86 lines
3.5 KiB
Markdown
86 lines
3.5 KiB
Markdown
# Site-side configuration (manual steps at Trochalakis and Oswald)
|
|
|
|
Everything the RackNerd box needs from the two sites, the DCs, and the Duo
|
|
admin panel. Nothing here runs on the VPS.
|
|
|
|
## 1. WireGuard peers (both sites)
|
|
|
|
Add the RackNerd peer to each site's existing WG config. The sites
|
|
**initiate** (RackNerd has the static IP) and keep the tunnel alive:
|
|
|
|
```ini
|
|
# Trochalakis WG box — add:
|
|
[Peer] # RackNerd hub
|
|
PublicKey = <RACKNERD_WG_PUBLIC_KEY> # printed by host/setup.sh
|
|
Endpoint = vpn.atlashorizon.net:51820
|
|
# .8 = OpenVPN clients, .9 = travel routers (docs/TRAVEL-ROUTERS.md)
|
|
AllowedIPs = 172.31.255.1/32, 172.31.8.0/24, 172.31.9.0/24
|
|
PersistentKeepalive = 25
|
|
```
|
|
|
|
Oswald: identical block. Site WG interface addresses on the new mesh links:
|
|
Trochalakis `172.31.255.2/32`, Oswald `172.31.255.3/32` (add to the site
|
|
[Interface] Address list if the WG box doesn't already carry an address in
|
|
this transfer net).
|
|
|
|
**Do NOT** add the other site's LAN to the RackNerd peer's AllowedIPs —
|
|
inter-site traffic stays on your existing direct tunnel. The mesh only adds
|
|
`172.31.8.0/24` (roaming clients) and `172.31.255.1` (the hub) via RackNerd.
|
|
|
|
## 2. Return-path routing (both sites)
|
|
|
|
Hosts at each site must route the client subnet back via the site WG box.
|
|
If the WG box is **not** the LAN default gateway, add static routes on the
|
|
LAN router (or directly on the DCs):
|
|
|
|
| Destination | Via |
|
|
|------------------|------------------------|
|
|
| `172.31.8.0/24` | site WireGuard box |
|
|
| `172.31.9.0/24` | site WireGuard box |
|
|
| `172.31.255.1/32`| site WireGuard box |
|
|
|
|
Verify no asymmetry: `tracert 172.31.8.10` from a DC must leave via the
|
|
local WG box → RackNerd, never via the other site.
|
|
|
|
## 3. Windows Firewall / segmentation on the DCs
|
|
|
|
Allow from **`172.31.8.0/24`** (OpenVPN clients, real source IPs) and
|
|
**`172.31.9.0/24`** (travel routers): standard AD client ports — DNS 53,
|
|
Kerberos 88/464, LDAP 389/636, SMB 445, RPC 135 + 49152-65535, NTP 123,
|
|
GC 3268/3269.
|
|
|
|
Allow from **`172.31.255.1/32`** (the RackNerd host itself):
|
|
- TCP/UDP 53 → AHDC01, AHDC03, AH-OSWLDC (Technitium forwarder queries)
|
|
- TCP 636 → AHDC01, AHDC03 (Duo Auth Proxy LDAPS)
|
|
|
|
## 4. Active Directory
|
|
|
|
- **Sites and Services**: create subnet `172.31.8.0/24` and assign it to the
|
|
Trochalakis site (clients will then prefer AHDC01/AHDC03 for DC discovery).
|
|
- **Duo service account**: plain domain user, read-only, no interactive
|
|
logon rights; goes in `.env` as `DUO_SVC_USER` / `DUO_SVC_PASSWORD`.
|
|
- Optional: a `VPN Users` security group if you want `security_group_dn`
|
|
gating in the auth proxy.
|
|
|
|
## 5. LDAPS certificates
|
|
|
|
AHDC01 and AHDC03 need valid LDAPS certs (AD CS auto-enrollment or
|
|
manually issued). Export the issuing CA chain as PEM →
|
|
`duo-authproxy/certs/ad-ldaps-ca.pem` on the VPS
|
|
(see that directory's README).
|
|
|
|
## 6. Duo Admin Panel
|
|
|
|
Applications → Protect an Application → search **RADIUS** → Protect.
|
|
(Not the "OpenVPN" catalog entry — that one is for Duo's server-side
|
|
plugin, not the Auth Proxy `radius_server_auto` flow we use.) Copy the
|
|
integration key, secret key, and API hostname into `.env` /
|
|
`group_vars/vpnhub.yml`. Set username normalization to **Simple** so
|
|
`user`, `DOMAIN\user`, and `user@domain` all map to one Duo user.
|
|
Recommended policy: new-user policy deny (enrolled users only).
|
|
|
|
## 7. Public DNS
|
|
|
|
Create `vpn.atlashorizon.net` → RackNerd static IP (public registrar DNS,
|
|
not AD). Used by roaming clients and both site WG endpoints.
|