I've been diving pretty deep into networking recently, especially from a self-hosting perspective. Self-hosting tends to turn into a mess of domain name registration, VPS management, TLS cert management, dyndns, port forwarding, hole punching, etc etc[0].
I think technologies like WireGuard are going to play an important role in reducing that complexity (once we get some higher abstractions). I started a list of useful software I've found in this space here[1].
I'm in the exact same phase - been doing hosting/ops/sysadmin for most of my life but only starting to pay serious attention to the networking since recently.
Something I've yet come up with a good solution for that I feel should be much more common and simple, maybe you can point me to the right direction for (and maybe the answer is iptables, urgh):
(Containerized) P2P software that should be routed through some other endpoint before reaching/beaing reachable from the network.
Example: Bitcoin full node or Bittorrent node running in a Docker container on one of my home servers (where the host runs other software too). For all intents and purposes I want the nodes to route traffic through a VPS in some other DC (in this case bridged via wireguard). Incoming's easy enough with reverse proxies/load balancers, but with all the UDP traffic on random ports, outgoing TCP connections, etc, I haven't figured out a way to make it not leak my IP in some way.
Feels this should be dead easy but I'm stumped. Oh, and assume no support of SOCKS proxies in the software itself.
I'm aware of hidden onion services but talking clearnet here.
Yeah sorry, I can't think of anything to solve that. But it does have me thinking that I bet someone out there has made a wrapper program that intercepts network system calls (using LD_PRELOAD hacks) from a target executable and routes them all through a specific interface.
Failing that, you're probably stuck with iptables and maybe Linux namespaces.
K8s means you'll have a single source IP for all your application's traffic so you can just forward it all upstream instead of having to hunt for which ports it actually uses
Yeah, a VPN gateway on a VPS does away with a lot of that complexity. Having your LAN devices in the same virtual network makes dyndns, hole punching and port forwarding largely unnecessary. However, I still view wrapper scripts that you are supposed to curl | bash with some suspicion. I have a simple IPSec setup with strongswan and frankly I did not find the documentation to be as daunting as people make it out to be.
If there is a certbot plugin [1] for your DNS provider's API then renewal of TLS certs is a matter of a single cronjob with some hooks for other services. I set it up 18 months ago and it has never failed to renew.
On wireguard -- I recently replaced a pretty grim/complicated openvpn setup with a wireguard one, and while I had to write a ~200 line shell script to let our ops guys create configs for the users, it's been pretty much a great experience. (wireguard is itching for a nice ui or cli tool for managing configs.... if anyone knows one please let me know...)
Wireguard is simple point-to-point, I have an iptables rule that masquarades the tunnel interface to the internal interface of the 'vpn server' but it's all so simple that don't feel bad at all that someone down the road will inherit this system and have to mange it. It's obvious, the stuff I wrote around it is simple enough to grok in an hour, and that's a world of difference from openvpn, where you can easily deploy it with some ansible-galaxy role, but actually maintaining it for 200+ devs requires you to actually undersand it which is a different thing.
I'm not really contributing anything here, apart from -- everywhere I've used wireguard I feel better for it. If you're weighing up options, I suggest you go wg. :}
Thank you for your work on wg-access-server, I am happily using it at work with the multi user support to let staff self-service their VPN logins.
There's a few rough edges if you wander off from the simplest use case and a few nice-to-have features that I'm sure will show up in due course, but the core product nails it IMO.
I understand WG is meant to be no frills but for my company to use it, we need a standardized authentication framework around it like Xauth that can handle usernames/passwords/certificates (X509, not just keys)/MFA/etc. and server side tracking to allow for termination of sessions when people leave. It's not something I want to build myself. I would prefer that it be standardized and added to the official clients. Even if it's as simple as an OAuth flow that returns a key.
Wireguard doesn't support MFA so it isn't complaint to the frameworks we require (I guess Tailscale is). Tho you can make a SSH proxy with MFA if you enforce MFA via PAM (e.g. FIDO2 or TOTP are both possible).
FWIW: WireGuard isn't supposed to support MFA. You're meant to do MFA at a level above WireGuard. WireGuard sessions are keyed directly with Curve25519.
We created a web portal with SAML authentication that provisions and manages wireguard profiles on our edge locations. Employees have to log into the portal to obtain a wireguard configuration, and their configuration(s) are removed when their profile is deprovisioned in the IDP. It’s much easier to support then OpenVPN was - much easier to support and the wireguard client for mobile (at least iOS) just works, whereas the OpenVPN client for iOS was a nightmare to setup.
WG is rather low-level. Projects and companies like Tailscale are tackling what you describe, and I'm confident we'll eventually have open standards as well.
On the topic of WireGuard, I just thought I’d share wgcf that discovered recently. It generates the configs and keys you need to connect to CloudFlare’s Warp+ from any WireGuard client. I used it on my router so I can use Warp+ with my entire network.
I skimmed through the page. While Algo has many sane defaults for configuration as well as (VPS) destinations and an interactive mode, this one doesn’t have any interactive features. It doesn’t seem to have have specific defaults either.
I may be completely wrong here since I’ve used Algo only a few times, and that was quite sometime ago. One difference I see with this is the creation of new user profiles every time it’s run. Algo, in my limited use, seems to be geared for one user profile (or creating user profiles on setup and not later?).
It would be great to see this integrated with Algo.
I think technologies like WireGuard are going to play an important role in reducing that complexity (once we get some higher abstractions). I started a list of useful software I've found in this space here[1].
[0]: https://news.ycombinator.com/item?id=24475946
[1]: https://github.com/anderspitman/awesome-tunneling