wireguard
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
wireguard [2025/12/17 18:25] dmick [Mac/Linux] |
wireguard [2026/08/17 21:19] (current) djgalloway |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Wireguard Access ====== | ====== Wireguard Access ====== | ||
| ===== Summary ===== | ===== Summary ===== | ||
| - | For now, this is a manual process to access the "new" Sepia lab in Poughkeepsie, NY. | + | We use Wireguard for VPN access to the Sepia lab. Lab access requests are now automated. |
| ===== How To ===== | ===== How To ===== | ||
| - | Overall flow: | + | ==== Summary ==== |
| - | * install Wireguard | + | |
| - | * generate a public/private keypair; | + | * Install Wireguard |
| - | * send in the public key to David/Dan to get a server entry | + | * Generate a public/private keypair |
| - | * get an IP address to use in return | + | * Provide the public key in the [[https://onboarding.sepia.ceph.com/wireguard|Onboarding Portal]] |
| - | * use the private key, the IP address, and these instructions to configure your | + | * Once your access is approved, you'll be e-mailed your Wireguard IP |
| - | client | + | * Connect |
| ==== Mac/Linux == | ==== Mac/Linux == | ||
| Line 43: | Line 43: | ||
| **Keep the Private Key secret!!** | **Keep the Private Key secret!!** | ||
| - | 5. Send the Wireguard public key (''~/.wireguard/public.key'' contents) to David or Dan. They will update the Wireguard server and give you your VPN IP address. | + | 5. Provide the Wireguard public key (''~/.wireguard/public.key'' contents) in the [[https://onboarding.sepia.ceph.com/wireguard|Onboarding Portal]]. |
| + | |||
| + | === DO NOT ping any Lab Admins directly === | ||
| 6. Create ''~/.wireguard/client.conf'' (note that the $PRIVATE_KEY must expand to | 6. Create ''~/.wireguard/client.conf'' (note that the $PRIVATE_KEY must expand to | ||
| Line 54: | Line 56: | ||
| PrivateKey = $PRIVATE_KEY | PrivateKey = $PRIVATE_KEY | ||
| Address = X.X.X.X/32 | Address = X.X.X.X/32 | ||
| - | DNS = 10.20.192.11, front.sepia.ceph.com, ipmi.sepia.ceph.com | + | DNS = 10.20.192.13, front.sepia.ceph.com, ipmi.sepia.ceph.com |
| MTU = 1200 | MTU = 1200 | ||
| [Peer] | [Peer] | ||
| PublicKey = kyEHy3ZBewI5RiK4/a0/UQn6O1kMt3h8V3u0OwsfUXc= | PublicKey = kyEHy3ZBewI5RiK4/a0/UQn6O1kMt3h8V3u0OwsfUXc= | ||
| - | AllowedIPs = 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25 | + | AllowedIPs = 172.21.0.0/20, 172.21.32.0/20, 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25, 172.21.64.0/24, 172.21.65.0/24, 172.21.66.0/24, 172.21.67.0/24 |
| Endpoint = 192.86.31.5:1194 | Endpoint = 192.86.31.5:1194 | ||
| PersistentKeepalive = 25 | PersistentKeepalive = 25 | ||
| Line 65: | Line 67: | ||
| </code> | </code> | ||
| - | 6. Once Dan or David give you your private IP, replace ''X.X.X.X'' in ''client.conf'' with it. | + | 6. Once you receive your private IP, replace ''X.X.X.X'' in ''client.conf'' with it. |
| 7. Bring up the interface | 7. Bring up the interface | ||
| Line 83: | Line 85: | ||
| </code> | </code> | ||
| - | use wg show to show status. | + | Use ''wg show'' to show status. |
| ==== Windows ==== | ==== Windows ==== | ||
| - | 1. Install Windows client from https://www.wireguard.com/install/ | + | 1. Install Windows client from https://www.wireguard.com/install/ |
| - | 2. In the wireguard app, select "Add tunnel/Add empty tunnel". A public and private key will be automatically generated for you. Note them. KEEP THE PRIVATE KEY SECRET. | + | 2. In the Wireguard app, select "Add tunnel/Add empty tunnel". A public and private key will be automatically generated for you. Note them. KEEP THE PRIVATE KEY SECRET. |
| - | 3. send in your public key to David/Dan | + | 3. Submit your public key in the [[https://onboarding.sepia.ceph.com/wireguard|Onboarding Portal]] |
| - | 4. get an IP address in return | + | 4. Wait to receive your Wireguard IP |
| - | 5. add the configuration to the wireguard app. The first two lines | + | 5. Add the configuration to the wireguard app. The first two lines |
| ([Interface] and PrivateKey = <your private key>) will already be present. | ([Interface] and PrivateKey = <your private key>) will already be present. | ||
| Be very careful to not change anything besides your Address. In | Be very careful to not change anything besides your Address. In | ||
| Line 103: | Line 106: | ||
| PrivateKey = <your private key> | PrivateKey = <your private key> | ||
| Address = <address from communication with David/Dan>/32 | Address = <address from communication with David/Dan>/32 | ||
| - | DNS = 10.20.192.11, front.sepia.ceph.com, ipmi.sepia.ceph.com | + | DNS = 10.20.192.13, front.sepia.ceph.com, ipmi.sepia.ceph.com |
| MTU = 1200 | MTU = 1200 | ||
| [Peer] | [Peer] | ||
| PublicKey = kyEHy3ZBewI5RiK4/a0/UQn6O1kMt3h8V3u0OwsfUXc= | PublicKey = kyEHy3ZBewI5RiK4/a0/UQn6O1kMt3h8V3u0OwsfUXc= | ||
| - | AllowedIPs = 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25 | + | AllowedIPs = 172.21.0.0/20, 172.21.32.0/20, 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25, 172.21.64.0/24, 172.21.65.0/24, 172.21.66.0/24, 172.21.67.0/24 |
| Endpoint = 192.86.31.5:1194 | Endpoint = 192.86.31.5:1194 | ||
| PersistentKeepalive = 25 | PersistentKeepalive = 25 | ||
| Line 120: | Line 123: | ||
| <code> | <code> | ||
| - | PostUp = powershell -ExecutionPolicy Bypass -File "C:\Wireguard\wg-up.ps1" | + | PostUp = powershell -ExecutionPolicy Bypass -File "C:\Wireguard\wg-up.ps1" -InterfaceAlias wg0 |
| - | PostDown = powershell -ExecutionPolicy Bypass -File "C:\Wireguard\wg-down.ps1" | + | PostDown = powershell -ExecutionPolicy Bypass -File "C:\Wireguard\wg-down.ps1" -InterfaceAlias wg0 |
| </code> | </code> | ||
| Line 128: | Line 131: | ||
| # wg-up.ps1 | # wg-up.ps1 | ||
| param( | param( | ||
| - | [string[]]$Domains = @("sepia.ceph.com", "front.sepia.ceph.com"), | + | [string]$InterfaceAlias = "wg0", |
| + | [string[]]$Domains = @("front.sepia.ceph.com"), | ||
| [string]$DNSServer = "10.20.192.11" | [string]$DNSServer = "10.20.192.11" | ||
| ) | ) | ||
| Line 138: | Line 142: | ||
| } | } | ||
| - | # Auto-detect WireGuard interface (by type) | + | # Verify the requested interface exists and is up |
| - | $Interface = Get-NetAdapter | Where-Object { $_.InterfaceDescription -match "WireGuard" -and $_.Status -eq "Up" } | Select-Object -First 1 | + | $Interface = Get-NetAdapter -Name $InterfaceAlias -ErrorAction Stop |
| - | if (-not $Interface) { | + | if ($Interface.Status -ne "Up") { |
| - | Write-Error "No active WireGuard interface found." | + | Write-Error "WireGuard interface /$InterfaceAlias' is not up." |
| exit 1 | exit 1 | ||
| } | } | ||
| - | $InterfaceAlias = $Interface.Name | ||
| Write-Output "Using WireGuard interface: $InterfaceAlias" | Write-Output "Using WireGuard interface: $InterfaceAlias" | ||
| Line 159: | Line 162: | ||
| # Set connection-specific DNS suffix (short names) | # Set connection-specific DNS suffix (short names) | ||
| Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix $Domains[0] | Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix $Domains[0] | ||
| - | Write-Output "Set connection-specific suffix: $($Domains[0]) | + | Write-Output "Set connection-specific suffix: $($Domains[0])" |
| </code> | </code> | ||
| Line 165: | Line 168: | ||
| # wg-down.ps1 | # wg-down.ps1 | ||
| param( | param( | ||
| + | [string]$InterfaceAlias = "wg0", | ||
| [string[]]$Domains = @("sepia.ceph.com") | [string[]]$Domains = @("sepia.ceph.com") | ||
| ) | ) | ||
| Line 174: | Line 178: | ||
| } | } | ||
| - | # Auto-detect WireGuard interface (by type) | ||
| - | $Interface = Get-NetAdapter | Where-Object { $_.InterfaceDescription -match "WireGuard" -and $_.Status -eq "Up" } | Select-Object -First 1 | ||
| - | |||
| - | if (-not $Interface) { | ||
| - | Write-Output "No active WireGuard interface found; skipping cleanup." | ||
| - | exit 0 | ||
| - | } | ||
| - | |||
| - | $InterfaceAlias = $Interface.Name | ||
| Write-Output "Using WireGuard interface: $InterfaceAlias" | Write-Output "Using WireGuard interface: $InterfaceAlias" | ||
| Line 189: | Line 184: | ||
| Get-DnsClientNrptRule | | Get-DnsClientNrptRule | | ||
| Where-Object { $_.Namespace -eq $domain } | | Where-Object { $_.Namespace -eq $domain } | | ||
| - | Remove-DnsClientNrptRule -ErrorAction SilentlyContinue | + | Remove-DnsClientNrptRule -Force -ErrorAction SilentlyContinue |
| Write-Output "Removed NRPT rule for $domain" | Write-Output "Removed NRPT rule for $domain" | ||
| } | } | ||
| Line 196: | Line 191: | ||
| Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix '' | Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix '' | ||
| Write-Output "Cleared connection-specific suffix" | Write-Output "Cleared connection-specific suffix" | ||
| + | |||
| </code> | </code> | ||
wireguard.1765995910.txt.gz · Last modified: 2025/12/17 18:25 by dmick
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
