Wireguard

Wireguard

We support wireguard vpn connections towards the space. Wireguard vpn's are a lightweight alternative to openvpn. A vpn tunnel comes in two forms:

• Client-to-Site (Roadwarrior)
• Site-to-Site

In both cases you will need someone from the BOFH team to configure the vpn for you, as this is a manual operation which requires admin privileges.

Client-to-Site

A CtS/Roadwarrior vpn tunnel is when you connect your laptop to a network, in a hub-spoke topology. In this setup, you will receive a route towards the nurdspace network (10.208.0.0/16) together with an ip address within the nurdspace network.

Site-to-Site

A StS tunnel is meant to bind two networks together. It requires additional routing rules, and because of this you need to check with the bofh team to see if the prefix you use at home is available for routing on the nurdspace network. If there is a collission, you will not be able to setup a network. You will exchange routes with the nurdspace router, and both networks will be able to reach each other.

Getting connected

First, you need to determine if you want a roadwarrior or site-to-site vpn. Next, setup wireguard. You will need a private key, and we need to know the corresponding public key. You can generate the keys using the commands below:

# Generate a private key and write this to somename.key
wg genkey > somename.key

# Get the pubkey for the key you just generated
cat somename.key | wg pubkey

Contact someone from the BOFH team to create the configuration on the nurdspace router, and follow their instructions and advice in getting the tunnel to work. A roadwarrior config looks like this:

[Interface]
Address = <ip address that is registered in ipam>/24
PrivateKey = <run wg genkey and copy&paste the resulting key here>

[Peer]
PublicKey = ebbpxRFJKQt6e4LrigBKOHBomFhu3TVl4VCTWM3BkRY=
Endpoint = 213.154.252.130:2062
AllowedIPs = 10.208.0.0/16
PersistentKeepalive = 25

Optionally, you can configure DNS forwarding towards the nurdspace dns server. This will allow you to use *.nurd.space address from the comfort of your network. For unbound add the following configuration:

server:
 # Note that you need to *add* these under server:
 domain-insecure: "example.com"
 domain-insecure: "nurd.space"
 domain-insecure: "lan.nurd.space"
 domain-insecure: "vm.nurd.space"
 domain-insecure: "management.nurd.space"
 domain-insecure: "router.nurd.space"
 domain-insecure: "dhcp.nurd.space"
 domain-insecure: "11.208.10.in-addr.arpa"
 domain-insecure: "30.208.10.in-addr.arpa"
 domain-insecure: "42.208.10.in-addr.arpa"
 domain-insecure: "43.208.10.in-addr.arpa"

forward-zone:
  name: "nurd.space"
  forward-addr: "10.208.30.254"

forward-zone:
  name: "lan.nurd.space"
  forward-addr: "10.208.30.254"

forward-zone:
  name: "vm.nurd.space"
  forward-addr: "10.208.30.254"

forward-zone:
  name: "management.nurd.space"
  forward-addr: "10.208.30.254"

forward-zone:
  name: "router.nurd.space"
  forward-addr: "10.208.30.254"

forward-zone:
  name: "dhcp.nurd.space"
  forward-addr: "10.208.30.254"

forward-zone:
  name: "11.208.10.in-addr.arpa"
  forward-addr: "10.208.30.254"

forward-zone:
  name: "30.208.10.in-addr.arpa"
  forward-addr: "10.208.30.254"

forward-zone:
  name: "42.208.10.in-addr.arpa"
  forward-addr: "10.208.30.254"

forward-zone:
  name: "43.208.10.in-addr.arpa"
  forward-addr: "10.208.30.254"

Configuring a new wireguard connection

Start by registering all relevant ip addresses and networks in ipam. For a roadwarrior vpn, you will need to allocate a new ip address in the 10.208.253.0/24 network. Pick a free one, and be sure to give the host a descriptive name (something.vpn.nurd.space). In the future, this will be used to generate dns names for the connected members. Next, log into the edgerouter, and navigate to ConfigTree->Interfaces->wireguard->wg0->peer. Click on 'Add'. This will create a new row, where you can fill in the public key of the peer you want to connect. Click on 'Update List', and in the menu on the left, navigate to the public key you just added. In the corresponding form you will configure the peer. Start by adding the allowed ips. For a roadwarrior vpn, this is the ip you allocated earlier. Be sure to give this the /32 prefix. For a site-to-site vpn, you add this ip, together with the prefixes that belong to the other side of the vpn tunnel. Next, add the name for this vpn tunnel in the description field. Once you are done, click on 'Preview->Apply' to activate the new tunnel.