Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add VPN/WG support to Virtual Router #68

Closed
tinova opened this issue Mar 4, 2024 · 1 comment
Closed

Add VPN/WG support to Virtual Router #68

tinova opened this issue Mar 4, 2024 · 1 comment
Assignees
@vichansson
Labels
category: virtual router Virtual Router appliance
Milestone
Release 6.10.0

Comments

@tinova
Copy link
Member

tinova commented Mar 4, 2024

No description provided.

@tinova tinova added this to the Release 7.0 milestone Mar 4, 2024
@tinova tinova added the category: virtual router Virtual Router appliance label Mar 4, 2024
sk4zuzu added a commit that referenced this issue Mar 28, 2024
@sk4zuzu
F #68: Add VR/WG support
7974a0c 
- Add onewg VPN admin tool
- Add Service::WireGuard feature to VR
- Adjust Service::Failover accordingly
sk4zuzu added a commit that referenced this issue Mar 28, 2024
@sk4zuzu
F #68: Add VR/WG support
05ff62a 
- Add onewg VPN admin tool
- Add Service::WireGuard feature to VR
- Adjust Service::Failover accordingly
- Add basic JSON schema validation
sk4zuzu added a commit that referenced this issue Mar 29, 2024
@sk4zuzu
F #68: Add VR/WG support
44a9df3 
- Add onewg VPN admin tool
- Add Service::WireGuard feature to VR
- Adjust Service::Failover accordingly
- Add basic JSON schema validation
sk4zuzu added a commit that referenced this issue Mar 29, 2024
@sk4zuzu
F #68: Add VR/WG support
a23b7ce 
- Add onewg VPN admin tool
- Add Service::WireGuard feature to VR
- Adjust Service::Failover accordingly
- Add basic JSON schema validation
sk4zuzu added a commit that referenced this issue Mar 29, 2024
@sk4zuzu
F #68: Add VR/WG support
2c6838f 
- Add onewg VPN admin tool
- Add Service::WireGuard feature to VR
- Adjust Service::Failover accordingly
- Add basic JSON schema validation
@rsmontero rsmontero modified the milestones: Release 7.0, Release 6.10.0 Apr 19, 2024
@rsmontero rsmontero self-assigned this Apr 23, 2024
rsmontero added a commit that referenced this issue May 5, 2024
@rsmontero
F #68: Generate configuration files from configure action
98bae06
rsmontero added a commit that referenced this issue May 6, 2024
@rsmontero
F #68: Manage multiple instances and reboots
0a1d6bd 
Configuration (server-side) is stored in virtual router VMs using:

- ONEAPP_VNF_WG_SERVER wg0.conf file base64 encoded
- ONEAPP_VNF_WG_SERVER_TIMESTAMP when file was generated

Virtual router will reuse this configuration if present in any of the
virtual router VMs.

State is managed through onegate, thus required to run the WG service
rsmontero added a commit that referenced this issue May 8, 2024
@rsmontero @sk4zuzu
F #68: Add VR/WG support
f253949 
WG support allows you to setup a VPN with one of the "internal" subnets
attached to the VR.

Configuration
-------------
Sample configuration minimal (with 5 peers):

CONTEXT = [
   ...
    ONEAPP_VNF_WG_ENABLED       = "YES",
    ONEAPP_VNF_WG_INTERFACE_OUT = "eth0",
    ONEAPP_VNF_WG_INTERFACE_IN  = "eth1",
   ...
]

Configuration parameters:
 - ONEAPP_VNF_WG_ENABLED. Enables the service
 - ONEAPP_VNF_WG_INTERFACE_OUT. The NIC to connect clients, its IP will be the service endpoint (MANDATORY)
 - ONEAPP_VNF_WG_INTERFACE_IN. The NIC to connect to the private subnet (MANDATORY)
 - ONEAPP_VNF_WG_LISTEN_PORT. Listen port number, defaults to 51820
 - ONEAPP_VNF_WG_DEVICE. WG device name, defaults to wg0
 - ONEAPP_VNF_WG_PEERS. Number of peers, it will generate peer configuration and associated keys
 - ONEAPP_VNF_WG_SUBNET. Subnet used to interconnect WG peers these address should not be part of an OpenNebula virtual network. Defaults to '169.254.33.0/24'

Once the VR is running peer configuratio is stored in the VM USER
TEMPLATE as:

- ONEAPP_VNF_WG_SERVER for the WG server (VR)
- ONEAPP_VNF_WG_PEER<number>, e.g. ONEAPP_VNF_WG_PEER0

The information is base64 encoded.

Requirements
------------
- onegate is needed to publish the peers configuration
- peer subnet should not collide with the OpenNebula Vnet address
  ranges. The provided default should be safe for most cases.
- can run in standalone mode (i.e. as a VM) or as a full virtual router

Internal
--------
- A onewg tool is included to manage configurations. Not used by current
  implementation
- Add Service::WireGuard feature to VR
- Adjust Service::Failover accordingly
- New method to get subnet addresses by nic

co-authored-by: Michal Opala <mopala@opennebula.io>
rsmontero added a commit that referenced this issue May 9, 2024
@rsmontero
F #68: Rename dynamic variables generated by VRouter
85b9bd6 
ONEAPP_VNF_WG_PEERx            -> ONEGATE_VNF_WG_PEERx
ONEAPP_VNF_WG_SERVER_TIMESTAMP -> ONEGATE_VNF_WG_SERVER_TIMESTAMP
ONEAPP_VNF_WG_SERVER           -> ONEGATE_VNF_WG_SERVER

This follows the convention used in other apps, so ONEAPP_* are set by the user
in context, and ONEGATE_* are dynamic generated by the apps.

This commits also removes onewg tool
@rsmontero rsmontero reopened this May 9, 2024
@rsmontero rsmontero reopened this May 13, 2024
Aletibazo pushed a commit to Aletibazo/one-apps that referenced this issue May 16, 2024
@rsmontero @sk4zuzu @Aletibazo
F OpenNebula#68: Add VR/WG support
4ae3b2e 
WG support allows you to setup a VPN with one of the "internal" subnets
attached to the VR.

Configuration
-------------
Sample configuration minimal (with 5 peers):

CONTEXT = [
   ...
    ONEAPP_VNF_WG_ENABLED       = "YES",
    ONEAPP_VNF_WG_INTERFACE_OUT = "eth0",
    ONEAPP_VNF_WG_INTERFACE_IN  = "eth1",
   ...
]

Configuration parameters:
 - ONEAPP_VNF_WG_ENABLED. Enables the service
 - ONEAPP_VNF_WG_INTERFACE_OUT. The NIC to connect clients, its IP will be the service endpoint (MANDATORY)
 - ONEAPP_VNF_WG_INTERFACE_IN. The NIC to connect to the private subnet (MANDATORY)
 - ONEAPP_VNF_WG_LISTEN_PORT. Listen port number, defaults to 51820
 - ONEAPP_VNF_WG_DEVICE. WG device name, defaults to wg0
 - ONEAPP_VNF_WG_PEERS. Number of peers, it will generate peer configuration and associated keys
 - ONEAPP_VNF_WG_SUBNET. Subnet used to interconnect WG peers these address should not be part of an OpenNebula virtual network. Defaults to '169.254.33.0/24'

Once the VR is running peer configuratio is stored in the VM USER
TEMPLATE as:

- ONEAPP_VNF_WG_SERVER for the WG server (VR)
- ONEAPP_VNF_WG_PEER<number>, e.g. ONEAPP_VNF_WG_PEER0

The information is base64 encoded.

Requirements
------------
- onegate is needed to publish the peers configuration
- peer subnet should not collide with the OpenNebula Vnet address
  ranges. The provided default should be safe for most cases.
- can run in standalone mode (i.e. as a VM) or as a full virtual router

Internal
--------
- A onewg tool is included to manage configurations. Not used by current
  implementation
- Add Service::WireGuard feature to VR
- Adjust Service::Failover accordingly
- New method to get subnet addresses by nic

co-authored-by: Michal Opala <mopala@opennebula.io>
Aletibazo pushed a commit to Aletibazo/one-apps that referenced this issue May 16, 2024
@rsmontero @Aletibazo
F OpenNebula#68: Rename dynamic variables generated by VRouter
5f6f45a 
ONEAPP_VNF_WG_PEERx            -> ONEGATE_VNF_WG_PEERx
ONEAPP_VNF_WG_SERVER_TIMESTAMP -> ONEGATE_VNF_WG_SERVER_TIMESTAMP
ONEAPP_VNF_WG_SERVER           -> ONEGATE_VNF_WG_SERVER

This follows the convention used in other apps, so ONEAPP_* are set by the user
in context, and ONEGATE_* are dynamic generated by the apps.

This commits also removes onewg tool
@rsmontero rsmontero reopened this Jun 18, 2024
@tinova
Copy link
Member Author

tinova commented Jun 18, 2024

closing, will improve the UX in a more general approach here OpenNebula/one#6618

@tinova tinova closed this as completed Jun 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vichansson vichansson

Labels
category: virtual router Virtual Router appliance
Projects
None yet
Milestone
Release 6.10.0
Development

No branches or pull requests
4 participants
@tinova @rsmontero @sk4zuzu @vichansson