Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard: Beyond the most basic configuration

sloonz.github.io

Post reply on HN
Print view View original

111–115 of 115 posts

Re: WireGuard: Beyond the most basic configuration

#111

Post by rudasn »

feurio wrote: post #104
rudasn wrote: post #25

Earlier quoted context omitted.

Yeah, that's the biggest pain point I think. Syncing configs once changes are made (new peers, new access rules, pre shared key rotation etc). It's one of the reasons I'm working on wirehub[0], as a way to distribute configs to both end users (share a link) and machines (have a script to periodically pull from wirehub). Not the perfect solution, but one that does not require additional clients/agents/software to be i…

I've built a proof-of-concept WireGuard VPN for work (SSO with mTLD portal/OIDC, BGP/WG tunnels to link edge servers into the network) and the team love it - better than the Cisco VPN they'd have to use otherwise. Only problem is the config - I'd love a simple alternate WG app (for macOS/Windows) that could pull a config from a remote endpoint (checking signing) and bring up a WG tunnel with the config presented. I'v…

There are quite a few open source wg clients out there, maybe you can get some ideas from those. Defguard, netbird come to mind.

I just want to avoid all that custom client stuff.

I don't have a solution, but I was experimenting on having a unique network url that would show different content depending if you're hitting it via the wireguard connection or not. Pretty basic stuff, just firewall rules and nginx proxying. Add the (hub) endpoint to client's AllowedIPs and route traffic on the hub depending on the networ interface and port the traffic is coming from.

So the client would connect to the wg network and open up the network page (eg. home.rudasn.wirehub.org).

If the connection is established, they would see a welcome message or whatever (if they need to update their config maybe a link to get their new one).

If the connection is not via the wg tunnel, they would see a message to first connect to the wireguard vpn. And if it's their first time, directions on how to install the official client and get their config from their admin (via wirehub.org or whatnot).

It's nice to have that automated via a custom client, but I don't think it's such a huge issue - if you would only update configs for client devices sporadically and have the server peers polling for updates every x seconds.

The downside of custom client apps is another security layer to consider, which nobody has the time for.

Re: WireGuard: Beyond the most basic configuration

#112

Post by pulse7 »

irunmyownemail wrote: post #75
logicziller wrote: post #63

One that I could not get to work properly with Wireguard is port-forwarding without masquerading. I need the source IP to remain intact, but unless I add 0.0.0.0/0 to the AllowedIPs, the Wireguard peer will drop the packet. If I do add 0.0.0.0/0 to AllowedIPs then it adds a route which prevents the response from my application to go back to the source. Eventually gave up on it. Nobody had a clue how to fix this or wh…

When a public Internet client connects to my VPS, WG routes the port traffic like 443 to the WG client here at home, then through Apache reverse proxy then to a node in my kube cluster running a spring boot app which is my main site. The logs shows the IP of the incoming public Internet client. The response is routed all the way back out to the Internet client. Is what I'm describing not achieving what you're discuss…

Please post your configuration... Thank you!

Re: WireGuard: Beyond the most basic configuration

#113

Post by epiecs »

speakspokespok wrote: post #57
denkmoon wrote: post #39

Earlier quoted context omitted.

I've been very pleased with powerdns for my self hosted internal DNS services. It implements basically everything you want for even the most esoteric DNS setups, and IMO, quite sanely.

I've tried many times to setup PowerDNS and never complete it because I get bogged down in the complexity. I saw they had an ansible / terraform script for deployments. Do you just use the team's docs or something else?

You can also just setup a pihole adblocker on a vm. It has a local dns feature as well (that is nothing more that a textfile containing all your local records). Super easy to setup and maintain :)

Re: WireGuard: Beyond the most basic configuration

#114

Post by OptionOfT »

Since the post mentions IPv6, I thought I'd put out a BIG footgun that the WireGuard app to this date hasn't solved.

Imagine a situation with 464XLAT, e.g. on T-Mobile in the USA. You only have an IPv6 address. When you want to communicate to a server that only has an IPv4 endpoint you go over a proxy owned by T-Mobile. The traffic leaving your device is always IPv6, unlike say CGNAT, where there is IPv4 traffic between your device and the NAT gateway.

Problem with the default WireGuard app on iOS is that when it is set up to connect to a DNS name which offers both A and AAAA they default to the A one, which means on T-Mobile the connection goes over this proxy and constantly breaks, as the proxy connection times out after a while. So things like Push notifications stop working.

The fix is to create a separate config with the IPv6 address and connect to that one. No more middle-man, and push notifications keep on working, even when you disable KeepAlive.

Re: WireGuard: Beyond the most basic configuration

#115

Post by ggpsv »

zaptheimpaler wrote: post #86

Im trying to set up a personal server with services that may be accessible from the web with a real domain name or only via Tailscale. I got the web part working with Caddy and mapping subdomains to services, but the problem is Tailscale Magic DNS doesn't support subdomains. I could try to host services on paths like "blah.blah.ts.net/svc1" and strip the paths in Caddy but that causes all sorts of problems that you h…

That is what I ended up doing, I wrote a blog post about it some months ago [0].

The gist of it is using private dns and exposing services only on the private network. Implementation details can vary, you decide whether to use tailscale or bare wireguard, and any reverse proxy and dns server will do. In my case, I use Tailscale, NextDNS, and Caddy.

[0]: https://garrido.io/notes/tailscale-nextdns-custom-domains/

Post reply on HN