Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[feature] Added support for WireGuard #225 #226

Draft
wants to merge 11 commits into
base: master
Choose a base branch
from
Draft

Conversation

pandafy
Copy link
Member

@pandafy pandafy commented Jun 3, 2022

Added two images:

  • wireguard: image that runs WireGuard server
  • wireguard_updater: image that runs a Flask app that is
    used for triggering configuration update for WireGuard server.

Closes #225


TODO

  • Restrict sudo access on celery and wireguard images.

@nemesifier nemesifier changed the title [feature] Added support for WireGuard and VXLAN #225 [feature] Added support for WireGuard #225 Jun 9, 2022
Copy link
Member

@nemesifier nemesifier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please rebase on the latest master.

images/openwisp_wireguard_updater/Dockerfile Outdated Show resolved Hide resolved
images/common/utils.sh Outdated Show resolved Hide resolved
@pandafy pandafy force-pushed the wireguard-support branch 13 times, most recently from 77f35ae to 21976be Compare June 17, 2022 13:17
Copy link
Member

@nemesifier nemesifier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The first commit message says: Added support for WireGuard and VXLAN, is the VXLAN part true?

Copy link
Member

@nemesifier nemesifier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the wireguard container log I see the following warning repeated many times, which pollutes the log unnecessarily:

Warning: Using a password with '-a' or '-u' option on the command line interface may not be safe.


USER root:root
RUN apt install --yes --no-install-recommends \
iproute2 iptables sudo
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's install also ping-utils which is useful

Copy link
Member

@nemesifier nemesifier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happens if the configured VPN key or ID are wrong?
Let's make sure this is communicated explicitly in the logs.

Copy link
Member

@nemesifier nemesifier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see that the Wireguard VPN updater app is not working as expected (on linode), I get the following:

[pid: 106268|app: 0|req: 1296/19080] 10.2.2.78 () {38 vars in 627 bytes} [Mon Jul  4 16:07:11 2022] POST /trigger-update?key=************ => generated 0 bytes in 0 msecs (HTTP/1.1 400) 2 headers in 87 bytes (0 switches on core 0)

In the code I see that vpn_id is a required parameter, but are you sure the current version of OpenWISP Controller sends this in the request?
https://github.com/openwisp/openwisp-controller/blob/c02d5279614935790b51863aff623d525c279f41/openwisp_controller/config/tasks.py#L92-L106

Moreover, the periodic update is also not working. I tried waiting for the cron period to pass but the peers are not updated.

cat /var/spool/cron/crontabs/openwisp
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (- installed on Mon Jul  4 09:36:32 2022)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
*/5 * * * * bash /opt/openwisp/update_wireguard.sh check_config

I see the crontab there but it doesn't seems like it's working.

If I add a line * * * * * touch /opt/openwisp/testyo it works (it creates the file), if I run the command manually it also works (updates the local wg peers), but the cronjob on its own is not working.

@pandafy
Copy link
Member Author

pandafy commented Jul 5, 2022

In the code I see that vpn_id is a required parameter, but are you sure the current version of OpenWISP Controller sends this in the request?
https://github.com/openwisp/openwisp-controller/blob/c02d5279614935790b51863aff623d525c279f41/openwisp_controller/config/tasks.py#L92-L106

I am aware that openwisp-controller does not send vpn_id in the request. Hence, I have added in the docs on how to configure the webhook endpoint

https://github.com/openwisp/docker-openwisp/blame/f58450c5589897b9eb42e9fb3116adf8742c888a/docs/tutorials/deploying-wireguard-vpn.md#L91-L108

I am double checking the cron job

Copy link
Member

@nemesifier nemesifier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible to disable the VPN wireguard updater on the public hostname and only use it internally, if not can you change it so that this is possible please?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[features] Add support for WireGuard
2 participants