154 lines
2.2 KiB
Markdown
154 lines
2.2 KiB
Markdown
# Check if traffic hits the pod
|
|
|
|
```shell
|
|
kubectl -n wg-easy exec -it wg-easy-wg-easy-0 -- wg show
|
|
```
|
|
|
|
```shell
|
|
microk8s kubectl -n wg-easy exec -it wg-easy-wg-easy-0 -- iptables -t nat -L -n -v | grep 10.8
|
|
```
|
|
|
|
sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens192 -j MASQUERADE
|
|
|
|
|
|
#net.ipv4.ip_forward=1
|
|
|
|
sudo nano /var/snap/microk8s/current/args/kubelet
|
|
|
|
--allowed-unsafe-sysctls=net.ipv4.ip_forward
|
|
|
|
|
|
|
|
```shell
|
|
helm install wg-easy ./ --namespace wg-easy --create-namespace
|
|
```
|
|
|
|
```shell
|
|
kubectl delete ns wg-easy
|
|
```
|
|
|
|
```shell
|
|
kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-0 -- ip add
|
|
```
|
|
|
|
```shell
|
|
kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-6bcdd9fcb4-7xt94 -- iptables -t nat -L -n -v
|
|
```
|
|
|
|
```shell
|
|
kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-6bcdd9fcb4-7xt94 -- sysctl net.ipv4.ip_forward
|
|
```
|
|
|
|
```shell
|
|
kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-6bcdd9fcb4-7xt94 -- sysctl net.ipv4.conf.all.src_valid_mark
|
|
```
|
|
|
|
```shell
|
|
kubectl -n wg-easy logs -f wg-easy-0
|
|
```
|
|
|
|
```shell
|
|
kubectl -n wg-easy get pvc,pod,svc
|
|
```
|
|
|
|
|
|
|
|
# Rout traffic
|
|
|
|
## Systemd service
|
|
|
|
lets create a file `/etc/systemd/system/wireguard-masquerade.service`
|
|
|
|
```shell
|
|
sudo nano /etc/systemd/system/wireguard-masquerade.service
|
|
```
|
|
|
|
replace `<host-interface>` with your network card like `eth0`
|
|
|
|
```
|
|
[Unit]
|
|
Description=WireGuard MASQUERADE for 10.8.0.0/24
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens192 -j MASQUERADE
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
```
|
|
|
|
## Enable
|
|
|
|
```shell
|
|
sudo systemctl enable wireguard-masquerade
|
|
```
|
|
|
|
## Start
|
|
|
|
```shell
|
|
sudo systemctl start wireguard-masquerade
|
|
```
|
|
|
|
swordsteel@microk8s:~$ sudo systemctl enable wg-masquerade
|
|
Failed to enable unit: File wg-masquerade.service: Bad message
|
|
|
|
|
|
|
|
---
|
|
|
|
# WireGuard
|
|
|
|
|
|
|
|
```shell
|
|
helm install wg-easy ./helm --namespace wireguard --create-namespace
|
|
```
|
|
|
|
```shell
|
|
helm -n wireguard upgrade wg-easy .\helm\
|
|
```
|
|
|
|
```shell
|
|
kubectl -n wireguard get pvc,pod,svc
|
|
```
|
|
|
|
```shell
|
|
kubectl -n wireguard logs -f wg-easy-0
|
|
```
|
|
|
|
```shell
|
|
kubectl delete ns wireguard
|
|
```
|
|
|
|
```shell
|
|
kubectl get ns
|
|
```
|
|
|
|
```shell
|
|
kubectl -n wireguard describe pod wg-easy-wg-easy-0
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|