wireguard
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
wireguard [2026/02/02 16:46] djgalloway |
wireguard [2026/08/13 22:13] (current) dmick [Windows] fix up/down scripts to take interface name as argument |
||
|---|---|---|---|
| Line 5: | Line 5: | ||
| ===== How To ===== | ===== How To ===== | ||
| - | Overall flow: | + | ==== Summary ==== |
| - | * install Wireguard | + | |
| - | * generate a public/private keypair; | + | |
| - | * send in the public key to David/Dan to get a server entry | + | |
| - | * get an IP address to use in return | + | |
| - | * use the private key, the IP address, and these instructions to configure your | + | |
| - | client | + | |
| + | * Install Wireguard | ||
| + | * Generate a public/private keypair | ||
| + | * Provide the public key in a ticket | ||
| + | * The Labs team will DM or e-mail your Wireguard IP to you | ||
| + | * Connect | ||
| ==== Mac/Linux == | ==== Mac/Linux == | ||
| Line 43: | Line 42: | ||
| **Keep the Private Key secret!!** | **Keep the Private Key secret!!** | ||
| - | 5. Send the Wireguard public key (''~/.wireguard/public.key'' contents) to David or Dan **via IBM Slack or E-mail**. They will update the Wireguard server and give you your VPN IP address. | + | 5. Provide the Wireguard public key (''~/.wireguard/public.key'' contents) [[http://tracker.ceph.com/projects/lab/issues/new?issue[tracker_id]=3|in a tracker ticket]]. We will DM your Wireguard IP to you. |
| + | |||
| + | === DO NOT ping any Lab Admins directly. We have a rotation we follow for processing tickets. === | ||
| 6. Create ''~/.wireguard/client.conf'' (note that the $PRIVATE_KEY must expand to | 6. Create ''~/.wireguard/client.conf'' (note that the $PRIVATE_KEY must expand to | ||
| Line 59: | Line 61: | ||
| [Peer] | [Peer] | ||
| PublicKey = kyEHy3ZBewI5RiK4/a0/UQn6O1kMt3h8V3u0OwsfUXc= | PublicKey = kyEHy3ZBewI5RiK4/a0/UQn6O1kMt3h8V3u0OwsfUXc= | ||
| - | AllowedIPs = 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25 | + | AllowedIPs = 172.21.0.0/20, 172.21.32.0/20, 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25, 172.21.64.0/24, 172.21.65.0/24, 172.21.66.0/24, 172.21.67.0/24 |
| Endpoint = 192.86.31.5:1194 | Endpoint = 192.86.31.5:1194 | ||
| PersistentKeepalive = 25 | PersistentKeepalive = 25 | ||
| Line 108: | Line 110: | ||
| [Peer] | [Peer] | ||
| PublicKey = kyEHy3ZBewI5RiK4/a0/UQn6O1kMt3h8V3u0OwsfUXc= | PublicKey = kyEHy3ZBewI5RiK4/a0/UQn6O1kMt3h8V3u0OwsfUXc= | ||
| - | AllowedIPs = 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25 | + | AllowedIPs = 172.21.0.0/20, 172.21.32.0/20, 172.16.48.0/24, 10.20.192.0/20, 10.20.208.0/20, 172.16.50.0/23, 172.16.53.0/25, 172.16.55.0/26, 172.16.56.0/23, 172.16.59.0/25, 172.16.60.0/25, 172.21.64.0/24, 172.21.65.0/24, 172.21.66.0/24, 172.21.67.0/24 |
| Endpoint = 192.86.31.5:1194 | Endpoint = 192.86.31.5:1194 | ||
| PersistentKeepalive = 25 | PersistentKeepalive = 25 | ||
| Line 120: | Line 122: | ||
| <code> | <code> | ||
| - | PostUp = powershell -ExecutionPolicy Bypass -File "C:\Wireguard\wg-up.ps1" | + | PostUp = powershell -ExecutionPolicy Bypass -File "C:\Wireguard\wg-up.ps1" -InterfaceAlias wg0 |
| - | PostDown = powershell -ExecutionPolicy Bypass -File "C:\Wireguard\wg-down.ps1" | + | PostDown = powershell -ExecutionPolicy Bypass -File "C:\Wireguard\wg-down.ps1" -InterfaceAlias wg0 |
| </code> | </code> | ||
| Line 128: | Line 130: | ||
| # wg-up.ps1 | # wg-up.ps1 | ||
| param( | param( | ||
| - | [string[]]$Domains = @("sepia.ceph.com", "front.sepia.ceph.com"), | + | [string]$InterfaceAlias = "wg0", |
| + | [string[]]$Domains = @("front.sepia.ceph.com"), | ||
| [string]$DNSServer = "10.20.192.11" | [string]$DNSServer = "10.20.192.11" | ||
| ) | ) | ||
| Line 138: | Line 141: | ||
| } | } | ||
| - | # Auto-detect WireGuard interface (by type) | + | # Verify the requested interface exists and is up |
| - | $Interface = Get-NetAdapter | Where-Object { $_.InterfaceDescription -match "WireGuard" -and $_.Status -eq "Up" } | Select-Object -First 1 | + | $Interface = Get-NetAdapter -Name $InterfaceAlias -ErrorAction Stop |
| - | if (-not $Interface) { | + | if ($Interface.Status -ne "Up") { |
| - | Write-Error "No active WireGuard interface found." | + | Write-Error "WireGuard interface /$InterfaceAlias' is not up." |
| exit 1 | exit 1 | ||
| } | } | ||
| - | $InterfaceAlias = $Interface.Name | ||
| Write-Output "Using WireGuard interface: $InterfaceAlias" | Write-Output "Using WireGuard interface: $InterfaceAlias" | ||
| Line 159: | Line 161: | ||
| # Set connection-specific DNS suffix (short names) | # Set connection-specific DNS suffix (short names) | ||
| Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix $Domains[0] | Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix $Domains[0] | ||
| - | Write-Output "Set connection-specific suffix: $($Domains[0]) | + | Write-Output "Set connection-specific suffix: $($Domains[0])" |
| </code> | </code> | ||
| Line 165: | Line 167: | ||
| # wg-down.ps1 | # wg-down.ps1 | ||
| param( | param( | ||
| + | [string]$InterfaceAlias = "wg0", | ||
| [string[]]$Domains = @("sepia.ceph.com") | [string[]]$Domains = @("sepia.ceph.com") | ||
| ) | ) | ||
| Line 174: | Line 177: | ||
| } | } | ||
| - | # Auto-detect WireGuard interface (by type) | ||
| - | $Interface = Get-NetAdapter | Where-Object { $_.InterfaceDescription -match "WireGuard" -and $_.Status -eq "Up" } | Select-Object -First 1 | ||
| - | |||
| - | if (-not $Interface) { | ||
| - | Write-Output "No active WireGuard interface found; skipping cleanup." | ||
| - | exit 0 | ||
| - | } | ||
| - | |||
| - | $InterfaceAlias = $Interface.Name | ||
| Write-Output "Using WireGuard interface: $InterfaceAlias" | Write-Output "Using WireGuard interface: $InterfaceAlias" | ||
| Line 189: | Line 183: | ||
| Get-DnsClientNrptRule | | Get-DnsClientNrptRule | | ||
| Where-Object { $_.Namespace -eq $domain } | | Where-Object { $_.Namespace -eq $domain } | | ||
| - | Remove-DnsClientNrptRule -ErrorAction SilentlyContinue | + | Remove-DnsClientNrptRule -Force -ErrorAction SilentlyContinue |
| Write-Output "Removed NRPT rule for $domain" | Write-Output "Removed NRPT rule for $domain" | ||
| } | } | ||
| Line 196: | Line 190: | ||
| Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix '' | Set-DnsClient -InterfaceAlias $InterfaceAlias -ConnectionSpecificSuffix '' | ||
| Write-Output "Cleared connection-specific suffix" | Write-Output "Cleared connection-specific suffix" | ||
| + | |||
| </code> | </code> | ||
wireguard.1770050776.txt.gz · Last modified: 2026/02/02 16:46 by djgalloway
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
