Differences

This shows you the differences between two versions of the page.

--- wireguard [2025/12/10 03:21]
dmick
+++ wireguard [2026/08/13 22:13] (current)
dmick [Windows] fix up/down scripts to take interface name as argument
@@ Line 4: / Line 4: @@
 ===== How To =====
+==== Summary ====
+  * Install Wireguard
+  * Generate a public/private keypair
+  * Provide the public key in a ticket
+  * The Labs team will DM or e-mail your Wireguard IP to you
+  * Connect
+==== Mac/Linux ==
 . For Mac, Install Wireguard from the App Store\\
@@ Line 26: / Line 35: @@
 . Generate a keypair
 <code>
 wg genkey | tee ~/.wireguard/private.key | wg pubkey > ~/.wireguard/public.key
@@ Line 32: / Line 42: @@
 **Keep the Private Key secret!!**
-. Send the public.key contents to David or Dan.  They will update the Wireguard server and give you your VPN IP address.
+. Provide the Wireguard public key (''~/.wireguard/public.key'' contents) [[http://tracker.ceph.com/projects/lab/issues/new?issue[tracker_id]=3|in a tracker ticket]].  We will DM your Wireguard IP to you.
+=== DO NOT ping any Lab Admins directly.  We have a rotation we follow for processing tickets. ===
-. Create ''~/.wireguard/client.conf''\\
+. Create ''~/.wireguard/client.conf''  (note that the $PRIVATE_KEY must expand to
+the actual text of your private key)\\
 <code>
 PRIVATE_KEY=$(cat ~/.wireguard/private.key)
@@ Line 47: / Line 61: @@
 [Peer]
 PublicKey = kyEHy3ZBewI5RiK4/a0/UQn6O1kMt3h8V3u0OwsfUXc=
-AllowedIPs = 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25
+AllowedIPs = 172.21.0.0/20, 172.21.32.0/20, 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25, 172.21.64.0/24, 172.21.65.0/24, 172.21.66.0/24, 172.21.67.0/24
 Endpoint = 192.86.31.5:1194
 PersistentKeepalive = 25
@@ Line 57: / Line 71: @@
 . Bring up the interface
-**On Mac OS**, open the Wireguard GUI.  Press Command+O and open ''~/.wireguard/client.conf''
+**On Mac OS**, open the Wireguard GUI.  Press Command+O and open ''~/.wireguard/client.conf''.  Click **Activate**
+Success looks like\\
+{{::screenshot_2025-12-03_at_9.08.01_am.png?400|}}
 **On Ubuntu**,\\
@@ Line 67: / Line 85: @@
 </code>
-. Click **Activate**
+use wg show to show status.
+==== Windows ====
+.  Install Windows client from https://www.wireguard.com/install/
+. In the wireguard app, select "Add tunnel/Add empty tunnel".  A public and private key will be automatically generated for you.  Note them.  KEEP THE PRIVATE KEY SECRET.
+. send in your public key to David/Dan
+. get an IP address in return
+. add the configuration to the wireguard app.  The first two lines
+([Interface] and PrivateKey = <your private key>) will already be present.
+Be very careful to not change anything besides your Address.  In
+particular, do not edit [Peer] PublicKey; that is the server's public key
+and does not change.
+<code>
+[Interface]
+PrivateKey = <your private key>
+Address = <address from communication with David/Dan>/32
+DNS = 10.20.192.11, front.sepia.ceph.com, ipmi.sepia.ceph.com
+MTU = 1200
+[Peer]
+PublicKey = kyEHy3ZBewI5RiK4/a0/UQn6O1kMt3h8V3u0OwsfUXc=
+AllowedIPs = 172.21.0.0/20, 172.21.32.0/20, 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25, 172.21.64.0/24, 172.21.65.0/24, 172.21.66.0/24, 172.21.67.0/24
+Endpoint = 192.86.31.5:1194
+PersistentKeepalive = 25
+</code>
+. Save the configuration, which should activate the wg0 tunnel.  If all goes well, you will see "Latest Handshake" in the Peer section be a few seconds out of date
+. despite DNS = , the current wireguard client does not properly handle split-horizon DNS.  You must add Powershell scripts to the configuration, and enable their execution with a Windows Registry setting.
+Add the following after MTU = in the [Interface] section:
+<code>
+PostUp = powershell -ExecutionPolicy Bypass -File "C:\Wireguard\wg-up.ps1" -InterfaceAlias wg0
+PostDown = powershell -ExecutionPolicy Bypass -File "C:\Wireguard\wg-down.ps1" -InterfaceAlias wg0
+</code>
+and add the scripts to C:\Wireguard:
+<code>
+# wg-up.ps1
+param(
+    [string]$InterfaceAlias = "wg0",
+    [string[]]$Domains = @("front.sepia.ceph.com"),
+    [string]$DNSServer = "10.20.192.11"
+)
+# Ensure admin
+if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
+    Write-Error "This script must be run as Administrator."
+    exit 1
+}
+# Verify the requested interface exists and is up
+$Interface = Get-NetAdapter -Name $InterfaceAlias -ErrorAction Stop
+if ($Interface.Status -ne "Up") {
+    Write-Error "WireGuard interface /$InterfaceAlias' is not up."
+    exit 1
+}
+Write-Output "Using WireGuard interface: $InterfaceAlias"
+# Add NRPT rules (idempotent)
+foreach ($domain in $Domains) {
+    if (-not (Get-DnsClientNrptRule | Where-Object { $_.Namespace -eq $domain })) {
+        Write-Output "Adding NRPT rule for $domain -> $DNSServer"
+        Add-DnsClientNrptRule -Namespace $domain -NameServers $DNSServer
+    }
+}
+# Set connection-specific DNS suffix (short names)
+Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix $Domains[0]
+Write-Output "Set connection-specific suffix: $($Domains[0])"
+</code>
+<code>
+# wg-down.ps1
+param(
+    [string]$InterfaceAlias = "wg0",
+    [string[]]$Domains = @("sepia.ceph.com")
+)
+# Ensure admin
+if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
+    Write-Error "This script must be run as Administrator."
+    exit 1
+}
+Write-Output "Using WireGuard interface: $InterfaceAlias"
+# Remove NRPT rules safely
+foreach ($domain in $Domains) {
+    Get-DnsClientNrptRule |
+        Where-Object { $_.Namespace -eq $domain } |
+        Remove-DnsClientNrptRule -Force -ErrorAction SilentlyContinue
+    Write-Output "Removed NRPT rule for $domain"
+}
+# Clear connection-specific suffix
+Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix ''
+Write-Output "Cleared connection-specific suffix"
+</code>
+Add to the registry:
+<code>
+HKEY_LOCAL_MACHINE\Software\WireGuard\DangerousScriptExecution
+</code>
+set it to 1.  You can do this with a Command prompt running as administrator:
+<code>
+reg add HKLM\Software\WireGuard /v DangerousScriptExecution /t REG_DWORD /d 1 /f
+</code>
-Success looks like\\
-{{::screenshot_2025-12-03_at_9.08.01_am.png?400|}}
-. More about DNS Configuration on Linux
+===== More about DNS Configuration on Linux =====
 If you're using systemd-resolved, stop.  It is incapable of handling split DNS.  I would not use resolvconf.
@@ Line 119: / Line 253: @@
 Now lookups of shortname or shortname.front or shortname.ipmi should work.  Note that dig does not respect the search domains in /etc/resolv.conf by default; you must use dig +search <domain>

Sepia Lab Wiki

User Tools

Site Tools

Differences

Page Tools