1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
#########
Wireguard
#########
| Testdate: 2022-10-09
| Version: 1.4-rolling-202210090955
This simple structure show how to connect two offices. One remote branch and the
central office.
********
Topology
********
The topology have a central and a branch VyOS router and one client, to
test, in each site.
.. image:: _include/topology.png
:alt: Ansible Example topology image
*************
Configuration
*************
Set the local subnet on eth2 and the public ip address eth1 on each site.
Central
.. literalinclude:: _include/central.conf
:language: none
:lines: 1-2
Branch
.. literalinclude:: _include/branch.conf
:language: none
:lines: 1-2
Next thing to do, is to create a wireguard keypair on each side.
After this, the public key can be displayed, to save for later.
.. code-block:: none
vyos@central:~$ generate pki wireguard
Private key: IAxN76wdmZ6Y0nGzuNSIdSseFELWgAyBsRK0AEyHTV0=
Public key: g9APk9Pv7EHv0METuXaAguYtoGnn5eSirjZWSKyaT3c=
After you have each public key. The wireguard interfaces can be setup.
Central
.. literalinclude:: _include/central.conf
:language: none
:lines: 4-12
Branch
.. literalinclude:: _include/branch.conf
:language: none
:lines: 4-12
To reach the network, a route must be set on each VyOS host.
In this structure, a static interface route will fit the requirements.
Central
.. literalinclude:: _include/central.conf
:language: none
:lines: 14
Branch
.. literalinclude:: _include/branch.conf
:language: none
:lines: 14
*********************
Testing and debugging
*********************
After all is done and commit, let's take a look if the Wireguard interface is
up and running.
.. code-block:: none
vyos@central:~$ show interfaces wireguard
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
wg01 192.168.0.1/24 u/u VPN-to-Branch
And ping the Branch PC from your central router to check the response.
.. code-block:: none
vyos@central:~$ ping 10.0.2.100 count 4
PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data.
64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.594 ms
64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.837 ms
64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.768 ms
64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=1.30 ms
--- 10.0.2.100 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3102ms
rtt min/avg/max/mdev = 0.594/0.873/1.296/0.259 ms
|
