Test plan

Run the stages in order — each depends on the previous one.

0. Host plumbing (on the VPS)

sysctl net.ipv4.ip_forward          # = 1
wg show wg0                         # both peers: recent "latest handshake"
ping -c3 172.31.255.2               # Trochalakis WG box
ping -c3 172.31.255.3               # Oswald WG box
ping -c3 <TROCH_DC1_IP>             # AHDC01 across the tunnel
ping -c3 <OSWALD_DC_IP>             # AH-OSWLDC across the tunnel

1. Technitium DNS (on the VPS)

docker compose logs technitium-init  # "Technitium AD forwarder zones OK."
# AD SRV record via conditional forward (the money query):
dig @127.0.0.1 _ldap._tcp.dc._msdcs.ad.atlashorizon.net SRV +short
dig @127.0.0.1 ahdc01.ad.atlashorizon.net +short
dig @127.0.0.1 ah-oswldc.ad.oswaldtheotter.net +short
dig @127.0.0.1 -x <TROCH_DC1_IP> +short          # reverse zone
dig @127.0.0.1 google.com +short                  # public recursion

Web console: from a VPN client or site host, http://172.31.8.1:5380 (or http://172.31.255.1:5380 over the site tunnels) — verify the six conditional-forwarder zones exist. Must NOT load from the public IP.

2. Duo Auth Proxy (on the VPS)

docker compose logs duo-authproxy   # connectivity tool output: LDAPS bind
                                    # to both DCs OK, Duo API reachable
# End-to-end RADIUS (expect a push to your phone, then Access-Accept):
apt-get install -y freeradius-utils
radtest '<aduser>' '<adpassword>' 127.0.0.1:1812 10 "$RADIUS_SECRET"
# Negative: wrong password -> immediate Access-Reject, no push.

This stage proves the LDAP bind leg independently of OpenVPN.

3. Full client connect (from outside, e.g. phone hotspot)

Import a built .ovpn, connect with AD username + password → approve the Duo push → connected.
ipconfig /all: address in 172.31.8.0/24, DNS 172.31.8.1, suffix ad.atlashorizon.net.
DNS through the tunnel: nslookup -type=SRV _ldap._tcp.dc._msdcs.ad.atlashorizon.net
Reachability, one host per site: ping ahdc01.ad.atlashorizon.net and ping ah-oswldc.ad.oswaldtheotter.net
AD actually works: dir \\ad.atlashorizon.net\SYSVOL then klist (Kerberos tickets present, no NTLM fallback).
Passcode-append fallback: reconnect using password,<passcode> from the Duo app — must succeed with no push.

4. Routing correctness

On AHDC01, Security log 4624/4768 for the test user shows the real client IP (172.31.8.x), not a NAT address — confirms routed (no masquerade) design.
From the client: tracert <TROCH_DC1_IP> → first hop 172.31.8.1.
From a DC at each site: tracert 172.31.8.x → leaves via the local WG box (no path through the other site = no asymmetric routing).
From a Trochalakis host: tracert <oswald LAN IP> still uses the direct site-to-site tunnel (RackNerd never appears).

5. Exposure check (from any outside box)

nmap -sU -p 53,1194,51820 <racknerd_public_ip>   # 53 must NOT respond
nmap -sT -p 22,53,636,1812,5380,7505 <racknerd_public_ip>  # only 22 open
# If the VPS has a public IPv6 address, repeat over v6:
nmap -6 -sT -p 22,53,5380 <racknerd_public_ipv6>          # only 22 open

6. Persistence

docker compose down && docker compose up -d --build   # survives cleanly
# Technitium zones must still exist afterwards (state in /opt/technitium/config)
dig @127.0.0.1 _ldap._tcp.dc._msdcs.ad.atlashorizon.net SRV +short
reboot   # then: wg show, docker compose ps, re-run stage 3 quick connect

3.5 KiB Raw Blame History