Skip to content
Register

wireguard mesh between 5 locations

VPS Hosting by MARIA3 5 replies 199 views
MARIA3

Member OP

#1

I make a server up in 5 place: home, office, parents house, two VPS (Vultr and RackNerd). Before I use OpenVPN but is slow and hard to manage.

New setup: all node connect to all, full mesh. I use `wg` and small bash script for add peers.

Diagram:

home <----> office
 |  \      /  |
 |   \    /   |
 |    vps1    |
 |    /  \    |
 v   v    v   v
parents<-->vps2

Config is same in all, only change Endpoint and AllowedIPs. I use /24 for all tunnel, assign from 10.200.200.0/24.

For firewall I am open UDP 51820 only. Regards.

siesta first, deploy later
techmei

Member

#2
MARIA3 said:
Config is same in all

You forget the preshared key lah

Two server without PSK is OK for home but I will not run in production like this

Here is my command, even one command I put in code block:

wg genkey | tee private.key | wg pubkey > public.key

XD the key file is secret, do not git push

lookuppierre

Member

4 #3
techmei said:
Two server without PSK

«the Preshared Key» is for the Post-Quantum, oui? I am read the WireGuard paper and the PSK is «the Optional» but I am use anyway.

My config is more complex, I have 7 node. The script for add peer is the Python, not bash. I am share if someone want.

prix fixe infrastructure: €5/mo
olespete

Member

Trust No One

#4
MARIA3 said:
Open UDP 51820 only

WHAT ABOUT THE REST OF THE ATTACK SURFACE

Without proper hardening:

  • WG listens on 0.0.0.0 by default — restrict to interface!
  • No fail2ban on WG port — brute force possible
  • Missing sysctl hardening: net.ipv4.conf.all.rp_filter
  • No key rotation schedule

Also implement firewall rules on EACH node:

iptables -A INPUT -i wg0 -j ACCEPT
iptables -A INPUT -p udp --dport 51820 -m state --state NEW -j ACCEPT
iptables -P INPUT DROP

I have seen mesh without preshared keys in PRODUCTION. The admin was fired.

https://www.wireguard.com

airgapped, encrypted, faraday'd, still worried
bravomartha

Member

#5
olespete said:
Admin was fired

WELL I IMPLEMENTED SOMETHING SIMILAR EXCEPT IT WAS LAST TUESDAY AND I WAS EATING CEREAL FOR BREAKFAST WHEN THE SERVER WENT DOWN AND MY CAT MR. WHISKERS JUMPED OFF THE COUCH BECAUSE THE ALERT WENT OFF AND IT WAS RAINING OUTSIDE WHICH IS UNUSUAL FOR JULY HERE AND I HAD FORGOTTEN THE PRESHARED KEYS EXACTLY LIKE techmei SAID AND I THOUGHT IT WOULD BE FINE BECAUSE THE DOCUMENTATION SAID OPTIONAL AND I PUT IT IN PRODUCTION ANYWAY BECAUSE MY BOSS WANTED IT DONE BY FRIDAY AND NOW I HAVE TO EXPLAIN WHY THE SECURITY AUDIT FAILED AND THE AUDITOR WAS THIS GUY NAMED DAVE WHO WORE A TIE WITH DUCKS ON IT AND HE KEPT ASKING ABOUT KEY ROTATION AND I DIDNT HAVE ANSWERS AND THE WHOLE MEETING WAS THREE HOURS LONG AND MY CAT WAS STILL MAD ABOUT THE ALERT NOISE AND I HAVENT SLEPT SINCE

quinnbizz

Member

#6

Optional does not mean skip it.

...

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft