Package: wgstarman
wgstarmanWireGuard manager written in Python 3 to connect two or more peers in a star VPN, i.e. having a central peer which routes the traffic within the VPN. It includes a DHCP-like IP address allocation mechanism.It currently supports IPv6 only, but IPv4 is in the plans (it needs a proper IP address release logic).It has been designed and tested on Linux, specifically due to the paths and commands used, but it should work on any POSIX / UNIX operating systems (like MacOS).SecurityThe VPN can be accessed only knowing a pre-shared key, generated by the server / central node the first time it is being executed. In case of PSK exposure, the--refresh-pskmight be used to generate a new one.Every message exchanged with the protocol is encrypted and decrypted via the given PSK.Once the peer joins the network, the WireGuard asymmetric encryption secures the connection between the peers.Software requirementWireGuard kernel's module (it should be enabled by default)wgandwg-quickcommands (provided by most Linux distributions via thewireguard-toolspackage)Setting up the serverwgstarmanserver--ipv6-networkfdxx:xxxx:xxxx:yyyy:zzzz:zzzz::/64[--device-namewg0][--listen-address-40.0.0.0][--listen-address-6::][--listen-port1194][--enable-listen-ipv6][--refresh-psk][--debug]--ipv6-networkthe IPv6 network to use for the VPN, i.e. fdxx:xxxx:xxxx:yyyy:zzzz:zzzz::/64--device-namethe name of both the network device and the configuration file (default: wg0)--listen-address-4the address IPv4 on which the address manager will listen on (default: 0.0.0.0)--listen-address-6the address IPv6 on which the address manager will listen on; requires--enable-listen-ipv6(default: ::)--listen-portthe port on which WireGuard (UDP) and the address manager (TCP) will listen on (default: 1194)--enable-listen-ipv6enable address manager to listen on{listen_address_6}:{listen_port}--refresh-pskforce the refresh of the pre-shared key--debugenable debug logThe manager will output the pre-shared key (PSK), to be used for interacting with it and connect new peers.The central peer will assign to itself the first IP of the network.NOTE: the pre-shared key is being stored in/etc/wgstarman/wgstarman.confand is formatted in the following way:{server_public_key} = {pre-shared key}The server's public key is generated at runtime the first time the network is being configured.sysctl configurationsThe following sysctl configurations must be set:net.ipv6.conf.all.disable_ipv6=0to enable IPv6 addressesnet.ipv6.conf.all.forwarding=1to allow the packets routing via IPv6docker capsIn case the server is run in docker, the following caps must be set:NET_ADMINSYS_MODULESetting up the peerswgstarmanpeer--server-addressxx.yy.zz.kk[--server-port1194]--device-namewg0--pskODjCtWVtBzAq11clgtEwYxhHfEz8asGmnzwEQsqIZTU=[--host-namepeer-name][--keep-alive][--overwrite][--debug]--server-addressthe server's public IP (either IPv4 or IPv6)--server-port(default 1194) the port on which the server is listening (see server configuration)--device-namethe device and configuration file WireGuard will use for this VPN--pskthe pre-shared key, given by the server at startup--host-namename of the peer, resolvable via wgstarman resolv (optional)--keep-alivekeep the connection to the server alive (to avoid connection drop in case of NAT)--overwriteoverwrite if a configuration already exists--debugenable debug logOnce the command is given and throws no errors, a configuration file is being written in/etc/wireguard/[device-name].confand the connection is established; the VPN connection can thus be upped or downed via thewg-quickcommands.In casewgstarmanis used again specifying an already configured device name, it will connect to thewgstarmanserver again and verify its address / public key against the server's configuration: in case the server doesn't have the peer's record, it will assign a new IP and the peer will overwrite its own configuration.Resolving VPN namesAs WireGuard supports only layer 3 of the ISO/OSI stack, peers can't use multicast messages to share their positions (for instance using ZeroConf's mDNS protocol).The tool also intentionally doesn't change the system's resolv configuration, as each system may vary and this might lead to unwanted behaviours (i.e. removing company's name servers etc).As a result, the tool supports a DNS-like mechanism to resolve host names into their VPN IP addresses. This sub-command can be used as regular users.The server replying to the resolv requests is the same which assigns the IP addresses, so it always knows which host have which address.wgstarmanresolv--device-name,-dwg0[--resolv-port,-p1195]{host_name}--device-name,-dthe device associated with the network--resolv-port,-pthe resolv port (server listen port + 1){host_name}the host name to queryThe resolv command will output the list of the found address(es) connected to the central peer, one address per line. In case of error, an error will be logged in stderr.Exit codes:0no error1resolv server error2unable to connect to resolv server