Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard: Beyond the most basic configuration

sloonz.github.io

Post reply on HN
Print view View original

91–100 of 115 posts

Re: WireGuard: Beyond the most basic configuration

#91

Post by inapis »

zaptheimpaler wrote: post #86

Im trying to set up a personal server with services that may be accessible from the web with a real domain name or only via Tailscale. I got the web part working with Caddy and mapping subdomains to services, but the problem is Tailscale Magic DNS doesn't support subdomains. I could try to host services on paths like "blah.blah.ts.net/svc1" and strip the paths in Caddy but that causes all sorts of problems that you h…

If you don't have a lot of services to access, you can hard code the tailscale IP address in /etc/hosts.

My personal /etc/hosts is at 10 services all hard coded since the internal IP address of a machine on tailscale is static. Way cheaper and easier to deal with than setting up a separate DNS resolver.

Of course that won't work if you have hundreds or thousands of services to work with.

Re: WireGuard: Beyond the most basic configuration

#93

Post by aborsy »

zaptheimpaler wrote: post #86

Im trying to set up a personal server with services that may be accessible from the web with a real domain name or only via Tailscale. I got the web part working with Caddy and mapping subdomains to services, but the problem is Tailscale Magic DNS doesn't support subdomains. I could try to host services on paths like "blah.blah.ts.net/svc1" and strip the paths in Caddy but that causes all sorts of problems that you h…

If you have a domain, you simply a dns record for the Tailscale IP.

You can also run your own dns server, like a pihole or AdGuard, on your Tailscale network. There you define any dns record.

Re: WireGuard: Beyond the most basic configuration

#94

Post by yosamino »

t0mas88 wrote: post #15

I'm using wireguard with ipv6, the only thing that I never got to work is for wireguard to do ipv6 prefix delegation allowing devices to pick (and change) their own address like they do on a normal ethernet subnet. I like the randomisation that normally happens to make it invisible which phone/device in the subnet made each request.

There's a chicken-egg-like problem involved with that based on the cryptokey routing that wireguard does.

The, a bit unfortunately named, 'allowed-ips' parameter determines to which peer wg routes a packet.

If you imagine three peers connected to your one central vpn server then for this to work you have to have an allowed-ips parameter set to the same /64 network for each of them from the point of view of the server, which creates a conflict.

There is a project to configure allowed-ips dynamically but it's not active any more unfortunately https://github.com/WireGuard/wg-dynamic/blob/master/docs/ide...

Re: WireGuard: Beyond the most basic configuration

#95

Post by yosamino »

jeroenhd wrote: post #24
t0mas88 wrote: post #15

I'm using wireguard with ipv6, the only thing that I never got to work is for wireguard to do ipv6 prefix delegation allowing devices to pick (and change) their own address like they do on a normal ethernet subnet. I like the randomisation that normally happens to make it invisible which phone/device in the subnet made each request.

I don't know about PD, but I found that native clients will accept RAs over WireGuard just fine. I only have a /64 at the moment unfortunately, so I can't really use this mechanism at the moment, but I did set up a ULA by giving radvd the following config: interface wg-server { AdvDefaultLifetime 0; AdvSendAdvert on; prefix fdf4:a694:0e43:c0de::/64 { AdvOnLink on; AdvAutonomous on; }; }; I use the equivalent of fdf4:…

Does this work for you with more than one client connected ? How did you configure the routing table ?

Re: WireGuard: Beyond the most basic configuration

#97

Post by teruakohatu »

rmrf100 wrote: post #96

> The first thing to notice is that my hosting provider has assigned to me a whole /48 network for my account (2001:aaaa:bbbb::/48) How to know this?

Enable IPv6 on your router. It should show you what prefix your ISP assigned you such as /56 or /48 assuming your ISP can do ipv6.

Re: WireGuard: Beyond the most basic configuration

#98

Post by AnonC »

criddell wrote: post #18
ww520 wrote: post #14

Earlier quoted context omitted.

I’m using an internal machine for the VPN server and port forwarded to it from the router. I also have Tailscale set up but if I remember correctly Tailscale requires all devices participating in its VPN to install its software, which is too much.

Is that true? I’m not 100% sure, but I think I’ve printed while I was away from home and I only have Tailscale software installed on my AppleTV.

I'm intrigued. Could you please elaborate on your setup, what Apple TV provides in this mix and how it is used? Is the Apple TV always powered on (24x7)?
Post reply on HN