wireguard #6

Supports: bionic xenial

Description

WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography.

Overview

This charm provides WireGuard. WireGuard describes itself as an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPSec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances. Initially released for the Linux kernel, it is now cross-platform and widely deployable. It is currently under heavy development, but already it might be regarded as the most secure, easiest to use, and simplest VPN solution in the industry.

Usage

This charm is in initial development and is not feature complete.

To deploy:

juju deploy cs:~pirate-charmers/wireguard

By default the charm sets up as a server, enabling routing of traffic. The device for the routing traffic defaults to eth0 and can be set with the configuration option 'forward-dev'.

The private address is set with the configuration option 'address' and must be unique. If two servers are deployed as peers one must have the address changed.

Peers are configured with the configuration option 'peers' and expects a base64 encoded string of a yaml configuration. To supply this in a bundle use the include-base64:// parameter to include the yaml file. To supply this via command line for a peers.yaml in the current directory: juju config wireguard peers="$(base64 ./peers.yaml)"

Known Limitations and Issues

This charm is under development, several other use cases/features are still under consideration. Merge requests are appreciated, some examples of current limitations include.

  • No wireguard relation for automatic configuration of two peers
  • Routing is either on or off, no option to limit or blacklist routes on the server
  • Functional testing is minimal

Contact Information

Upstream Project Information

Configuration

address
(string) Interface address
10.10.10.1/24
forward-dev
(string) Device to forward packets on
eth0
forward-ip
(boolean) Forward packets for clients
True
listen-port
(int) UDP port to listen for peers on
15820
peers
(string) base64 yaml file with peer options See include-base64:// Availabel options * allowedips - the allowed ip ranges for this peer * publickey - the public key * endpoint - peer ip and port X.X.X.X:PORT * persistentkeepalive - optional keep alive in seconds
private-key
(string) Specify rather than generating a private key, base64 encoded
proxy-via-hostname
(boolean) If true use fqdn with the reverse proxy, else use ip address