Re:Wg-access-server: An all-in-one WireGuard VPN solution wi...
by 3np on Saturday October 02, 2021 @01:49AM
(#28726289)
Two things I learned that were game-changers in setting up and managing Wireguard on Linux:
* The semantics and behavior of AllowedIPs. In itself, it means what IPs are allowed to be routed through the tunnel (that is, IPs "on the other end"). wg-quick will, additionally, add routes to these, but that's not part of Wireguard itself.
* systemd-networkd has native support for Wireguard netdevs and networks. It's pretty easy to set up and makes it a lot more flexible; it won't add routes to AllowedIPs like wg-quick but you can define the routes (and routing policies and tables) you want in the same file. [0]
As much flak as systemd gets, systemd-networkd has by far been the most sane way for me to manage networking on Linux, and I tried most.
I'd also like to take the opportunity to recommend nftables instead of iptables. Unless you already have good reasons to prefer iptables, nftables is so much easier to learn and manage.
Oh, and ufw gets ugly real fast. Managing it through ansible or similar is a real mess. firewalld is a lot more predictable IMO. Its routing story is not perfect but it's the best I found so far and can be complemented with ip and manual nftables rules[2].
* The semantics and behavior of AllowedIPs. In itself, it means what IPs are allowed to be routed through the tunnel (that is, IPs "on the other end"). wg-quick will, additionally, add routes to these, but that's not part of Wireguard itself.
* systemd-networkd has native support for Wireguard netdevs and networks. It's pretty easy to set up and makes it a lot more flexible; it won't add routes to AllowedIPs like wg-quick but you can define the routes (and routing policies and tables) you want in the same file. [0]
As much flak as systemd gets, systemd-networkd has by far been the most sane way for me to manage networking on Linux, and I tried most.
I'd also like to take the opportunity to recommend nftables instead of iptables. Unless you already have good reasons to prefer iptables, nftables is so much easier to learn and manage.
Oh, and ufw gets ugly real fast. Managing it through ansible or similar is a real mess. firewalld is a lot more predictable IMO. Its routing story is not perfect but it's the best I found so far and can be complemented with ip and manual nftables rules[2].
[0]: https://manpages.debian.org/buster/systemd/systemd.netdev.5....
[1]: https://wiki.archlinux.org/title/WireGuard#systemd-networkd
[2]: https://serverfault.com/a/1046246