Re: wireguard and shorewall

Hi John

Am 04.12.2020 um 19:17 schrieb John Sager:
> Let's call the two ends A & B. Each has an 'outside tunnel' address via 
> which they communicate with each other. These should be the 'Endpoint' 
> for the far end in the respective conf files, together with the port 
> that Wireguard listens on at the far end.

What are the respective parameters for these end points

I have on the central site, my internal network us on my own public (but 
unrouted) class C network 194.124.158.0/24

[Interface]
Address = 192.168.17.1/24
PrivateKey = _my_private_key_
#ListenPort = 11194
#
#
# Peer1
[Peer]
PublicKey = _the_other_public_key_
AllowedIPs = 192.168.17.2/32

Where does one define which ip the outside packet takes

gatekeeper# /etc/init.d/wireguard start
Starting wireguard VPN server on interface wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 192.168.17.1/24 dev wg0
[#] ip link set mtu 1420 up dev wg0

1372: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state 
UNKNOWN group default qlen 1000
     link/none
     inet 192.168.17.1/24 scope global wg0
        valid_lft forever preferred_lft forever

the route is

192.168.17.0/24 dev wg0 proto kernel scope link src 192.168.17.1


> 
> So, e.g. A's Endpoint should have B's outside tunnel address & wireguard 
> port, and vice versa. 'ListenPort' on each should have the UDP port it 
> listens on. I'm assuming you are OK with the public & private key settings.

Yes so in my example above I would use an additional interface address 
on the _real_ network for the wg0 interface and not the internal tunnel 
address?

> 
> The 'Address' setting at each end is its local address inside the tunnel 
> together with the CIDR for that network appended.

Yes, but wireguard start assigns the Address parameter of the interface 
block to the wg0 adapter.

> 
> AllowedIPs on each should list all the networks at the *other* end that 
> this end should have access to.
> 
> So, for firewalling, the outside tunnel interface rules should allow 
> connections to the other end's outside tunnel address/port. The wg0 
> interface rules should allow connectivity to the networks in AllowedIPs.
> 

Well we need to integrate this into shorewall also

Thanks

ET


------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/