2021-11-21 11:00:23 +00:00
|
|
|
## Wireguard test
|
|
|
|
|
|
2021-11-21 17:38:00 +00:00
|
|
|
This is a test whether wireguard-as-a-service can be provided inside k8s.
|
|
|
|
|
|
|
|
|
|
##
|
|
|
|
|
|
|
|
|
|
## Configuration on the pod
|
2021-11-21 11:00:23 +00:00
|
|
|
|
|
|
|
|
```
|
|
|
|
|
apk update
|
|
|
|
|
apk add wireguard-tools tcpdump
|
|
|
|
|
cat > /etc/wireguard/wg0.conf <<EOF
|
|
|
|
|
[Interface]
|
|
|
|
|
ListenPort = 51820
|
|
|
|
|
PrivateKey = wNTbdLXXQVynFAqIqXuqbwul7O00kuqgzajeK7/NoUw=
|
|
|
|
|
|
|
|
|
|
[Peer]
|
|
|
|
|
PublicKey = J3qrhOP6GjRC8qOdKiKcAYMXKdiTliBBbJgNpz8sUQI=
|
|
|
|
|
AllowedIPs = 2a0a:e5c1:101::/48
|
|
|
|
|
EOF
|
|
|
|
|
wg-quick up wg0
|
|
|
|
|
ip addr add 2a0a:e5c3::42/32 dev wg0
|
|
|
|
|
tcpdump -ni eth0 port 51820
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
2021-11-21 17:38:00 +00:00
|
|
|
## On the client
|
2021-11-21 11:00:23 +00:00
|
|
|
|
|
|
|
|
```
|
|
|
|
|
[Interface]
|
|
|
|
|
PrivateKey = YIhBmmE+D8NwSUijXv2Jw8FazNI73BEM9ApzAfJ9Zms=
|
|
|
|
|
ListenPort = 51820
|
|
|
|
|
Address = 2a0a:e5c1:101::42/48
|
|
|
|
|
|
|
|
|
|
[Peer]
|
|
|
|
|
PublicKey = ohMbdXf+eQQyiFFyJq+a8NMxV3pgFzjgPYcTD/T+qzs=
|
|
|
|
|
Endpoint = wireguard4.default.svc.c2.k8s.ooo:51820
|
|
|
|
|
AllowedIPs = 2a0a:e5c3::/32
|
|
|
|
|
```
|
|
|
|
|
|
2021-11-21 17:38:00 +00:00
|
|
|
## Result
|
|
|
|
|
|
|
|
|
|
Working:
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
[12:01] nb3:~% ping -c3 2a0a:e5c3::42
|
|
|
|
|
PING 2a0a:e5c3::42(2a0a:e5c3::42) 56 data bytes
|
|
|
|
|
64 bytes from 2a0a:e5c3::42: icmp_seq=1 ttl=64 time=13.2 ms
|
|
|
|
|
64 bytes from 2a0a:e5c3::42: icmp_seq=2 ttl=64 time=13.3 ms
|
|
|
|
|
64 bytes from 2a0a:e5c3::42: icmp_seq=3 ttl=64 time=13.8 ms
|
|
|
|
|
|
|
|
|
|
--- 2a0a:e5c3::42 ping statistics ---
|
|
|
|
|
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
|
|
|
|
|
rtt min/avg/max/mdev = 13.195/13.409/13.751/0.244 ms
|
|
|
|
|
[12:01] nb3:~%
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
On the pod:
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
/ # wg show
|
|
|
|
|
interface: wg0
|
|
|
|
|
public key: ohMbdXf+eQQyiFFyJq+a8NMxV3pgFzjgPYcTD/T+qzs=
|
|
|
|
|
private key: (hidden)
|
|
|
|
|
listening port: 51820
|
|
|
|
|
|
|
|
|
|
peer: J3qrhOP6GjRC8qOdKiKcAYMXKdiTliBBbJgNpz8sUQI=
|
|
|
|
|
endpoint: [2a0a:e5c0:13:0:225:b3ff:fe20:383c]:11017
|
|
|
|
|
allowed ips: 2a0a:e5c1:101::/48
|
|
|
|
|
latest handshake: 26 seconds ago
|
|
|
|
|
transfer: 35.40 KiB received, 32.93 KiB sent
|
|
|
|
|
/ #
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
On the client:
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
interface: k8s
|
|
|
|
|
public key: J3qrhOP6GjRC8qOdKiKcAYMXKdiTliBBbJgNpz8sUQI=
|
|
|
|
|
private key: (hidden)
|
|
|
|
|
listening port: 51820
|
|
|
|
|
|
|
|
|
|
peer: ohMbdXf+eQQyiFFyJq+a8NMxV3pgFzjgPYcTD/T+qzs=
|
|
|
|
|
endpoint: [2a0a:e5c0:13:e2::ba58]:51820
|
|
|
|
|
allowed ips: 2a0a:e5c3::/32
|
|
|
|
|
latest handshake: 46 seconds ago
|
|
|
|
|
transfer: 32.93 KiB received, 35.40 KiB sent
|
|
|
|
|
```
|
|
|
|
|
|
2021-11-21 11:00:23 +00:00
|
|
|
## Missing
|
|
|
|
|
|
|
|
|
|
* -Receiving traffic inside wg0-: works
|
|
|
|
|
* -Different IPv6 address-: works
|
2021-11-21 17:38:00 +00:00
|
|
|
* -IPv4 outside-: via Jool/external
|
2021-11-21 11:00:23 +00:00
|
|
|
* Keeping pod alive
|
2021-11-21 17:38:00 +00:00
|
|
|
* Routing / network delegation for the range
|
|
|
|
|
* Configuration definition: helm chart?
|
|
|
|
|
* uncloud integration:
|
|
|
|
|
* git repo (?)
|
|
|
|
|
* VPN server definition
|
2021-11-21 11:00:23 +00:00
|
|
|
|
|
|
|
|
## Routing / delegation
|
|
|
|
|
|
|
|
|
|
* Also via wg
|
2021-11-21 17:38:00 +00:00
|
|
|
* Via external VPN
|
