• A different device from your home server?
  • On the same home server as the services but directly on the host?
  • On the same home server as the services but inside some VM or container?

Do you configure it manually or do you use some helper/interface like WGEasy?

I have been personally using wgeasy but recently started locking down and hardening my containers and this node app running as root is kinda…

  • cmnybo@discuss.tchncs.deEnglish
    2·
    3 hours ago

    I run one on my firewall, but it’s IPv6 only because of CGNAT. The other one is running on a VPS in case I need IPv4 access. I just configured them manually.

  • i_am_not_a_robot@discuss.tchncs.deEnglish
    3·
    4 hours ago

    Wireguard normally runs with higher than root privileges as part of the kernel, outside of any container namespaces. If you’re running some sort of Wireguard administration service you might be able to restrict its capabilities, but that isn’t Wireguard. Most of my devices are running Wireguard managed by tailscaled running as root, and some are running additional, fixed Wireguard tunnels without a persistent management service.

  • brewery@feddit.ukEnglish
    5·
    5 hours ago

    I have a vps (hetzner dedicated server auction) as well as my home servers. The vps has a fixed IP so ive setup wireguard endpoints to all point to it with forwarding on so can access every device indirectly through the vps. It allows them to work across DDNS or remotely.

    I used this guide (https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-ubuntu-20-04). Tried different tools gui’s and other methods but always came back to this to work the best

    • dan@upvote.auEnglish
      22·
      2 hours ago

      There’s no such thing as a client or server with Wireguard. All systems with Wireguard installed are “nodes”. Wireguard is peer-to-peer, not client-server.

      You can configure nftables rules to route through a particular node, but that doesn’t really make it a server. You could configure all nodes to allow routing traffic through them if you wanted to.

      If you run Wireguard on every device, you can configure a mesh VPN, where every device can directly reach any other device, without needing to route through an intermediary node. This is essentially what Tailscale does.

      • just_another_person@lemmy.worldEnglish
        2·
        2 hours ago

        Uhhh, nooooo. Why are all these new kids all in these threads saying this crazy uninformed stuff lately? 🤣

        https://www.wireguard.com/protocol/ https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_and_managing_networking/setting-up-a-wireguard-vpn

        And, in fact, for those of us that have been doing this a long time, anything with a control point or protocol always refers to said control point as the server in a PTP connection sense.

        In this case, a centralized VPN routing node that connects like a Hub and Spoke is the server. Everything else is a client of that server because they can’t independently do much else in this configuration.

        • dan@upvote.auEnglish
          11·
          2 hours ago

          Both of those documents agree with me? RedHat are just using the terms “client” and “server” to make it easier for people to understand, but they explicitly say that all hosts are “peers”.

          Note that all hosts that participate in a WireGuard VPN are peers. This documentation uses the terms client to describe hosts that establish a connection and server to describe the host with the fixed hostname or IP address that the clients connect to and, optionally, route all traffic through this server.

          –

          Everything else is a client of that server because they can’t independently do much else in this configuration.

          All you need to do is add an extra peer to the WireGuard config on any one of the “clients”, and it’s no longer just a client, and can connect directly to that peer without using the “server”.

          • just_another_person@lemmy.worldEnglish
            2·
            1 hour ago

            They do no such thing.

            The first link explains the protocol.

            The second explains WHY one would refer to client and server with regards to Wireguard.

            My point ties both together to explain why people would use client and server with regards to the protocol itself, and a common configuration where this would be necessary for clarification. Ties both of them together, and makes my point from my original comment, which also refers to OP’s comment.

            I’m not digging you, just illustrating a correction so you’re not running around misinformed.

            It wasn’t clear where OP was trying to make a point, just that the same host would be running running Wireguard for some reason, which one would assume means virtualization of some sort, meaning the host machine is the primary hub/server.

    • ferret@sh.itjust.worksEnglish
      1·
      4 hours ago

      You are, second point means running WG on say, a proxmox root, and using it to access the containers.

      • just_another_person@lemmy.worldEnglish
        2·
        4 hours ago

        Uhhhh…that is…not how you do that. Especially if you’re describing routing out from a container to an edge device and back into your host machine instead of using bridged network or another virtual router on the host.

        Like if you absolutely had to have a segmented network between hosts a la datacenter/cloud, you’d still create a virtual fabric or SDLAN/WAN to connect them, and that’s like going WAY out of your way.

        Wireguard for this purpose makes even less sense.

  • jol@discuss.tchncs.deEnglish
    1·
    4 hours ago

    On the home server on the host. I couldn’t figure out how to make it work in a container and still have ssh access to the host, which was my goal…