diff options
| m--------- | docs/_include/vyos-1x | 0 | ||||
| -rw-r--r-- | docs/_static/images/wireguard_qrcode.jpg | bin | 0 -> 133939 bytes | |||
| -rw-r--r-- | docs/changelog/1.3.rst | 41 | ||||
| -rw-r--r-- | docs/changelog/1.4.rst | 73 | ||||
| -rw-r--r-- | docs/configexamples/wan-load-balancing.rst | 4 | ||||
| -rw-r--r-- | docs/configuration/interfaces/wireguard.rst | 160 | ||||
| -rw-r--r-- | docs/configuration/protocols/isis.rst | 10 | ||||
| -rw-r--r-- | docs/configuration/service/console-server.rst | 4 |
8 files changed, 227 insertions, 65 deletions
diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x -Subproject bfc8b264aae5b48247c28fc4d43d762f090c20d +Subproject b6301bfd6a6cb084671fd24970a4a06b10a89d9 diff --git a/docs/_static/images/wireguard_qrcode.jpg b/docs/_static/images/wireguard_qrcode.jpg Binary files differnew file mode 100644 index 00000000..0a9a98c0 --- /dev/null +++ b/docs/_static/images/wireguard_qrcode.jpg diff --git a/docs/changelog/1.3.rst b/docs/changelog/1.3.rst index 2bbca922..75973009 100644 --- a/docs/changelog/1.3.rst +++ b/docs/changelog/1.3.rst @@ -8,6 +8,45 @@ _ext/releasenotes.py +2021-04-25 +========== + +* :vytask:`T3468` (bug): Tunnel interfaces aren't suggested as being available for bridging (regression) +* :vytask:`T1802` (feature): Wireguard QR code in cli for mobile devices + + +2021-04-23 +========== + +* :vytask:`T3395` (bug): WAN load-balancing fails with nexthop dhcp +* :vytask:`T3290` (bug): Disabling GRE conntrack module fails + + +2021-04-18 +========== + +* :vytask:`T3481` (default): Exclude tag node values from key mangling +* :vytask:`T3475` (bug): XML dictionary cache unable to process syntaxVersion elements + + +2021-04-15 +========== + +* :vytask:`T3386` (bug): PPPoE-server don't start with local authentication + + +2021-04-14 +========== + +* :vytask:`T3055` (bug): op-mode incorrect naming fo ipsec policy-based tunnels + + +2021-04-12 +========== + +* :vytask:`T3454` (enhancment): dhclient reject option + + 2021-04-08 ========== @@ -224,7 +263,7 @@ 2021-02-16 ========== -* :vytask:`T3318` (feature): Update Linux Kernel to v5.4.111 / 5.10.29 +* :vytask:`T3318` (feature): Update Linux Kernel to v5.4.114 / 5.10.32 2021-02-14 diff --git a/docs/changelog/1.4.rst b/docs/changelog/1.4.rst index e8e21c86..0d0bf654 100644 --- a/docs/changelog/1.4.rst +++ b/docs/changelog/1.4.rst @@ -8,6 +8,77 @@ _ext/releasenotes.py +2021-04-25 +========== + +* :vytask:`T3490` (bug): priority inversion on PBR "policy route" create, breaks default route from dhcp (live iso) +* :vytask:`T3468` (bug): Tunnel interfaces aren't suggested as being available for bridging (regression) +* :vytask:`T3497` (bug): Prefix list with rule containing only action is not detected as error during parse +* :vytask:`T3492` (bug): BGP Configuration Migration failed (badly!) from rolling 202102240218 to rolling 202104221210 +* :vytask:`T1802` (feature): Wireguard QR code in cli for mobile devices + + +2021-04-24 +========== + +* :vytask:`T3472` (bug): commit-confirm script not found +* :vytask:`T3439` (bug): Commit-archive location not working for scp + + +2021-04-23 +========== + +* :vytask:`T3395` (bug): WAN load-balancing fails with nexthop dhcp +* :vytask:`T3290` (bug): Disabling GRE conntrack module fails + + +2021-04-20 +========== + +* :vytask:`T3488` (bug): Specifying an invalid "interface address" like dhcph leads to commit error + + +2021-04-18 +========== + +* :vytask:`T3481` (default): Exclude tag node values from key mangling +* :vytask:`T3475` (bug): XML dictionary cache unable to process syntaxVersion elements + + +2021-04-17 +========== + +* :vytask:`T3470` (bug): as-override isn't applied to frr + + +2021-04-15 +========== + +* :vytask:`T3386` (bug): PPPoE-server don't start with local authentication +* :vytask:`T3190` (feature): Unable to subtract value from local-preference in route-map + + +2021-04-14 +========== + +* :vytask:`T3398` (bug): Can't commit +* :vytask:`T3055` (bug): op-mode incorrect naming fo ipsec policy-based tunnels + + +2021-04-13 +========== + +* :vytask:`T3436` (feature): Refactoring ospf op-mode for support vrf +* :vytask:`T3434` (feature): Refactoring bgp op-mode for support vrf + + +2021-04-12 +========== + +* :vytask:`T3454` (enhancment): dhclient reject option +* :vytask:`T3328` (bug): Bgp not possible to delete bgp route-map + + 2021-04-11 ========== @@ -267,7 +338,7 @@ ========== * :vytask:`T3313` (bug): ospfv3 interface missing options -* :vytask:`T3318` (feature): Update Linux Kernel to v5.4.111 / 5.10.29 +* :vytask:`T3318` (feature): Update Linux Kernel to v5.4.114 / 5.10.32 2021-02-15 diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst index 07974166..f26f3ce6 100644 --- a/docs/configexamples/wan-load-balancing.rst +++ b/docs/configexamples/wan-load-balancing.rst @@ -19,7 +19,7 @@ The setup used in this example is shown in the following diagram: Overview ^^^^^^^^ - * All traffic coming in trough eth2 is balanced between eth0 and eth1 + * All traffic coming in through eth2 is balanced between eth0 and eth1 on the router. * Pings will be sent to four targets for health testing (33.44.55.66, 44.55.66.77, 55.66.77.88 and 66.77.88.99). @@ -171,4 +171,4 @@ eth+ is used as an alias that refers to all ethernet interfaces: set load-balancing wan rule 5 inbound-interface eth+ set load-balancing wan rule 5 destination address 10.0.0.0/8 -.. start_vyoslinter
\ No newline at end of file +.. start_vyoslinter diff --git a/docs/configuration/interfaces/wireguard.rst b/docs/configuration/interfaces/wireguard.rst index 0ceb0aa2..ddfbe620 100644 --- a/docs/configuration/interfaces/wireguard.rst +++ b/docs/configuration/interfaces/wireguard.rst @@ -1,5 +1,7 @@ .. _wireguard: +.. include:: /_include/need_improvement.txt + ######### WireGuard ######### @@ -8,15 +10,16 @@ WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. See https://www.wireguard.com for more information. +************* Configuration -============= +************* WireGuard requires the generation of a keypair, which includes a private key to decrypt incoming traffic, and a public key for peer(s) to encrypt traffic. -Generate keypair ----------------- +Generate Keypair +================ .. opcmd:: generate wireguard default-keypair @@ -35,23 +38,25 @@ Generate keypair hW17UxY7zeydJNPIyo3UtGnBHkzTK/NeBOrDSIU9Tx0= -Generate named keypair ----------------------- +Generate Named Keypair +====================== Named keypairs can be used on a interface basis when configured. If multiple WireGuard interfaces are being configured, each can have their own keypairs. -The commands below generates 2 keypairs unrelated to each other. +.. opcmd:: generate wireguard named-keypairs <name> -.. code-block:: none + The commands below generates 2 keypairs unrelated to each other. - vyos@vyos:~$ generate wireguard named-keypairs KP01 - vyos@vyos:~$ generate wireguard named-keypairs KP02 + .. code-block:: none + + vyos@vyos:~$ generate wireguard named-keypairs KP01 + vyos@vyos:~$ generate wireguard named-keypairs KP02 Interface configuration ------------------------ +======================= The next step is to configure your local side as well as the policy based trusted destination addresses. If you only initiate a connection, @@ -88,17 +93,17 @@ or allows the traffic. WireGuard peers. This a a design decission. For more information please check the `WireGuard mailing list`_. +.. cfgcmd:: set interfaces wireguard <interface> private-key <name> -To use a named key on an interface, the option private-key needs to be -set. + To use a named key on an interface, the option private-key needs to be + set. -.. code-block:: none + .. code-block:: none - set interfaces wireguard wg01 private-key KP01 - set interfaces wireguard wg02 private-key KP02 + set interfaces wireguard wg01 private-key KP01 -The command ``run show wireguard keypairs pubkey KP01`` will then show -the public key, which needs to be shared with the peer. + The command :opcmd:`show wireguard keypairs pubkey KP01` will then show the + public key, which needs to be shared with the peer. **remote side** @@ -169,7 +174,7 @@ the peers. This allows the peers to interact with one another. } peer iPhone { allowed-ips 10.172.24.20/32 - allowed-ips 2001:DB8:470:22::30/128 + allowed-ips 2001:DB8:470:22::20/128 persistent-keepalive 15 pubkey BknHcLFo8nOo8Dwq2CjaC/TedchKQ0ebxC7GYn7Al00= } @@ -210,56 +215,103 @@ to the server go over the connection. PersistentKeepalive = 25 -Operational commands -==================== +******************** +Operational Commands +******************** -**Show interface status** +Status +====== -.. code-block:: none +.. opcmd:: show interfaces wireguard + + Get a list of all wireguard interfaces + + .. code-block:: none - vyos@wg01# run show interfaces wireguard wg01 - interface: wg1 - description: VPN-to-wg01 - address: 10.2.0.1/24 - public key: RIbtUTCfgzNjnLNPQ/asldkfjhaERDFl2H/xUfbyjc= + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + wg0 10.0.0.1/24 u/u + + +.. opcmd:: show interfaces wireguard <interface> + + Show general information about specific WireGuard interface + + .. code-block:: none + + vyos@vyos:~$ show interfaces wireguard wg01 + interface: wg0 + address: 10.0.0.1/24 + public key: h1HkYlSuHdJN6Qv4Hz4bBzjGg5WUty+U1L7DJsZy1iE= private key: (hidden) - listening port: 53665 - peer: to-wg02 - public key: u41jO3OF73Gq1WARMMFG7tOfk7+r8o8AzPxJ1FZRhzk= - latest handshake: 0:01:20 - status: active - endpoint: 192.168.0.124:12345 - allowed ips: 10.2.0.0/24 - transfer: 42 GB received, 487 MB sent - persistent keepalive: every 15 seconds - RX: - bytes packets errors dropped overrun mcast - 45252407916 31192260 0 244493 0 0 - TX: - bytes packets errors dropped carrier collisions - 511649780 5129601 24465 0 0 0 - -**Show public key of the default key** + listening port: 41751 -.. code-block:: none + RX: bytes packets errors dropped overrun mcast + 0 0 0 0 0 0 + TX: bytes packets errors dropped carrier collisions + 0 0 0 0 0 0 - vyos@wg01# run show wireguard keypair pubkey default - FAXCPb6EbTlSH5200J5zTopt9AYXneBthAySPBLbZwM= +Encryption Keys +=============== -**Show public key of a named key** +.. opcmd:: show wireguard keypair pubkey <name> -.. code-block:: none + Show public key portion for specified key. This can be either the ``default`` + key, or any other named key-pair. - vyos@wg01# run show wireguard keypair pubkey KP01 - HUtsu198toEnm1poGoRTyqkUKfKUdyh54f45dtcahDM= + The ``default`` keypair + .. code-block:: none -**Delete wireguard keypairs** + vyos@vyos:~$ show wireguard keypair pubkey default + FAXCPb6EbTlSH5200J5zTopt9AYXneBthAySPBLbZwM= -.. code-block:: none + Name keypair ``KP01`` + + .. code-block:: none + + vyos@vyos:~$ show wireguard keypair pubkey KP01 + HUtsu198toEnm1poGoRTyqkUKfKUdyh54f45dtcahDM= + +.. opcmd:: delete wireguard keypair pubkey <name> + + Delete a keypair, this can be either the ``default`` key, or any other + named key-pair. + + .. code-block:: none + + vyos@vyos:~$ delete wireguard keypair default + + +Mobile "RoadWarrior" clients +============================ + +Some users tend to connect their mobile devices using WireGuard to their VyOS +router. To ease deployment one can generate a "per mobile" configuration from +the VyOS CLI. + +.. warning:: From a security perspective it is not recommended to let a third + party create the private key for a secured connection. You should create the + private portion on your own and only hand out the public key. Please keep this + in mind when using this convenience feature. + +.. opcmd:: generate wireguard client-config <name> interface <interface> server <ip|fqdn> address <client-ip> + + Using this command you will create a new client configuration which can + connect to ``interface`` on this router. The public key from the specified + interface is automatically extracted and embedded into the configuration. + + The command also generates a configuration snipped which can be copy/pasted + into the VyOS CLI if needed. The supplied ``<name>`` on the CLI will become + the peer name in the snippet. - vyos@wg01$ delete wireguard keypair default + In addition you will specifiy the IP address or FQDN for the client where it + will connect to. The address parameter can be used up to two times and is used + to assign the client its specific IPv4 (/32) or IPv6 (/128) address. + .. figure:: /_static/images/wireguard_qrcode.jpg + :alt: WireGuard Client QR code .. stop_vyoslinter diff --git a/docs/configuration/protocols/isis.rst b/docs/configuration/protocols/isis.rst index a38db6f2..416a42c3 100644 --- a/docs/configuration/protocols/isis.rst +++ b/docs/configuration/protocols/isis.rst @@ -280,9 +280,9 @@ interfaces. set policy route-map EXPORT-ISIS rule 10 action 'permit' set policy route-map EXPORT-ISIS rule 10 match ip address prefix-list 'EXPORT-ISIS' - set protocols isis FOO interface eth1 - set protocols isis FOO net '49.0001.1921.6800.1002.00' - set protocols isis FOO redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS' + set protocols isis interface eth1 + set protocols isis net '49.0001.1921.6800.1002.00' + set protocols isis redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS' **Node 2:** @@ -290,8 +290,8 @@ interfaces. set interfaces ethernet eth1 address '192.0.2.2/24' - set protocols isis FOO interface eth1 - set protocols isis FOO net '49.0001.1921.6800.2002.00' + set protocols isis interface eth1 + set protocols isis net '49.0001.1921.6800.2002.00' Show ip routes on Node2: diff --git a/docs/configuration/service/console-server.rst b/docs/configuration/service/console-server.rst index a509723e..dd2f5032 100644 --- a/docs/configuration/service/console-server.rst +++ b/docs/configuration/service/console-server.rst @@ -89,13 +89,13 @@ Operation usb0b2.4p1.0 up vyos@localhost -.. opcmd:: connect console-server <device> +.. opcmd:: connect console <device> Locally connect to serial port identified by `<device>`. .. code-block:: none - vyos@vyos-r1:~$ connect console-server usb0b2.4p1.0 + vyos@vyos-r1:~$ connect console usb0b2.4p1.0 [Enter `^Ec?' for help] [-- MOTD -- VyOS Console Server] |
