wireguard
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| wireguard [2025/12/17 18:25] – [Mac/Linux] dmick | wireguard [2026/08/24 15:23] (current) – djgalloway | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Wireguard Access ====== | ====== Wireguard Access ====== | ||
| ===== Summary ===== | ===== Summary ===== | ||
| - | For now, this is a manual process to access the " | + | We use Wireguard for VPN access |
| ===== How To ===== | ===== How To ===== | ||
| - | Overall flow: | + | ==== Summary ==== |
| - | * install | + | |
| - | * generate | + | * Install |
| - | * send in the public key to David/Dan to get a server entry | + | * Generate |
| - | * get an IP address to use in return | + | * Provide |
| - | * use the private key, the IP address, and these instructions to configure your | + | * Once your access is approved, you'll be e-mailed your Wireguard |
| - | client | + | * Connect |
| ==== Mac/Linux == | ==== Mac/Linux == | ||
| Line 43: | Line 43: | ||
| **Keep the Private Key secret!!** | **Keep the Private Key secret!!** | ||
| - | 5. Send the Wireguard public key ('' | + | 5. Provide |
| + | |||
| + | === DO NOT ping any Lab Admins directly === | ||
| 6. Create '' | 6. Create '' | ||
| Line 54: | Line 56: | ||
| PrivateKey = $PRIVATE_KEY | PrivateKey = $PRIVATE_KEY | ||
| Address = X.X.X.X/32 | Address = X.X.X.X/32 | ||
| - | DNS = 10.20.192.11, front.sepia.ceph.com, | + | DNS = 10.20.192.13, front.sepia.ceph.com, |
| MTU = 1200 | MTU = 1200 | ||
| [Peer] | [Peer] | ||
| PublicKey = kyEHy3ZBewI5RiK4/ | PublicKey = kyEHy3ZBewI5RiK4/ | ||
| - | AllowedIPs = 172.16.48.0/ | + | AllowedIPs = 172.21.0.0/ |
| Endpoint = 192.86.31.5: | Endpoint = 192.86.31.5: | ||
| PersistentKeepalive = 25 | PersistentKeepalive = 25 | ||
| Line 65: | Line 67: | ||
| </ | </ | ||
| - | 6. Once Dan or David give you your private IP, replace '' | + | 6. Once you receive |
| 7. Bring up the interface | 7. Bring up the interface | ||
| Line 83: | Line 85: | ||
| </ | </ | ||
| - | use wg show to show status. | + | Use '' |
| ==== Windows ==== | ==== Windows ==== | ||
| - | 1. Install Windows client from https:// | + | 1. Install Windows client from https:// |
| - | 2. In the wireguard | + | 2. In the Wireguard |
| - | 3. send in your public key to David/Dan | + | 3. Submit |
| - | 4. get an IP address in return | + | 4. Wait to receive your Wireguard |
| - | 5. add the configuration to the wireguard app. The first two lines | + | 5. Add the configuration to the wireguard app. The first two lines |
| ([Interface] and PrivateKey = <your private key>) will already be present. | ([Interface] and PrivateKey = <your private key>) will already be present. | ||
| Be very careful to not change anything besides your Address. | Be very careful to not change anything besides your Address. | ||
| Line 103: | Line 106: | ||
| PrivateKey = <your private key> | PrivateKey = <your private key> | ||
| Address = <address from communication with David/ | Address = <address from communication with David/ | ||
| - | DNS = 10.20.192.11, front.sepia.ceph.com, | + | DNS = 10.20.192.13, front.sepia.ceph.com, |
| MTU = 1200 | MTU = 1200 | ||
| [Peer] | [Peer] | ||
| PublicKey = kyEHy3ZBewI5RiK4/ | PublicKey = kyEHy3ZBewI5RiK4/ | ||
| - | AllowedIPs = 172.16.48.0/ | + | AllowedIPs = 172.21.0.0/ |
| Endpoint = 192.86.31.5: | Endpoint = 192.86.31.5: | ||
| PersistentKeepalive = 25 | PersistentKeepalive = 25 | ||
| Line 120: | Line 123: | ||
| < | < | ||
| - | PostUp = powershell -ExecutionPolicy Bypass -File " | + | PostUp = powershell -ExecutionPolicy Bypass -File " |
| - | PostDown = powershell -ExecutionPolicy Bypass -File " | + | PostDown = powershell -ExecutionPolicy Bypass -File " |
| </ | </ | ||
| Line 128: | Line 131: | ||
| # wg-up.ps1 | # wg-up.ps1 | ||
| param( | param( | ||
| - | [string[]]$Domains = @(" | + | |
| + | | ||
| [string]$DNSServer = " | [string]$DNSServer = " | ||
| ) | ) | ||
| Line 138: | Line 142: | ||
| } | } | ||
| - | # Auto-detect WireGuard | + | # Verify the requested |
| - | $Interface = Get-NetAdapter | + | $Interface = Get-NetAdapter -Name $InterfaceAlias |
| - | if (-not $Interface) { | + | if ($Interface.Status -ne " |
| - | Write-Error "No active | + | Write-Error " |
| exit 1 | exit 1 | ||
| } | } | ||
| - | $InterfaceAlias = $Interface.Name | ||
| Write-Output "Using WireGuard interface: $InterfaceAlias" | Write-Output "Using WireGuard interface: $InterfaceAlias" | ||
| Line 159: | Line 162: | ||
| # Set connection-specific DNS suffix (short names) | # Set connection-specific DNS suffix (short names) | ||
| Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix $Domains[0] | Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix $Domains[0] | ||
| - | Write-Output "Set connection-specific suffix: $($Domains[0]) | + | Write-Output "Set connection-specific suffix: $($Domains[0])" |
| </ | </ | ||
| Line 165: | Line 168: | ||
| # wg-down.ps1 | # wg-down.ps1 | ||
| param( | param( | ||
| + | [string]$InterfaceAlias = " | ||
| [string[]]$Domains = @(" | [string[]]$Domains = @(" | ||
| ) | ) | ||
| Line 174: | Line 178: | ||
| } | } | ||
| - | # Auto-detect WireGuard interface (by type) | ||
| - | $Interface = Get-NetAdapter | Where-Object { $_.InterfaceDescription -match " | ||
| - | |||
| - | if (-not $Interface) { | ||
| - | Write-Output "No active WireGuard interface found; skipping cleanup." | ||
| - | exit 0 | ||
| - | } | ||
| - | |||
| - | $InterfaceAlias = $Interface.Name | ||
| Write-Output "Using WireGuard interface: $InterfaceAlias" | Write-Output "Using WireGuard interface: $InterfaceAlias" | ||
| Line 189: | Line 184: | ||
| Get-DnsClientNrptRule | | Get-DnsClientNrptRule | | ||
| Where-Object { $_.Namespace -eq $domain } | | Where-Object { $_.Namespace -eq $domain } | | ||
| - | Remove-DnsClientNrptRule -ErrorAction SilentlyContinue | + | Remove-DnsClientNrptRule |
| Write-Output " | Write-Output " | ||
| } | } | ||
| Line 196: | Line 191: | ||
| Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix '' | Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix '' | ||
| Write-Output " | Write-Output " | ||
| + | |||
| </ | </ | ||
| Line 211: | Line 207: | ||
| - | ===== More about DNS Configuration on Linux ===== | + | ===== DNS Configuration |
| If you're using systemd-resolved, | If you're using systemd-resolved, | ||
| Line 259: | Line 255: | ||
| Now lookups of shortname or shortname.front or shortname.ipmi should work. Note that dig does not respect the search domains in / | Now lookups of shortname or shortname.front or shortname.ipmi should work. Note that dig does not respect the search domains in / | ||
| + | ===== Split DNS on systemd-resolved distros (Fedora, recent Ubuntu, etc.) ===== | ||
| + | |||
| + | If all web browsing / external DNS stops working while connected to the Sepia VPN, but works again after '' | ||
| + | |||
| + | Do **not** use '' | ||
| + | |||
| + | - Edit ''/ | ||
| + | - **Remove** (or comment out) the '' | ||
| + | - Add the following lines under '' | ||
| + | |||
| + | < | ||
| + | PostUp = resolvectl dns %i 10.20.192.13 | ||
| + | PostUp = resolvectl domain %i ~sepia.ceph.com ~front.sepia.ceph.com ~ipmi.sepia.ceph.com | ||
| + | PostUp = resolvectl default-route %i false | ||
| + | </ | ||
| + | |||
| + | Then restart the tunnel: | ||
| + | |||
| + | < | ||
| + | sudo wg-quick down sepia && sudo wg-quick up sepia | ||
| + | </ | ||
| + | |||
| + | Verify: | ||
| + | |||
| + | < | ||
| + | resolvectl status sepia | ||
| + | </ | ||
| + | |||
| + | You should see '' | ||
| + | |||
| + | ==== Alternative: | ||
| + | |||
| + | On Fedora you can instead import the tunnel into NetworkManager, | ||
| + | |||
| + | < | ||
| + | sudo nmcli connection import type wireguard file / | ||
| + | sudo nmcli connection modify sepia ipv4.dns-search " | ||
| + | sudo nmcli connection up sepia | ||
| + | </ | ||
| + | Only use one method — don't run wg-quick and the NetworkManager connection at the same time. | ||
wireguard.1765995910.txt.gz · Last modified: by dmick