insdavm

WireGuard over TCP with udptunnel

udptunnel is a small program which can tunnel UDP packets bi-directionally over a TCP connection. Its primary purpose (and original motivation) is to allow multi-media conferences to traverse a firewall which allows only outgoing TCP connections.

Server

# udptunnel -s 443 127.0.0.1/51820

Client

insdavm

/u/c5cf2ee6-1901-40a9

• Tunnel Subnet 10.7.0.0/24
• Host C Public IP 66.10.10.1 (just for the example)
• Host A - 10.7.0.2
• Host B - 10.7.0.3
• Host C - 10.7.0.1

Host A wg0.conf

insdavm

# SERVER wg0.conf
[Interface]
PrivateKey = <PRIVKEY of SERVER>
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <PUBKEY of CLIENT 1>
AllowedIPs = 10.0.0.2/32

insdavm

WireGuard Site-to-Site

Accessing a subnet that is behind a WireGuard client using a site-to-site setup

Problem Summary

We want to access a local subnet remotely, but it is behind a NAT firewall and we can't setup port forwarding. Outgoing connections work, but all incoming connections get DROPPED by the ISP's routing policy.

Solution Summary

insdavm

Unbound

Install
$ sudo apt install unbound unbound-host

Get latest list of root DNS servers
$ curl -o /var/lib/unbound/root.hints https://www.internic.net/domain/named.cache

Setup /etc/unbound/unbound.conf:

insdavm

[Interface]
Address = 10.8.1.1
PrivateKey = <SERVER-PRIVATE-KEY>
ListenPort = 51820

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = <CLIENT-1-PUBLIC-KEY>

insdavm

# Generated by iptables-save v1.8.2 on Mon Dec 24 10:42:19 2018
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [6:852]
:TCP - [0:0]
:UDP - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP

insdavm

# I have 4 workspaces arranged in a quad pattern...
#   [ 1 ][ 2 ]
#   [ 3 ][ 4 ]
# up/down/left/right moves to the next workspace:

gesture swipe up 3	xdotool key ctrl+alt+Down
gesture swipe down 3	xdotool key ctrl+alt+Up
gesture swipe left 3    xdotool key ctrl+alt+Left
gesture swipe right 3   xdotool key ctrl+alt+Right

insdavm

# file in /etc/netplan/01-netcfg.yaml
# spacing for indents just need to be consistent
network:
    version: 2
    renderer: networkd
    ethernets:
        enp2s0:
            addresses: []
            dhcp4: true

insdavm

MODULES=(ext4)
BINARIES=()
FILES=()
HOOKS=(base udev autodetect modconf block encrypt lvm2 filesystems keyboard fsck)


# Initial attempt, but had issues with unlocking the cryptlvm volume with this...
# But who the fuck wants a systemd-based initramfs anyway!? /s
#
# We can still use systemd-boot to use Apple's native bootloader and read the .efi