: Created slice User Slice of UID 1000.
  Dec 15 22:23:14 ip-99-99-99-100 systemd[1]: Starting User Runtime Directory /run/user/1000...
  Dec 15 22:23:14 ip-99-99-99-100 systemd-logind[510]: New session 34 of user admin.
  Dec 15 22:23:14 ip-99-99-99-100 systemd[1]: Finished User Runtime Directory /run/user/1000.
  Dec 15 22:23:14 ip-99-99-99-100 systemd[1]: Starting User Manager for UID 1000...
  Dec 15 22:23:14 ip-99-99-99-100 systemd[2001]: pam_unix(systemd-user:session): session opened for user admin by (uid=0)
  Dec 15 22:24:44 ip-99-99-99-100 systemd[2003]: pam_unix(systemd-user:session): session closed for user admin
  Dec 15 22:24:44 ip-99-99-99-100 systemd[1]: user@1000.service: Main process exited, code=exited, status=1/FAILURE
  Dec 15 22:24:44 ip-99-99-99-100 systemd[1]: user@1000.service: Killing process 2007 (gpgconf) with signal SIGKILL.
  Dec 15 22:24:44 ip-99-99-99-100 systemd[1]: user@1000.service: Killing process 2008 (awk) with signal SIGKILL.
  Dec 15 22:24:44 ip-99-99-99-100 systemd[1]: user@1000.service: Killing process 2013 (dirmngr) with signal SIGKILL.
  Dec 15 22:24:44 ip-99-99-99-100 systemd[1]: user@1000.service: Failed with result 'exit-code'.
  Dec 15 22:24:44 ip-99-99-99-100 systemd[1]: Failed to start User Manager for UID 1000.
  Dec 15 22:24:44 ip-99-99-99-100 systemd[1]: Started Session 34 of user admin.
But what are these evidently unnecessary session and User Manager things? What controls starting them? What are they supposed to do for me, if they ever work right? Why did starting them fail?

Re: WireGuard Bounce Server Setup

#57

Post by ncmncm »

jacob019 wrote: post #55
artificialLimbs wrote: post #53

Earlier quoted context omitted.

Do you have a writeup or know where one is that could be of use in setting this up? I don't know much about v6...

No, I just cobbled it together with standard Linux routing tools. echo 1 > /proc/sys/net/ipv6/conf/all/forwarding The trickiest part is making sure that the VPS answers NDP requests for the routed addresses: echo 1 > /proc/sys/net/ipv6/conf/all/proxy_ndp for i in `seq 0x0010 0x001f`; do ip=2001:1111:2222:3333::$(printf '%x' $i) ip neigh add proxy $ip dev ens3 done Assign the routed address range to the wireguard inte…

If you do, please link it here.

Re: WireGuard Bounce Server Setup

#58

Post by tptacek »

IncludeSecurity wrote: post #33

This is a great FOSS tool if you don't want to deal with all of the low level stuff. https://github.com/StreisandEffect/streisand We did an audit of it and they fixed lots of configuration problems, it's now pretty solid security defaults wise. And the WG integration works well. They support the following setups: OpenSSH Tinyproxy OpenConnect / Cisco AnyConnect Stunnel Shadowsocks Obfsproxy WireGuard, Running on: Ama…

The generally-better-regarded implementation of this idea is Algo:

https://github.com/trailofbits/algo

Re: WireGuard Bounce Server Setup

#59

Post by _hyn3 »

aftbit wrote: post #26
_hyn3 wrote: post #22

https://zerotier.com does a very nice job of NAT "bouncing", free (hosted) for up to 50 hosts, or you can run your own. You end up with another "zt" interface, so you can apply firewall rules to that interface, separate from your main NIC(s), kinda like assigning your own VPC but for your laptop, etc. It only takes a few seconds to install the agent and join your private network, and it seems to reconnect quite nicel…

Is zerotier FLOSS? I have been looking for something to fulfill this need, but especially after the Solarwinds hack, I am unwilling to run a closed-source agent on any of my hosts.

https://github.com/zerotier/ZeroTierOne
Post reply on HN