Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

system configuration/wireguard: suggest using NetworkManager #653

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

jbtrystram
Copy link
Contributor

Show how to set up wireguard with networkManager on FCOS. The wg-quick approach had selinux issues for a while now.

coreos/fedora-coreos-tracker#1487 (comment) prompted this update.

Show how to set up wireguard with networkManager on FCOS.
The wg-quick approach had selinux issues for a while now.

coreos/fedora-coreos-tracker#1487 (comment)
prompted this update.
@jbtrystram jbtrystram requested a review from travier July 15, 2024 10:34
Copy link
Member

@travier travier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mostly LGTM. Some nits. Maybe let's keep the "existing" wg-quick path as a second section at the bottom of this page?

@@ -12,10 +11,15 @@ https://www.wireguard.com/[WireGuard] is a novel VPN that runs inside the Linux

FCOS has full support for WireGuard out of the box. This guide is going to demonstrate how to set up a single connection between a FCOS server and one client computer. It goes over the basic client configuration, but it does not cover installing WireGuard on your clients.

There are several ways to set up wireguard on linux, here we suggest importing the wireguard configuration in NetworkManager.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
There are several ways to set up wireguard on linux, here we suggest importing the wireguard configuration in NetworkManager.
There are several ways to set up Wireguard on FCOS. Here we suggest importing the Wireguard configuration in NetworkManager.

@@ -12,10 +11,15 @@ https://www.wireguard.com/[WireGuard] is a novel VPN that runs inside the Linux

FCOS has full support for WireGuard out of the box. This guide is going to demonstrate how to set up a single connection between a FCOS server and one client computer. It goes over the basic client configuration, but it does not cover installing WireGuard on your clients.

There are several ways to set up wireguard on linux, here we suggest importing the wireguard configuration in NetworkManager.
Another popular approach is to use [wg-quick](https://www.man7.org/linux/man-pages/man8/wg-quick.8.html) (also included in fcos but have had [SELinux isues](https://github.com/coreos/fedora-coreos-tracker/issues/1487))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Another popular approach is to use [wg-quick](https://www.man7.org/linux/man-pages/man8/wg-quick.8.html) (also included in fcos but have had [SELinux isues](https://github.com/coreos/fedora-coreos-tracker/issues/1487))
Another popular approach is to use [wg-quick](https://www.man7.org/linux/man-pages/man8/wg-quick.8.html) (also included in FCOS but currently has [issues with SELinux](https://github.com/coreos/fedora-coreos-tracker/issues/1487))

@@ -12,10 +11,15 @@ https://www.wireguard.com/[WireGuard] is a novel VPN that runs inside the Linux

FCOS has full support for WireGuard out of the box. This guide is going to demonstrate how to set up a single connection between a FCOS server and one client computer. It goes over the basic client configuration, but it does not cover installing WireGuard on your clients.

There are several ways to set up wireguard on linux, here we suggest importing the wireguard configuration in NetworkManager.
Another popular approach is to use [wg-quick](https://www.man7.org/linux/man-pages/man8/wg-quick.8.html) (also included in fcos but have had [SELinux isues](https://github.com/coreos/fedora-coreos-tracker/issues/1487))

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

----

Note that we setup a oneshot unit to import the configuration in NetworkManager.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

Comment on lines -86 to +103
[core@wireguard-demo ~]$ sudo wg show
[root@wireguard-demo ~]# wg show
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any specific reason behind this change?

@@ -71,19 +75,32 @@ storage:
[Peer]
PublicKey = <client_one_public_key>
PresharedKey = <fcos_client_one_psk>
AllowedIPs = 192.168.71.0/24,fdc9:3c6b:21c7:e6bd::/64
AllowedIPs = 192.168.71.2/32,fdc9:3c6b:21c7:e6bd::2/128
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hum, this is stricter than what we have now. Any specific reason?

@@ -103,7 +120,15 @@ peer: <client_one_public_key>
valid_lft forever preferred_lft forever
----

NOTE: <Client IP address> above is the IP or FQDN of the Client computer.

NOTE: If you need to make further changes to update wireguard configuration, simply delete the connection then re-import the updated file.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
NOTE: If you need to make further changes to update wireguard configuration, simply delete the connection then re-import the updated file.
NOTE: If you need to make further changes to update Wireguard's configuration, then delete the connection and re-import it from an updated configuration file.

@@ -103,7 +120,15 @@ peer: <client_one_public_key>
valid_lft forever preferred_lft forever
----

NOTE: <Client IP address> above is the IP or FQDN of the Client computer.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any specific reason this line is removed?

@travier
Copy link
Member

travier commented Jul 15, 2024

and thanks for working on this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants