diff options
Diffstat (limited to 'docs/configuration')
| -rw-r--r-- | docs/configuration/interfaces/wireguard.rst | 160 | ||||
| -rw-r--r-- | docs/configuration/protocols/isis.rst | 10 | ||||
| -rw-r--r-- | docs/configuration/service/console-server.rst | 4 |
3 files changed, 113 insertions, 61 deletions
diff --git a/docs/configuration/interfaces/wireguard.rst b/docs/configuration/interfaces/wireguard.rst index 0ceb0aa2..ddfbe620 100644 --- a/docs/configuration/interfaces/wireguard.rst +++ b/docs/configuration/interfaces/wireguard.rst @@ -1,5 +1,7 @@ .. _wireguard: +.. include:: /_include/need_improvement.txt + ######### WireGuard ######### @@ -8,15 +10,16 @@ WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. See https://www.wireguard.com for more information. +************* Configuration -============= +************* WireGuard requires the generation of a keypair, which includes a private key to decrypt incoming traffic, and a public key for peer(s) to encrypt traffic. -Generate keypair ----------------- +Generate Keypair +================ .. opcmd:: generate wireguard default-keypair @@ -35,23 +38,25 @@ Generate keypair hW17UxY7zeydJNPIyo3UtGnBHkzTK/NeBOrDSIU9Tx0= -Generate named keypair ----------------------- +Generate Named Keypair +====================== Named keypairs can be used on a interface basis when configured. If multiple WireGuard interfaces are being configured, each can have their own keypairs. -The commands below generates 2 keypairs unrelated to each other. +.. opcmd:: generate wireguard named-keypairs <name> -.. code-block:: none + The commands below generates 2 keypairs unrelated to each other. - vyos@vyos:~$ generate wireguard named-keypairs KP01 - vyos@vyos:~$ generate wireguard named-keypairs KP02 + .. code-block:: none + + vyos@vyos:~$ generate wireguard named-keypairs KP01 + vyos@vyos:~$ generate wireguard named-keypairs KP02 Interface configuration ------------------------ +======================= The next step is to configure your local side as well as the policy based trusted destination addresses. If you only initiate a connection, @@ -88,17 +93,17 @@ or allows the traffic. WireGuard peers. This a a design decission. For more information please check the `WireGuard mailing list`_. +.. cfgcmd:: set interfaces wireguard <interface> private-key <name> -To use a named key on an interface, the option private-key needs to be -set. + To use a named key on an interface, the option private-key needs to be + set. -.. code-block:: none + .. code-block:: none - set interfaces wireguard wg01 private-key KP01 - set interfaces wireguard wg02 private-key KP02 + set interfaces wireguard wg01 private-key KP01 -The command ``run show wireguard keypairs pubkey KP01`` will then show -the public key, which needs to be shared with the peer. + The command :opcmd:`show wireguard keypairs pubkey KP01` will then show the + public key, which needs to be shared with the peer. **remote side** @@ -169,7 +174,7 @@ the peers. This allows the peers to interact with one another. } peer iPhone { allowed-ips 10.172.24.20/32 - allowed-ips 2001:DB8:470:22::30/128 + allowed-ips 2001:DB8:470:22::20/128 persistent-keepalive 15 pubkey BknHcLFo8nOo8Dwq2CjaC/TedchKQ0ebxC7GYn7Al00= } @@ -210,56 +215,103 @@ to the server go over the connection. PersistentKeepalive = 25 -Operational commands -==================== +******************** +Operational Commands +******************** -**Show interface status** +Status +====== -.. code-block:: none +.. opcmd:: show interfaces wireguard + + Get a list of all wireguard interfaces + + .. code-block:: none - vyos@wg01# run show interfaces wireguard wg01 - interface: wg1 - description: VPN-to-wg01 - address: 10.2.0.1/24 - public key: RIbtUTCfgzNjnLNPQ/asldkfjhaERDFl2H/xUfbyjc= + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + wg0 10.0.0.1/24 u/u + + +.. opcmd:: show interfaces wireguard <interface> + + Show general information about specific WireGuard interface + + .. code-block:: none + + vyos@vyos:~$ show interfaces wireguard wg01 + interface: wg0 + address: 10.0.0.1/24 + public key: h1HkYlSuHdJN6Qv4Hz4bBzjGg5WUty+U1L7DJsZy1iE= private key: (hidden) - listening port: 53665 - peer: to-wg02 - public key: u41jO3OF73Gq1WARMMFG7tOfk7+r8o8AzPxJ1FZRhzk= - latest handshake: 0:01:20 - status: active - endpoint: 192.168.0.124:12345 - allowed ips: 10.2.0.0/24 - transfer: 42 GB received, 487 MB sent - persistent keepalive: every 15 seconds - RX: - bytes packets errors dropped overrun mcast - 45252407916 31192260 0 244493 0 0 - TX: - bytes packets errors dropped carrier collisions - 511649780 5129601 24465 0 0 0 - -**Show public key of the default key** + listening port: 41751 -.. code-block:: none + RX: bytes packets errors dropped overrun mcast + 0 0 0 0 0 0 + TX: bytes packets errors dropped carrier collisions + 0 0 0 0 0 0 - vyos@wg01# run show wireguard keypair pubkey default - FAXCPb6EbTlSH5200J5zTopt9AYXneBthAySPBLbZwM= +Encryption Keys +=============== -**Show public key of a named key** +.. opcmd:: show wireguard keypair pubkey <name> -.. code-block:: none + Show public key portion for specified key. This can be either the ``default`` + key, or any other named key-pair. - vyos@wg01# run show wireguard keypair pubkey KP01 - HUtsu198toEnm1poGoRTyqkUKfKUdyh54f45dtcahDM= + The ``default`` keypair + .. code-block:: none -**Delete wireguard keypairs** + vyos@vyos:~$ show wireguard keypair pubkey default + FAXCPb6EbTlSH5200J5zTopt9AYXneBthAySPBLbZwM= -.. code-block:: none + Name keypair ``KP01`` + + .. code-block:: none + + vyos@vyos:~$ show wireguard keypair pubkey KP01 + HUtsu198toEnm1poGoRTyqkUKfKUdyh54f45dtcahDM= + +.. opcmd:: delete wireguard keypair pubkey <name> + + Delete a keypair, this can be either the ``default`` key, or any other + named key-pair. + + .. code-block:: none + + vyos@vyos:~$ delete wireguard keypair default + + +Mobile "RoadWarrior" clients +============================ + +Some users tend to connect their mobile devices using WireGuard to their VyOS +router. To ease deployment one can generate a "per mobile" configuration from +the VyOS CLI. + +.. warning:: From a security perspective it is not recommended to let a third + party create the private key for a secured connection. You should create the + private portion on your own and only hand out the public key. Please keep this + in mind when using this convenience feature. + +.. opcmd:: generate wireguard client-config <name> interface <interface> server <ip|fqdn> address <client-ip> + + Using this command you will create a new client configuration which can + connect to ``interface`` on this router. The public key from the specified + interface is automatically extracted and embedded into the configuration. + + The command also generates a configuration snipped which can be copy/pasted + into the VyOS CLI if needed. The supplied ``<name>`` on the CLI will become + the peer name in the snippet. - vyos@wg01$ delete wireguard keypair default + In addition you will specifiy the IP address or FQDN for the client where it + will connect to. The address parameter can be used up to two times and is used + to assign the client its specific IPv4 (/32) or IPv6 (/128) address. + .. figure:: /_static/images/wireguard_qrcode.jpg + :alt: WireGuard Client QR code .. stop_vyoslinter diff --git a/docs/configuration/protocols/isis.rst b/docs/configuration/protocols/isis.rst index a38db6f2..416a42c3 100644 --- a/docs/configuration/protocols/isis.rst +++ b/docs/configuration/protocols/isis.rst @@ -280,9 +280,9 @@ interfaces. set policy route-map EXPORT-ISIS rule 10 action 'permit' set policy route-map EXPORT-ISIS rule 10 match ip address prefix-list 'EXPORT-ISIS' - set protocols isis FOO interface eth1 - set protocols isis FOO net '49.0001.1921.6800.1002.00' - set protocols isis FOO redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS' + set protocols isis interface eth1 + set protocols isis net '49.0001.1921.6800.1002.00' + set protocols isis redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS' **Node 2:** @@ -290,8 +290,8 @@ interfaces. set interfaces ethernet eth1 address '192.0.2.2/24' - set protocols isis FOO interface eth1 - set protocols isis FOO net '49.0001.1921.6800.2002.00' + set protocols isis interface eth1 + set protocols isis net '49.0001.1921.6800.2002.00' Show ip routes on Node2: diff --git a/docs/configuration/service/console-server.rst b/docs/configuration/service/console-server.rst index a509723e..dd2f5032 100644 --- a/docs/configuration/service/console-server.rst +++ b/docs/configuration/service/console-server.rst @@ -89,13 +89,13 @@ Operation usb0b2.4p1.0 up vyos@localhost -.. opcmd:: connect console-server <device> +.. opcmd:: connect console <device> Locally connect to serial port identified by `<device>`. .. code-block:: none - vyos@vyos-r1:~$ connect console-server usb0b2.4p1.0 + vyos@vyos-r1:~$ connect console usb0b2.4p1.0 [Enter `^Ec?' for help] [-- MOTD -- VyOS Console Server] |