Differences

This shows you the differences between two versions of the page.

--- wireguard [2026/08/13 22:13] – [Windows] fix up/down scripts to take interface name as argument dmick
+++ wireguard [2026/08/24 15:23] (current) – djgalloway
@@ Line 1: / Line 1: @@
 ====== Wireguard Access ======
 ===== Summary =====
-For now, this is a manual process to access the "new" Sepia lab in Poughkeepsie, NY.
+We use Wireguard for VPN access to the Sepia lab.  Lab access requests are now automated.
 ===== How To =====
@@ Line 9: / Line 9: @@
   * Install Wireguard
   * Generate a public/private keypair
-  * Provide the public key in a ticket
+  * Provide the public key in the [[https://onboarding.sepia.ceph.com/wireguard|Onboarding Portal]]
-  * The Labs team will DM or e-mail your Wireguard IP to you
+  * Once your access is approved, you'll be e-mailed your Wireguard IP
   * Connect
 ==== Mac/Linux ==
@@ Line 42: / Line 43: @@
 **Keep the Private Key secret!!**
-. Provide the Wireguard public key (''~/.wireguard/public.key'' contents) [[http://tracker.ceph.com/projects/lab/issues/new?issue[tracker_id]=3|in a tracker ticket]].  We will DM your Wireguard IP to you.
+. Provide the Wireguard public key (''~/.wireguard/public.key'' contents) in the [[https://onboarding.sepia.ceph.com/wireguard|Onboarding Portal]].
-=== DO NOT ping any Lab Admins directly.  We have a rotation we follow for processing tickets. ===
+=== DO NOT ping any Lab Admins directly ===
 . Create ''~/.wireguard/client.conf''  (note that the $PRIVATE_KEY must expand to
@@ Line 56: / Line 56: @@
 PrivateKey = $PRIVATE_KEY
 Address = X.X.X.X/32
-DNS = 10.20.192.11, front.sepia.ceph.com, ipmi.sepia.ceph.com
+DNS = 10.20.192.13, front.sepia.ceph.com, ipmi.sepia.ceph.com
 MTU = 1200
@@ Line 67: / Line 67: @@
 </code>
-. Once Dan or David give you your private IP, replace ''X.X.X.X'' in ''client.conf'' with it.
+. Once you receive your private IP, replace ''X.X.X.X'' in ''client.conf'' with it.
 . Bring up the interface
@@ Line 85: / Line 85: @@
 </code>
-use wg show to show status.
+Use ''wg show'' to show status.
 ==== Windows ====
-.  Install Windows client from https://www.wireguard.com/install/
+. Install Windows client from https://www.wireguard.com/install/
-. In the wireguard app, select "Add tunnel/Add empty tunnel".  A public and private key will be automatically generated for you.  Note them.  KEEP THE PRIVATE KEY SECRET.
+. In the Wireguard app, select "Add tunnel/Add empty tunnel".  A public and private key will be automatically generated for you.  Note them.  KEEP THE PRIVATE KEY SECRET.
-. send in your public key to David/Dan
+. Submit your public key in the [[https://onboarding.sepia.ceph.com/wireguard|Onboarding Portal]]
-. get an IP address in return
+. Wait to receive your Wireguard IP
-. add the configuration to the wireguard app.  The first two lines
+. Add the configuration to the wireguard app.  The first two lines
 ([Interface] and PrivateKey = <your private key>) will already be present.
 Be very careful to not change anything besides your Address.  In
@@ Line 105: / Line 106: @@
 PrivateKey = <your private key>
 Address = <address from communication with David/Dan>/32
-DNS = 10.20.192.11, front.sepia.ceph.com, ipmi.sepia.ceph.com
+DNS = 10.20.192.13, front.sepia.ceph.com, ipmi.sepia.ceph.com
 MTU = 1200
@@ Line 206: / Line 207: @@
-===== More about DNS Configuration on Linux =====
+===== DNS Configuration using dnsmasq on Linux =====
 If you're using systemd-resolved, stop.  It is incapable of handling split DNS.  I would not use resolvconf.
@@ Line 254: / Line 255: @@
 Now lookups of shortname or shortname.front or shortname.ipmi should work.  Note that dig does not respect the search domains in /etc/resolv.conf by default; you must use dig +search <domain>
+===== Split DNS on systemd-resolved distros (Fedora, recent Ubuntu, etc.) =====
+If all web browsing / external DNS stops working while connected to the Sepia VPN, but works again after ''sudo resolvectl revert sepia'', your distro is using systemd-resolved and wg-quick has set the lab DNS server as the **default** resolver for all queries — not just Sepia ones.
+Do **not** use ''resolvectl revert'' as a workaround; it also breaks resolution of lab hostnames. Configure split DNS instead so only Sepia domains are sent to the lab resolver:
+  - Edit ''/etc/wireguard/sepia.conf''
+  - **Remove** (or comment out) the ''DNS ='' line
+  - Add the following lines under ''[Interface]'':
+<code>
+PostUp = resolvectl dns %i 10.20.192.13
+PostUp = resolvectl domain %i ~sepia.ceph.com ~front.sepia.ceph.com ~ipmi.sepia.ceph.com
+PostUp = resolvectl default-route %i false
+</code>
+Then restart the tunnel:
+<code>
+sudo wg-quick down sepia && sudo wg-quick up sepia
+</code>
+Verify:
+<code>
+resolvectl status sepia
+</code>
+You should see ''Default Route: no'' and the three sepia domains listed. Lab hostnames (e.g. ''smithi001.front.sepia.ceph.com'') will resolve via the VPN; everything else uses your normal DNS.
+==== Alternative: NetworkManager ====
+On Fedora you can instead import the tunnel into NetworkManager, which handles split DNS natively:
+<code>
+sudo nmcli connection import type wireguard file /etc/wireguard/sepia.conf
+sudo nmcli connection modify sepia ipv4.dns-search "~sepia.ceph.com;front.sepia.ceph.com;ipmi.sepia.ceph.com" ipv4.dns-priority 50
+sudo nmcli connection up sepia
+</code>
+Only use one method — don't run wg-quick and the NetworkManager connection at the same time.