-
Notifications
You must be signed in to change notification settings - Fork 120
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
system configuration/wireguard: suggest using NetworkManager #653
base: main
Are you sure you want to change the base?
Conversation
Show how to set up wireguard with networkManager on FCOS. The wg-quick approach had selinux issues for a while now. coreos/fedora-coreos-tracker#1487 (comment) prompted this update.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mostly LGTM. Some nits. Maybe let's keep the "existing" wg-quick path as a second section at the bottom of this page?
@@ -12,10 +11,15 @@ https://www.wireguard.com/[WireGuard] is a novel VPN that runs inside the Linux | |||
|
|||
FCOS has full support for WireGuard out of the box. This guide is going to demonstrate how to set up a single connection between a FCOS server and one client computer. It goes over the basic client configuration, but it does not cover installing WireGuard on your clients. | |||
|
|||
There are several ways to set up wireguard on linux, here we suggest importing the wireguard configuration in NetworkManager. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There are several ways to set up wireguard on linux, here we suggest importing the wireguard configuration in NetworkManager. | |
There are several ways to set up Wireguard on FCOS. Here we suggest importing the Wireguard configuration in NetworkManager. |
@@ -12,10 +11,15 @@ https://www.wireguard.com/[WireGuard] is a novel VPN that runs inside the Linux | |||
|
|||
FCOS has full support for WireGuard out of the box. This guide is going to demonstrate how to set up a single connection between a FCOS server and one client computer. It goes over the basic client configuration, but it does not cover installing WireGuard on your clients. | |||
|
|||
There are several ways to set up wireguard on linux, here we suggest importing the wireguard configuration in NetworkManager. | |||
Another popular approach is to use [wg-quick](https://www.man7.org/linux/man-pages/man8/wg-quick.8.html) (also included in fcos but have had [SELinux isues](https://github.com/coreos/fedora-coreos-tracker/issues/1487)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Another popular approach is to use [wg-quick](https://www.man7.org/linux/man-pages/man8/wg-quick.8.html) (also included in fcos but have had [SELinux isues](https://github.com/coreos/fedora-coreos-tracker/issues/1487)) | |
Another popular approach is to use [wg-quick](https://www.man7.org/linux/man-pages/man8/wg-quick.8.html) (also included in FCOS but currently has [issues with SELinux](https://github.com/coreos/fedora-coreos-tracker/issues/1487)) |
@@ -12,10 +11,15 @@ https://www.wireguard.com/[WireGuard] is a novel VPN that runs inside the Linux | |||
|
|||
FCOS has full support for WireGuard out of the box. This guide is going to demonstrate how to set up a single connection between a FCOS server and one client computer. It goes over the basic client configuration, but it does not cover installing WireGuard on your clients. | |||
|
|||
There are several ways to set up wireguard on linux, here we suggest importing the wireguard configuration in NetworkManager. | |||
Another popular approach is to use [wg-quick](https://www.man7.org/linux/man-pages/man8/wg-quick.8.html) (also included in fcos but have had [SELinux isues](https://github.com/coreos/fedora-coreos-tracker/issues/1487)) | |||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
---- | ||
|
||
Note that we setup a oneshot unit to import the configuration in NetworkManager. | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[core@wireguard-demo ~]$ sudo wg show | ||
[root@wireguard-demo ~]# wg show |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Any specific reason behind this change?
@@ -71,19 +75,32 @@ storage: | |||
[Peer] | |||
PublicKey = <client_one_public_key> | |||
PresharedKey = <fcos_client_one_psk> | |||
AllowedIPs = 192.168.71.0/24,fdc9:3c6b:21c7:e6bd::/64 | |||
AllowedIPs = 192.168.71.2/32,fdc9:3c6b:21c7:e6bd::2/128 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hum, this is stricter than what we have now. Any specific reason?
@@ -103,7 +120,15 @@ peer: <client_one_public_key> | |||
valid_lft forever preferred_lft forever | |||
---- | |||
|
|||
NOTE: <Client IP address> above is the IP or FQDN of the Client computer. | |||
|
|||
NOTE: If you need to make further changes to update wireguard configuration, simply delete the connection then re-import the updated file. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
NOTE: If you need to make further changes to update wireguard configuration, simply delete the connection then re-import the updated file. | |
NOTE: If you need to make further changes to update Wireguard's configuration, then delete the connection and re-import it from an updated configuration file. |
@@ -103,7 +120,15 @@ peer: <client_one_public_key> | |||
valid_lft forever preferred_lft forever | |||
---- | |||
|
|||
NOTE: <Client IP address> above is the IP or FQDN of the Client computer. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Any specific reason this line is removed?
and thanks for working on this! |
Show how to set up wireguard with networkManager on FCOS. The wg-quick approach had selinux issues for a while now.
coreos/fedora-coreos-tracker#1487 (comment) prompted this update.