Re: wireguard and shorewall

On 04/12/2020 21:19, Erich Titl wrote:
> Hi John
> 
> Am 04.12.2020 um 19:17 schrieb John Sager:
>> Let's call the two ends A & B. Each has an 'outside tunnel' address via 
>> which they communicate with each other. These should be the 'Endpoint' for 
>> the far end in the respective conf files, together with the port that 
>> Wireguard listens on at the far end.
> 
> What are the respective parameters for these end points
> 
> I have on the central site, my internal network us on my own public (but 
> unrouted) class C network 194.124.158.0/24
> 
> [Interface]
> Address = 192.168.17.1/24
> PrivateKey = _my_private_key_
> #ListenPort = 11194
> #
> #
> # Peer1
> [Peer]
> PublicKey = _the_other_public_key_
> AllowedIPs = 192.168.17.2/32
> 
> Where does one define which ip the outside packet takes

That is 'Endpoint = <B's address:port>' defined under [Peer]

Obviously you must already have a route defined to B as wg-quick won't set 
that up - it only sets up routes in AllowedIPs.

ListenPort should be uncommented too, defined under [Interface]

This is where your Wireguard kernel module listens.

> 
> gatekeeper# /etc/init.d/wireguard start
> Starting wireguard VPN server on interface wg0
> [#] ip link add wg0 type wireguard
> [#] wg setconf wg0 /dev/fd/63
> [#] ip -4 address add 192.168.17.1/24 dev wg0
> [#] ip link set mtu 1420 up dev wg0
> 
> 1372: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state 
> UNKNOWN group default qlen 1000
>      link/none
>      inet 192.168.17.1/24 scope global wg0
>         valid_lft forever preferred_lft forever
> 
> the route is
> 
> 192.168.17.0/24 dev wg0 proto kernel scope link src 192.168.17.1
> 
> 
>>
>> So, e.g. A's Endpoint should have B's outside tunnel address & wireguard 
>> port, and vice versa. 'ListenPort' on each should have the UDP port it 
>> listens on. I'm assuming you are OK with the public & private key settings.
> 
> Yes so in my example above I would use an additional interface address on 
> the _real_ network for the wg0 interface and not the internal tunnel address?

The Wireguard kernel uses whichever interface has a route to B, plus the 
port in ListenPort

> 
>>
>> The 'Address' setting at each end is its local address inside the tunnel 
>> together with the CIDR for that network appended.
> 
> Yes, but wireguard start assigns the Address parameter of the interface 
> block to the wg0 adapter.

Yes. That is the 'inside tunnel' address on A. That is one end of the 
point-to-point link to B that the Wireguard tunnel implements.

> 
>>
>> AllowedIPs on each should list all the networks at the *other* end that 
>> this end should have access to.
>>
>> So, for firewalling, the outside tunnel interface rules should allow 
>> connections to the other end's outside tunnel address/port. The wg0 
>> interface rules should allow connectivity to the networks in AllowedIPs.
>>
> 
> Well we need to integrate this into shorewall also

You may want to implement whole address ranges in AllowedIPs but use the 
firewall rules to restrict address/port access within that, so if you did 
try to generate Shorewall rules automatically they would need to be able to 
be pre-empted by more specific rules.

> 
> Thanks
> 
> ET
> 
> 
> ------------------------------------------------------------------------
> leaf-user mailing list: [email protected]
> https://lists.sourceforge.net/lists/listinfo/leaf-user
> Support Request -- http://leaf-project.org/
> 


------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/