Fully opensource fullmesh wg solution \o/

@User thanks!

I have to ask, you're not Jason are you?

That's me yea

I saw some comment, btw, that you guys are going to start to investigate incorporating WireGuardNT

Two remarks on this: 1) I need to bug Matt about adding support to wgctrl for it (I see you guys are using wgctrl) 2) You'll have to decide whether you want to use the higher level "embeddable-dll-service" project, or the lower level wireguard-nt dll directly

Embeddable-dll-service is: https://git.zx2c4.com/wireguard-windows/about/embeddable-dll-service/README.md https://git.zx2c4.com/wireguard-windows/tree/embeddable-dll-service It handles setting addresses and firewalling and all that.

While wireguard-nt gives you basically just: https://git.zx2c4.com/wireguard-nt/tree/api/wireguard.h as an API which lets you make things like https://git.zx2c4.com/wireguard-nt/tree/example/example.c

Thanks for joining the server!

Yeah, as soon as we saw your WireGuard NT post, we knew we had to get that in as soon as possible

Cool

Ok, that is good to know. We were considering refactoring to lessen dependence on wgctrl since there are some limitations there

I'm not too sure about higher level vs lower level yet. We haven't done any Windows up to this point, so will need to investigate and see which will fit better with what we have.

On first glance it sounds like we'd want to do some refactoring and go with the embeddable service

Oh really? What issues have you seen with wgctrl?

I think it was more of just realizing it might be easier to call wg-quick rather than use wgctrl. We try to set node settings like they would be in a conf file, but there's no postup/postdown in wgctrl so need to set iptables directly. Then when we started setting up UDP hole punching we had to put in some workarounds to avoid bringing down/up the interface each time, and were thinking using something like wg sync would be easier.

we were also running into some problems generating duplicate AllowedIps and extra interfaces. These aren't really problems with wgctrl, just seems like we can do a lot more (and avoid more logic on our part) by using some built in wg/wg-quick stuff

Hmm

Well keep in mind wg-quick is just a bash script

And the sync you have in mind is really just

wg syncconf wg0 <(wg-quick strip wg0)

which is some pretty clumsy bash redirection stuff

If you're in the business of adding and removing hundreds of nodes adhoc, or in relation to potentially adversary controllable network events, you dont want to be forking a bash process everytime

That's true. We were thinking it would be better to rely more on conf files and wg-quick to minimize our own logic, but I'm guessing moving into Windows we'll end up needing to implement similar logic anyway for postup/postdown and setting interfaces, so maybe that's not the right move

Windows has postup/postdown

But the commands of course will be different and

You cant really do much with the windows commandline anyway, unless you want to shell out to powershell, in which case, just write a real program

If you have a dynamic environment, I'd say the best way to manage it would be to do it all from within Go, configuring Linux routes and iptables using the go netlink package, and configuring Windows routes and such using similar go packages

That's true. That's the current path we're on and are going into Windows with that plan in mind, but we were debating on whether or not to switch to wg-quick + conf files to make it more simple. It's good to have input from the man himself on which direction to take!

just found this project and it literally saved my day, mesh and side-to-side works great, wondering if netmaker can also do a regular VPN? The scenario would be like an external client connect to a node and all the client's traffic will be routed through one of the nodes, meaning when the client browsing https://ipconfig.me, it will show the nodes IP instead of the client's IP.

@User could you test with DNS = .... in your Clients Wireguarad Config on [Interface] And set allowed IPs on the client to 0.0.0.0/0 I tried that but not working. Don't know what is missing here. Traceroute stops at the node for me.

@victorious-optician-32228 I tested it before, set DNS to node or public DNS neither works.