Package: wgmesh
Wireguard Mesh ToolThis is a small project designed to experiment with distribution and maintenance of Wireguard Meshes for private networks using Protocol Routing.Of necessity, the Routing Daemons are running against the wireguard interfaces.If there are local Routing Requirements, they are beyond the scope of this mesh development.  This is intended to produce a routing mesh - care and feeding of the mesh is your responsibility.RequirementsFedoraprolly any modern linux will workWireguardincluded with Fedora (wireguard-tools)Pythonincluded with almost all modern linuxBIRDmodular protocol routing daemonShorewalllocal linux firewall configuration, with the simple two-interface setupSee INSTALL.mdTODObuild node removal workflow.wgconfig should perform the initial wghost configuration.Local Site-specific configurations integration?1/2 done, calls-localscripts.Rename netns "private" to a mesh-specificlocus.startup script should prolly be written in python.Non-dns method of transmitting deploy_messages.Warning command:check default and private for forwardingcheck for addresses on WG interfacesCheck for wg upCheck for veth device presenceCheck veth addressedMonitor/Warn on UDP port conflicts on startup.Examine ifaddr dependency.Simplifywgconfig, removewgdeployredundant code blocks.Fix deploy template args structure so that wg/table/ifdetails are portable throughout the templatesGetting StartedExample config:wgmesh.yamlExample Domain:mesh.example.comSite ConfigCopy wgmesh-example.yaml towgmesh.yamlEdit the file and set the primitives.The ipv6 segment should be a 48bit ULA subnet.Execute site publisher:wgsite wgmesh.yamlPublish the DNS Information. (TXT record 'mesh.example.com')Endpoint ConfigConnect to mesh endpoints, setup python virtualenv if desired.Install wgmesh package;pip install wgmeshSetup host registration the mesh (run as root or sudo):wgconfig mesh.example.comConfigure the local host:wgconfig -i ens3 -T ens4 -I 172.22.15.243/24  mesh.example.comPublish Site import data:wghost mesh.example.comSite ConfigImport the host by copying the output into the site controller.wgsite -i <hash> wgmesh.yamlOnce host(s) are ready, publish Host-base DNS records:wgpub wgmesh.yamlPublish output to the[uuid].wgmesh.example.comTXT records.Endpoint ConfigDeploy on the local hosts:wgdeploy mesh.example.comPublish and deploy processes can be automated.Warnings:wghostsetup, andwgsite -imust be a human-approved process, because this adds nodes (e.g. trusted keys) to the mesh.Route53 IntegrationIf you are using Route53 for DNS hosting, youmaysetup automated DNS posting from the site configurator.  This causeswgsite, andwgpubto automatically update records in DNS.Add theaws_access_key_idandaws_secret_access_keyto the Site Mesh file in theglobalsection.global:
  aws_access_key_id: XXXXXXXXXXXXXXXXXX
  aws_secret_access_key: yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyMesh EndpointsThe Mesh endpoints expect a VM (or machine) with two attached interfaces.  One interface should be configured for Internet access. The other interface must connect to the local LAN.Mesh BGP Configuration is setup for exchanging routes between Mesh Endpoints across the wireguard links.  Local routing configuration can be attached usingBIRD's modular configurationcapability.Process FlowTroubleshootingUDP PortsCheck for UDP Port conflicts.  Other elements on the system may conflict with the UDP ports.  UDP Ports are assigned from the base port in an ascending fashion. Reliable reports have come in and high-end (49900+) ports have caused OS-related interference.Lowering the ports resolved the issue.BIRD StatusBFD Is enabled to make troubleshooting easier.  The endpoints are all known at wgdeploy time, and this neatly describes the config when monitoring.  Use this script to watch bird on an endpoint, and to see changes in status as nodes are up'd and down'd.util/birdwatch.shwatch -n1 "birdc -s /var/run/bird-private.sock show prot;echo '';birdc -s /var/run/bird-private.sock show bfd session;echo '';birdc -s /var/run/bird-private.sock show route count"Testing SubnetIf you're experimenting with the MESH, and just want to send packets racing around, start the tester namespace:sudo systemctl start systemd-netns-access@tester systemd-netns@testerFrom within the namespace, you can ping the other nodes. (Taken from a 3-node test setup.)[root@vpn-nodea eis]# ip netns exec tester fping 192.168.101.1 192.168.102.100 192.168.103.10
192.168.101.1 is alive
192.168.102.100 is alive
192.168.103.10 is aliveContributingPull requests and feature requests gladly accepted.wgmeshis licensed under the MIT/Expat license.Changelog2020-12-04: Joshua Schmidlkofer - project setup2021-03-03: 0.5 - functional test release.2021-03-03: 0.5.1 - packaging test release.