beb30b0d3300be02031dda72bce8ad69c238a107
howto/wireguard.md
| ... | ... | @@ -61,4 +61,35 @@ ping fe80::<your_peers_suffix>%<interface_name> |
| 61 | 61 | |
| 62 | 62 | Afterwards configure your [BGP session](/howto/Bird) as usual |
| 63 | 63 | |
| 64 | +## wg-quick |
|
| 65 | + |
|
| 66 | +[wg-quick](https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8) is a script that is shipped with Wireguard to help users bring up tunnels in some common use cases. |
|
| 67 | + |
|
| 68 | +> It is designed for users with simple needs, and users with more advanced needs are highly encouraged to use a more specific tool, a more complete network manager, or otherwise just use wg(8) and ip(8), as usual. |
|
| 69 | + |
|
| 70 | +The script makes some changes that are not valid when used for DN42 tunnels, and which must be worked around: |
|
| 71 | + |
|
| 72 | +- By default, the script will add a routing policy that routes the 'AllowedIP' ranges through the tunnel. In DN42, route selection is managed by BGP so the routing policy *must* be removed to avoid problems. This is achieved by adding the '_Table = off_' directive. |
|
| 73 | + |
|
| 74 | + - Warning: a common pattern for DN42 tunnels is to use `AllowedIPs = 0.0.0.0/0` or `AllowedIPs = ::/0` then use firewall rules to limit source and destination addresses. If you do not add 'Table = off' this could cause you to route clearnet traffic via your peer and potentially lose connectivity to your node ! |
|
| 75 | + |
|
| 76 | +- It is common in DN42 to use Point-to-Point addressing schemes on tunnel interfaces (that is, using IPv4/32 and IPv6/128 addresses); this is not supported by wg-quick. To configure PTP addresses you must add a '_PostUp_' statement that first removes the addresses that wg-quick has configured and then re-add them. On Linux, this will typically be done using /sbin/ip. |
|
| 77 | + |
|
| 78 | +An example wg-quick script that incorporates the above two workarounds is below, where `<MyIPv[46]>` are the DN42 IP addresses of your node and `<PeerIPv[46]>` are the IP addresses for your peer. |
|
| 79 | + |
|
| 80 | +``` |
|
| 81 | +[Interface] |
|
| 82 | +PrivateKey = <your private key> |
|
| 83 | +Address = <MyIPv4>/32, <MyIPv6>/128 |
|
| 84 | +PostUp = /sbin/ip addr del dev wg0 <MyIPv4>/32 && /sbin/ip addr add dev wg0 <MyIPv4>/32 peer <PeerIPv4>/32 && /sbin/ip addr del dev wg0 <MyIPv6>/128 && /sbin/ip addr add dev wg0 <MyIPv6>/128 peer <PeerIPv6>/128 |
|
| 85 | +Table = off |
|
| 86 | + |
|
| 87 | +[Peer] |
|
| 88 | +Endpoint = <your peer's wireguard endpoint> |
|
| 89 | +PublicKey = <your peer's public key> |
|
| 90 | +AllowedIPs = 172.16.0.0/12 |
|
| 91 | +AllowedIPs = 10.0.0.0/8 |
|
| 92 | +AllowedIPs = fd00::/8 |
|
| 93 | +AllowedIPs = fe80::/10 |
|
| 94 | +``` |
|
| 64 | 95 |