69 lines
2.9 KiB
Markdown
69 lines
2.9 KiB
Markdown
# Travel routers (GL.iNet) as roaming WireGuard peers
|
|
|
|
The three GL.iNet routers connect to the hub as always-on WireGuard
|
|
clients from `172.31.9.0/24` (hub = `172.31.9.1`). They are roaming
|
|
*clients*, not sites: they initiate to the hub, carry no LAN routes of
|
|
their own on the hub side, and NAT their attached devices behind their
|
|
single WG address — so the DCs see one IP per router.
|
|
|
|
Security model (be aware): unlike OpenVPN users there is **no Duo** here —
|
|
possession of the router's private key is the whole credential. Each
|
|
router has its own keypair; if one is lost, remove its entry from
|
|
`wg_travel_peers` and re-run the playbook — that revokes it completely.
|
|
|
|
## Hub side (all via Ansible)
|
|
|
|
1. Generate a keypair per router — in the GL.iNet UI (it shows the public
|
|
key) or manually: `wg genkey | tee priv | wg pubkey`.
|
|
2. Fill `wg_travel_peers` in `group_vars/vpnhub.yml`:
|
|
```yaml
|
|
wg_travel_peers:
|
|
- { name: glinet-1, public_key: "xxxx=", ip: 172.31.9.11 }
|
|
- { name: glinet-2, public_key: "yyyy=", ip: 172.31.9.12 }
|
|
- { name: glinet-3, public_key: "zzzz=", ip: 172.31.9.13 }
|
|
```
|
|
3. `ansible-playbook site.yml` — appends the peers to wg0.conf (restarts
|
|
wg0: brief blip for all tunnels), adds the firewall forwards, and
|
|
registers `<name>.roam.atlashorizon.net` A + PTR records.
|
|
4. **Existing deploys only**: add `172.31.9.0/24` to the Technitium
|
|
recursion ACL by hand (console → Settings → Recursion) — that setting
|
|
was seeded at first boot and isn't re-read from the compose env.
|
|
|
|
## Router side (paste into the GL.iNet WireGuard client UI)
|
|
|
|
```ini
|
|
[Interface]
|
|
PrivateKey = <this router's private key>
|
|
Address = 172.31.9.11/24 # .12 / .13 for the others
|
|
DNS = 172.31.9.1 # Technitium — AD names resolve
|
|
|
|
[Peer]
|
|
PublicKey = <RACKNERD_WG_PUBLIC_KEY> # printed by setup/playbook
|
|
Endpoint = vpn.atlashorizon.net:51820
|
|
# FULL TUNNEL (GL.iNet's default, and usually what you want on hotel
|
|
# wifi): everything rides the VPN; internet egresses via the VPS
|
|
# (masqueraded by the hub firewall).
|
|
AllowedIPs = 0.0.0.0/0
|
|
# Split-tunnel alternative — only AD/hub networks ride the VPN:
|
|
#AllowedIPs = 192.168.20.0/24, 192.168.7.0/24, 172.31.9.0/24, 172.31.255.1/32
|
|
PersistentKeepalive = 25
|
|
```
|
|
|
|
## Site side (once, both sites — same drill as the OpenVPN subnet)
|
|
|
|
- Add `172.31.9.0/24` to the RackNerd peer's AllowedIPs in each site's
|
|
WG config.
|
|
- Return route: `172.31.9.0/24` via the site WG box (LAN router or DCs).
|
|
- DC/Windows firewall: allow AD ports from `172.31.9.0/24`.
|
|
- Optional: AD Sites & Services subnet object for `172.31.9.0/24`.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
wg show wg0 # router peers: recent handshakes
|
|
ping 172.31.9.11 # from the hub
|
|
dig @127.0.0.1 -x 172.31.9.11 +short # glinet-1.roam.atlashorizon.net.
|
|
# from a device behind the router:
|
|
# ping ahdc01.ad.atlashorizon.net (resolves via 172.31.9.1, routes via hub)
|
|
```
|