Site-side configuration (manual steps at Trochalakis and Oswald)

Everything the RackNerd box needs from the two sites, the DCs, and the Duo admin panel. Nothing here runs on the VPS.

1. WireGuard peers (both sites)

Add the RackNerd peer to each site's existing WG config. The sites initiate (RackNerd has the static IP) and keep the tunnel alive:

# Trochalakis WG box — add:
[Peer]                       # RackNerd hub
PublicKey = <RACKNERD_WG_PUBLIC_KEY>       # printed by host/setup.sh
Endpoint = vpn.atlashorizon.net:51820
# .8 = OpenVPN clients, .9 = travel routers (docs/TRAVEL-ROUTERS.md)
AllowedIPs = 172.31.255.1/32, 172.31.8.0/24, 172.31.9.0/24
PersistentKeepalive = 25

Oswald: identical block. Site WG interface addresses on the new mesh links: Trochalakis 172.31.255.2/32, Oswald 172.31.255.3/32 (add to the site [Interface] Address list if the WG box doesn't already carry an address in this transfer net).

Do NOT add the other site's LAN to the RackNerd peer's AllowedIPs — inter-site traffic stays on your existing direct tunnel. The mesh only adds 172.31.8.0/24 (roaming clients) and 172.31.255.1 (the hub) via RackNerd.

2. Return-path routing (both sites)

Hosts at each site must route the client subnet back via the site WG box. If the WG box is not the LAN default gateway, add static routes on the LAN router (or directly on the DCs):

Destination	Via
`172.31.8.0/24`	site WireGuard box
`172.31.9.0/24`	site WireGuard box
`172.31.255.1/32`	site WireGuard box

Verify no asymmetry: tracert 172.31.8.10 from a DC must leave via the local WG box → RackNerd, never via the other site.

3. Windows Firewall / segmentation on the DCs

Allow from 172.31.8.0/24 (OpenVPN clients, real source IPs) and 172.31.9.0/24 (travel routers): standard AD client ports — DNS 53, Kerberos 88/464, LDAP 389/636, SMB 445, RPC 135 + 49152-65535, NTP 123, GC 3268/3269.

Allow from 172.31.255.1/32 (the RackNerd host itself):

TCP/UDP 53 → AHDC01, AHDC03, AH-OSWLDC (Technitium forwarder queries)
TCP 636 → AHDC01, AHDC03 (Duo Auth Proxy LDAPS)

4. Active Directory

Sites and Services: create subnet 172.31.8.0/24 and assign it to the Trochalakis site (clients will then prefer AHDC01/AHDC03 for DC discovery).
Duo service account: plain domain user, read-only, no interactive logon rights; goes in .env as DUO_SVC_USER / DUO_SVC_PASSWORD.
Optional: a VPN Users security group if you want security_group_dn gating in the auth proxy.

5. LDAPS certificates

AHDC01 and AHDC03 need valid LDAPS certs (AD CS auto-enrollment or manually issued). Export the issuing CA chain as PEM → duo-authproxy/certs/ad-ldaps-ca.pem on the VPS (see that directory's README).

6. Duo Admin Panel

Applications → Protect an Application → search RADIUS → Protect. (Not the "OpenVPN" catalog entry — that one is for Duo's server-side plugin, not the Auth Proxy radius_server_auto flow we use.) Copy the integration key, secret key, and API hostname into .env / group_vars/vpnhub.yml. Set username normalization to Simple so user, DOMAIN\user, and user@domain all map to one Duo user. Recommended policy: new-user policy deny (enrolled users only).

7. Public DNS

Create vpn.atlashorizon.net → RackNerd static IP (public registrar DNS, not AD). Used by roaming clients and both site WG endpoints.

3.5 KiB Raw Permalink Blame History