103 lines
2.2 KiB
Markdown
103 lines
2.2 KiB
Markdown
# WireGuard with UI
|
|
|
|
## K8s and unsafe option
|
|
|
|
Config file on k8s host
|
|
|
|
```shell
|
|
sudo nano /var/snap/microk8s/current/args/kubelet
|
|
```
|
|
|
|
add `ipv4` and `ipv6` to be added to the end of the `kubelet` file.
|
|
|
|
> --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding
|
|
|
|
## Changing IP
|
|
|
|
these are recommended, as we use 8.0.0.0/8 for other things...
|
|
|
|
```
|
|
IPv4 172.16.0.0/24
|
|
IPv6 fdb0::/112
|
|
```
|
|
|
|
> info: changing ip's, a restart of the pod is needed... for iptables and nat to change to new ip.
|
|
|
|
## Rout traffic
|
|
|
|
Here is two ways of making the k8s server handle routing of traffic
|
|
|
|
### persistent iptables
|
|
|
|
```shell
|
|
sudo apt install iptables-persistent
|
|
```
|
|
|
|
- replace `<interface>` with your network card like `eth0`.
|
|
- replace `<host-ipv4>` with ip like `10.8.0.0/24`.
|
|
- replace `<host-ipv6>` with ip like `fdcc:ad94:bacf:61a4::cafe:0/112`.
|
|
|
|
```shell
|
|
sudo iptables -t nat -A POSTROUTING -s <host-ipv4> -o <interface> -j MASQUERADE
|
|
sudo iptables -t nat -A POSTROUTING -s <host-ipv6> -o <interface> -j MASQUERADE
|
|
```
|
|
|
|
```shell
|
|
sudo netfilter-persistent save
|
|
```
|
|
|
|
### Systemd service
|
|
|
|
create this file `/etc/systemd/system/wireguard-masquerade.service`
|
|
|
|
```shell
|
|
sudo nano /etc/systemd/system/wireguard-masquerade.service
|
|
```
|
|
|
|
Changes
|
|
|
|
- replace `<interface>` with your network card like `eth0`.
|
|
- replace `<host-ipv4>` with ip like `10.8.0.0/24`.
|
|
- replace `<host-ipv6>` with ip like `fdcc:ad94:bacf:61a4::cafe:0/112`.
|
|
|
|
```
|
|
[Unit]
|
|
Description=WireGuard MASQUERADE for <host-ipv4> and <host-ipv6>
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s <host-ipv4> -o <interface> -j MASQUERADE
|
|
ExecStart=/sbin/ip6tables -t nat -A POSTROUTING -s <host-ipv6> -o <interface> -j MASQUERADE
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
```
|
|
|
|
#### Enable
|
|
|
|
```shell
|
|
sudo systemctl enable wireguard-masquerade
|
|
```
|
|
|
|
#### Start
|
|
|
|
```shell
|
|
sudo systemctl start wireguard-masquerade
|
|
```
|
|
|
|
## check system
|
|
|
|
check IPv4 packet forwarding status.
|
|
|
|
```shell
|
|
kubectl -n wireguard exec -it pod/wg-easy-0 -- sysctl net.ipv4.ip_forward
|
|
```
|
|
|
|
check IPv6 packet forwarding status.
|
|
|
|
```shell
|
|
kubectl -n wireguard exec -it pod/wg-easy-0 -- sysctl net.ipv6.conf.all.forwarding
|
|
```
|