Re: Wireguard

[Maxime Devos]

crodges schreef op zo 29-08-2021 om 14:53 [-0700]:
> Hello everyone,
> 
> Let me start thanking you for developing such a interesting project in GNU 
> Guix. Also, I don't want to take up anyone's time, so you can just point to 
> documentation or other resource succinctly and I'll do my best. I'm writing 
> here because I tried the help list but not answer so far, after a few days.
> 
> I managed to configure wireguard on a vps running guix and created clients 
> for 
> my desktop and cellphone. What I want to do (and did already in a Debian vps) 
> is to make wireguard's lan accessible to anyone connected and also browse the 
> internet using this vpn.

The Wireguard service as defined in Guix System doesn't currently support the
forwarding you appear to describe ...

> As I remember, I need to allow ip forwarding using
> 
> sysctl net.ipv4.ip_forward=1
> 
> and I also need to put these rules into wireguard (the server) under 
> [interface],
> 
> PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING 
> -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t 
> nat 
> -A POSTROUTING -o eth0 -j MASQUERADE
> 
> PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D 
> POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; 
> ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

However, I don't see why this couldn't be implemented in Guix System
(after some changes to wireguard-service-type).

> Problem is, looking at the latest guix manual, PostUp and PostDown doesn't 
> seem to exist yet. Do they exist but are still undocumented?

Guix uses "wg-quick", so it would seem they do exist, but are inaccessible
from Guix.  The configuration file is created in wireguard-configuration-file
(in gnu/services/vpn.scm), maybe you can modify that.

> If they don't exist, where should be a reasonable place to add this 
> configurations?

<wireguard-configuration> and wireguard-configuration-file in (gnu services vpn)
it would seem.  Also, sysctl-service-type would need to be extended (in
the ‘service-extension’ meaning of the word) to set net.ipv4.ip_forward
appropriately.

> I'm trying to do everything the guix way, when I finish this 
> machine configuration, I'd like it to be fully replicable.
> 
> Also, is this something that I could solve modifying the wireguard service 
> definition itself?

If replicability is all you need, you could add ‘postdown’ and ‘postup’
options to <wireguard-configuration>, which would need to be set to the
commands above.  However, these strings seem rather complicated for the
uninitiated, so I'd recommend something more high-level instead.  Some
interface like

  (wireguard-configuration
    [...]
    (addresses ...)
    (peers ...)
    (forward? #t))

perhaps?  Make sure to add some documentation to ‘Wireguard’ in (guix)VPN 
Services.
(Maybe add some example situations on how forward? can be used and how it 
functions.)

I want to note that I don't understand what exactly you're doing, I only 
understand
that there is some forwarding going on, and I'm not unfamiliar with networking 
issue
(e.g. I recently figured out why I couldn't connect to the Internet with the
ISP-provided ‘4G minimodem’ -- DNS was b0rken).  So explaining forward? to 
laypeople
might take some care.

Writing a corresponding ‘system test’ in gnu/tests/networking.scm is 
recommended.

Greetings,
Maxime.

signature.asc
Description: This is a digitally signed message part