Difference between revisions of "OpenBSD Wireguard - Large network"
(Created page with "I've been doing a lot of testing in wireguard as of late and I'm impressed. We had some significant speed gains in all platforms of services with the cha cha cryptography. S...") |
|||
| Line 1: | Line 1: | ||
I've been doing a lot of testing in wireguard as of late and I'm impressed. We had some significant speed gains in all platforms of services with the cha cha cryptography. Setup is extremely easy, below I've included a small setup where I have three locations using wireguard; | I've been doing a lot of testing in wireguard as of late and I'm impressed. We had some significant speed gains in all platforms of services with the cha cha cryptography. Setup is extremely easy, below I've included a small setup where I have three locations using wireguard; | ||
| − | + | <code> | |
#This is file /etc/hostname.wg0 | #This is file /etc/hostname.wg0 | ||
| Line 21: | Line 21: | ||
wgport 700 | wgport 700 | ||
up | up | ||
| − | + | </code> | |
This router can accept traffic from all of those offices. Of course you need to make sure that IP traffic is allowed so if you take note "routept" would look like the below; This ensures that traffic is routable and also makes sure other up traffic can't snoop. | This router can accept traffic from all of those offices. Of course you need to make sure that IP traffic is allowed so if you take note "routept" would look like the below; This ensures that traffic is routable and also makes sure other up traffic can't snoop. | ||
Revision as of 09:43, 9 March 2021
I've been doing a lot of testing in wireguard as of late and I'm impressed. We had some significant speed gains in all platforms of services with the cha cha cryptography. Setup is extremely easy, below I've included a small setup where I have three locations using wireguard;
- This is file /etc/hostname.wg0
- Poughkeepsie
wgpeer asdasdasdasdasdasdasdasdasE= wgaip $(cat /etc/routept) wgendpoint 10.0.2.2 600
- elmira
wgpeer QcyFJK3YgM/jV/X/asdasdasdasdxczxczxczxczo= wgaip $(cat /etc/routeelmira) wgendpoint 10.0.3.2 600
- uticaga
wgpeer N8SS55iuyioiuyoiuyoiuyoiuyoiuyoyiuoyu3CBOhE= wgaip $(cat /etc/routeutga) wgendpoint 10.0.4.2 600
- shop
wgpeer TwyNwYY4AVy3243543532452435432zIhFxjk9PrKIr04tUU4= wgaip $(cat /etc/routeshp2) wgendpoint 10.0.5.2 600
- Main config (your router config)
10.0.11.13 255.255.255.0
wgkey OOfSxdOjUzftm8FYwjc3tGnvjtXCj8QpPfaON6f8Rns=
wgport 700
up
This router can accept traffic from all of those offices. Of course you need to make sure that IP traffic is allowed so if you take note "routept" would look like the below; This ensures that traffic is routable and also makes sure other up traffic can't snoop.
10.0.9.0/24 wgaip 10.1.9.0/24
The branch office config would look as follows
- This is file /etc/hostname.wg0
10.0.4.254 255.255.255.0 wgkey +K4q9asdasdasdasdasdasKRy0YrIJcxnYW1E= wgpeer v6udCue+7asdasdasdasdasdasdasdasdasdaasdd6CKC0= wgaip $(cat /etc/routesfile) wgendpoint 24.213.203.67 700 wgport 600 up
In my route file, since I have several network I have the below; You could certainly do this by masks but I would like strict filtering in my case;
- This is file /etc/routesfile
10.0.1.0/24 wgaip 10.0.2.0/24 wgaip 10.0.3.0/24 wgaip 10.0.4.0/24 wgaip 10.0.5.0/24 wgaip 10.0.6.0/24 wgaip 10.0.7.0/24 wgaip 10.0.8.0/24 wgaip 10.0.10.0/24 wgaip 10.0.11.0/24 wgaip 10.0.12.0/24 wgaip 10.0.13.0/24 wgaip 10.0.14.0/24 wgaip 10.0.15.0/24 wgaip 10.0.16.0/24 wgaip 10.0.17.0/24 wgaip 10.7.0.0/24
wgaip 10.1.1.0/24 wgaip 10.1.2.0/24 wgaip 10.1.3.0/24 wgaip 10.1.4.0/24 wgaip 10.1.5.0/24 wgaip 10.1.6.0/24 wgaip 10.1.7.0/24 wgaip 10.1.8.0/24 wgaip 10.1.10.0/24 wgaip 10.1.11.0/24 wgaip 10.1.12.0/24 wgaip 10.1.13.0/24 wgaip 10.1.14.0/24 wgaip 10.1.15.0/24 wgaip 10.1.16.0/24
Some of these networks don't exist yet but are added for future reference.