{"id":1682,"date":"2020-10-28T15:33:46","date_gmt":"2020-10-28T20:33:46","guid":{"rendered":"https:\/\/blog.iqonda.net\/?p=1682"},"modified":"2020-10-28T15:41:13","modified_gmt":"2020-10-28T20:41:13","slug":"wireguard-vpn-between-azure-and-oci-hosts","status":"publish","type":"post","link":"https:\/\/blog.ls-al.com\/wireguard-vpn-between-azure-and-oci-hosts\/","title":{"rendered":"Wireguard VPN between Azure and OCI hosts"},"content":{"rendered":"<h1>Wireguard test between Azure and Oracle OCI hosts<\/h1>\n<p>REF: <a href=\"https:\/\/www.wireguard.com\/\">https:\/\/www.wireguard.com\/<\/a><\/p>\n<h2>Azure VM setup<\/h2>\n<p>Ubuntu 18.04.5 LTS<\/p>\n<pre><code class=\"language-bash\">root@wireguard-az:~# dig +short myip.opendns.com @resolver1.opendns.com\n*IPAddress*<\/code><\/pre>\n<ul>\n<li>follow <a href=\"https:\/\/outsidersrepublic.com\/tech\/getting-started-wireguard-ubuntu-aws\/\">https:\/\/outsidersrepublic.com\/tech\/getting-started-wireguard-ubuntu-aws\/<\/a> for quick setup ie no routing etc<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">root@wireguard-az:~# apt install wireguard\n\nroot@wireguard-az:~# wg version\nwireguard-tools v1.0.20200513 - https:\/\/git.zx2c4.com\/wireguard-tools\/\n\nroot@wireguard-az:~# umask 077\nroot@wireguard-az:~# wg genkey > privatekey\nroot@wireguard-az:~# wg pubkey < privatekey > publickey\nroot@wireguard-az:~# ip link add wg0 type wireguard\nroot@wireguard-az:~# ip addr add 10.0.0.1\/24 dev wg0\nroot@wireguard-az:~# wg set wg0 private-key .\/privatekey\nroot@wireguard-az:~# ip link set wg0 up\n\nroot@wireguard-az:~# ip addr\n1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000\n    link\/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\n    inet 127.0.0.1\/8 scope host lo\n       valid_lft forever preferred_lft forever\n    inet6 ::1\/128 scope host \n       valid_lft forever preferred_lft forever\n2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000\n    link\/ether 00:0d:3a:5d:89:a7 brd ff:ff:ff:ff:ff:ff\n    inet 10.1.1.4\/24 brd 10.1.1.255 scope global eth0\n       valid_lft forever preferred_lft forever\n    inet6 fe80::20d:3aff:fe5d:89a7\/64 scope link \n       valid_lft forever preferred_lft forever\n3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000\n    link\/none \n    inet 10.0.0.1\/24 scope global wg0\n       valid_lft forever preferred_lft forever\n\nroot@wireguard-az:~# wg show\ninterface: wg0\n  public key: *redacted*\n  private key: (hidden)\n  listening port: 43971\n\nroot@wireguard-az:~# wg set wg0 peer *redacted* allowed-ips 10.0.0.2\/32 endpoint *IPAddress*:40181\n\nroot@wireguard-az:~# wg show\ninterface: wg0\n  public key: *redacted*\n  private key: (hidden)\n  listening port: 43971\n\npeer: *redacted*\n  endpoint: *IPAddress*:40181\n  allowed ips: 10.0.0.2\/32\n  transfer: 0 B received, 3.32 KiB sent<\/code><\/pre>\n<p>NOTE: iptables on this server don't need adjustment it is open already<\/p>\n<pre><code class=\"language-bash\">root@wireguard-az:~# ping 10.0.0.2 -c 1\nPING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.\n64 bytes from 10.0.0.2: icmp_seq=10 ttl=64 time=31.7 ms<\/code><\/pre>\n<p>NOTE:  open Azure Security Rule for port we are running on<br \/>\n310    wg   43971   Any    <em>IPAddress<\/em>\/32  Any<\/p>\n<h2>Oracle OCI<\/h2>\n<p>Ubuntu 20.04.1 LTS<\/p>\n<pre><code class=\"language-bash\">root@usph-vmli-do01:~# dig +short myip.opendns.com @resolver1.opendns.com\n*IPAddress*<\/code><\/pre>\n<ul>\n<li>followed <a href=\"https:\/\/outsidersrepublic.com\/tech\/getting-started-wireguard-ubuntu-aws\/\">https:\/\/outsidersrepublic.com\/tech\/getting-started-wireguard-ubuntu-aws\/<\/a> for quick setup ie no routing etc<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">root@usph-vmli-do01:~# apt install wireguard\n\nroot@usph-vmli-do01:~# wg version\nwireguard-tools v1.0.20200513 - https:\/\/git.zx2c4.com\/wireguard-tools\/<\/code><\/pre>\n<ul>\n<li>open Security Rule for port we are running on<br \/>\nNo  <em>IPAddress<\/em>\/32  TCP All 40181       TCP traffic for ports: 40181<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">root@usph-vmli-do01:~# umask 077\nroot@usph-vmli-do01:~# wg genkey > privatekey\nroot@usph-vmli-do01:~# wg pubkey < privatekey > publickey\nroot@usph-vmli-do01:~# ip link add wg0 type wireguard\nroot@usph-vmli-do01:~# ip addr add 10.0.0.2\/24 dev wg0\nroot@usph-vmli-do01:~# wg set wg0 private-key .\/privatekey\nroot@usph-vmli-do01:~# ip link set wg0 up\n\nroot@usph-vmli-do01:~# ip addr\n2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc pfifo_fast state UP group default qlen 1000\n    link\/ether 00:00:17:02:8f:09 brd ff:ff:ff:ff:ff:ff\n    inet 10.3.1.8\/24 brd 10.3.1.255 scope global ens3\n       valid_lft forever preferred_lft forever\n    inet6 fe80::200:17ff:fe02:8f09\/64 scope link \n       valid_lft forever preferred_lft forever\n...\n20: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000\n    link\/none \n    inet 10.0.0.2\/24 scope global wg0\n       valid_lft forever preferred_lft forever\n\nroot@usph-vmli-do01:~# wg show\ninterface: wg0\n  public key: *redacted*\n  private key: (hidden)\n  listening port: 40181\n\nroot@usph-vmli-do01:~# wg set wg0 peer *redacted* allowed-ips 10.0.0.1\/32 endpoint *IPAddress*:43971\n\nroot@usph-vmli-do01:~# wg show\ninterface: wg0\n  public key: *redacted*\n  private key: (hidden)\n  listening port: 40181\n\npeer: *redacted*\n  endpoint: *IPAddress*:43971\n  allowed ips: 10.0.0.1\/32<\/code><\/pre>\n<p>NOTE: iptables need adjustment port is not open<\/p>\n<pre><code class=\"language-bash\">root@usph-vmli-do01:~# iptables -L --line-numbers\nChain INPUT (policy ACCEPT)\nnum  target     prot opt source               destination         \n1    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED\n2    ACCEPT     icmp --  anywhere             anywhere            \n3    ACCEPT     all  --  anywhere             anywhere            \n4    ACCEPT     udp  --  anywhere             anywhere             udp spt:ntp\n5    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http-alt state NEW,ESTABLISHED\n6    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https state NEW,ESTABLISHED\n7    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http state NEW,ESTABLISHED\n8    ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh\n9    REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited\n...\n\nroot@usph-vmli-do01:~# iptables -I INPUT 5 -p tcp -m tcp --dport 40181 -m state --state NEW,ESTABLISHED -j ACCEPT\n\nroot@usph-vmli-do01:~# iptables -L --line-numbers\nChain INPUT (policy ACCEPT)\nnum  target     prot opt source               destination         \n1    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED\n2    ACCEPT     icmp --  anywhere             anywhere            \n3    ACCEPT     all  --  anywhere             anywhere            \n4    ACCEPT     udp  --  anywhere             anywhere             udp spt:ntp\n5    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:40181 state NEW,ESTABLISHED\n6    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http-alt state NEW,ESTABLISHED\n7    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https state NEW,ESTABLISHED\n8    ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http state NEW,ESTABLISHED\n9    ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh\n10   REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited\n\nroot@usph-vmli-do01:~# ping 10.0.0.1 -c 1\nPING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.\n64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=31.9 ms\n\nubuntu@usph-vmli-do01:~\/.ssh$ ssh ubuntu@10.0.0.1\n...\nWelcome to Ubuntu 18.04.5 LTS (GNU\/Linux 5.4.0-1031-azure x86_64)\n\n * Documentation:  https:\/\/help.ubuntu.com\n * Management:     https:\/\/landscape.canonical.com\n * Support:        https:\/\/ubuntu.com\/advantage\n\n  System information as of Wed Oct 28 17:35:39 UTC 2020\n...<\/code><\/pre>\n<h2>Permanent steps<\/h2>\n<p>For routing\/NAT of hosts behind these, creating \/etc\/wireguard\/ config files, systemd starting etc read more here: <a href=\"https:\/\/linuxize.com\/post\/how-to-set-up-wireguard-vpn-on-ubuntu-20-04\/\">https:\/\/linuxize.com\/post\/how-to-set-up-wireguard-vpn-on-ubuntu-20-04\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Wireguard test between Azure and Oracle OCI hosts REF: https:\/\/www.wireguard.com\/ Azure VM setup Ubuntu 18.04.5 LTS root@wireguard-az:~# dig +short myip.opendns.com<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,122],"tags":[],"class_list":["post-1682","post","type-post","status-publish","format-standard","hentry","category-vpn","category-wireguard"],"_links":{"self":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts\/1682","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/comments?post=1682"}],"version-history":[{"count":0,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/posts\/1682\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/media?parent=1682"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/categories?post=1682"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ls-al.com\/wp-json\/wp\/v2\/tags?post=1682"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}