For people at the scale of running one wireguard server on one linux box, I suggest this script which sets everything up and creates vpn user accounts
Identity management for WireGuard
51–60 of 107 posts
Re: Identity management for WireGuard
#52I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up do…
FYI macOS (/etc/resolver/*) and windows (Set-DnsClientNrtpPolicy) resolvers support split dns out of the box. Suggestion for mobile is less ideal, but just tunnel to a DNS server that takes care of split resolution and use that server when wg interface is up.
Wireguard itself will always consider authentication, dns, routing, etc. out of scope which IMO is really for the best
Re: Identity management for WireGuard
#53For people at the scale of running one wireguard server on one linux box, I suggest this script which sets everything up and creates vpn user accounts https://github.com/angristan/wireguard-install
What's up with the uneven indentation in the script? Is that a bash thing or an oops thing?
Re: Identity management for WireGuard
#54I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up do…
You can use openresolv to configure a local DNS server to do split DNS, or let do systemd-resolved do it. Or did you mean Android/iOS with 'official client'?
In my case I mean the iOS official client.
Re: Identity management for WireGuard
#55For people at the scale of running one wireguard server on one linux box, I suggest this script which sets everything up and creates vpn user accounts https://github.com/angristan/wireguard-install
He also has an OpenVPN version. Both launches a VPN server with one click.
Needless to say, Wireguard is preferred over other VPNs. Far less code.
Re: Identity management for WireGuard
#56When Wireguard was 1st rolled out the smaller code base vs OpenVPN was touted as a feature. Now that 3rd party systems are available to bring feature parity with OpenVPN, it would be interesting to see a comparison of the size of the code base inclusive of these 3rd party systems. Not interesting enough for me to put forth the effort to do it but still interesting.
First, even with third-party code, WireGuard is going to be significantly smaller than OpenVPN (and significantly easier to audit).
But more importantly, you can't just count lines of code as if they're all equivalent. There's a trusted core of code that is more important than the rest of the code, and WireGuard's trusted code is microscopic compared to OpenVPN. That's the right word in this case: "microscopic". It's some of the easiest code in the whole kernel to read, even given the cryptography.
Re: Identity management for WireGuard
#57I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up do…
FYI macOS (/etc/resolver/*) and windows (Set-DnsClientNrtpPolicy) resolvers support split dns out of the box. Suggestion for mobile is less ideal, but just tunnel to a DNS server that takes care of split resolution and use that server when wg interface is up. Wireguard itself will always consider authentication, dns, routing, etc. out of scope which IMO is really for the best
My mental model of WireGuard is that it wants to replace IPSec (the encryption/tunneling), not IKE/IKEv2 (authentication, session setup, etc). It's not a perfect mental model, but it serves me well.
On the official client I can specify DNS servers for a particular connection, so one "easy" solution would be to specify domains that need to go to that set of DNS servers. e.g., when connected to home use 192.168.x.y to resolve *.blah, otherwise use the system resolvers.
Re: Identity management for WireGuard
#58I really want to like WireGuard, and these get so close to what I want. I think as soon as Headscale gets the iOS story sorted out I'll be able to switch away from IKEv2/IPSec. Right now the thing that's stopping me is the lack of Split-DNS. I'd even be happy if I could configure this in the official client, I've only got a handful of devices so distributing the configuration by hand is fine. My IKEv2/IPSec set up do…
This is feasible to config in WireGuard, but it’s somewhat up to the host to leverage it appropriately, and the config is certainly not clear about that fact. If you append the DNS config of a peer with the search domains you want sent over the private horizon (eg: 192.168.1.10, 192.168.1.11, internal.domain, other.domain) this is intended to configure conditional forwarding for those zones you specify. Again, it’s d…
That's the biggest challenge - it's not really a WireGuard problem, but "something" needs to be able to tell iOS "use server X for *.blah, otherwise use whatever servers you got from the WiFi connection".
Re: Identity management for WireGuard
#59Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to period…
These are all reasonable things to want and to track down, but it's worth noting that you in fact don't want WireGuard to support these things out of the box; the point of WireGuard is that it has exactly one job, and that job is integrated as deeply as possible with Linux networking. The things you're asking for are meant to be layered on top of WireGuard.
Re: Identity management for WireGuard
#60Earlier quoted context omitted.
Sounds like you are looking for a self hosted ZeroTier or Tailscale.
It does not appear that Tailscale is an identity provider but rather integrates into commercial ID providers? Do they integrate into OpenLDAP or into OAuth/SAML providers that are in front of OpenLDAP? [Edit] Answering my own question. Custom SAML providers are only supported with the Enterprise edition. [1] [1] - https://tailscale.com/kb/1119/sso-saml-oidc/
Take a look at Headscale if you want to self host. https://github.com/juanfont/headscale