Pro Custodibus Blog

Tailscale is not different. It simply makes managing WG configuration easier, and adds some useful value-added features on top. But, as you know, you can also manage this configuration yourself, either via traditional config mgmt tools, helpers like wg-meshconf, or even plain shell scripts, if you like. I'm aware this is a very HN-Dropboxy comment, but it's really not that complex[1], and is easily manageable for a small deployment. Another VPN tool I used before WG gained momentum was tinc, which supports mesh networking out of the box. It's even easier to configure and maintain, and supports all platforms. It does run in userspace, which should make it slower than WG, but I found the performance acceptable for my modest use cases. Highly recommended. [1]: https://www.procustodibus.com/blog/2020/11/wireguard-point-to-point-co…

WireGuard over WireGuard (WireGuard end-to-end encrypted hub and spoke) example https://www.procustodibus.com/blog/2021/12/wireguard-e2ee-hub-and-spok…

Not to hijack but last time I was setting up wireguard, I found this site to be super useful: https://www.procustodibus.com/blog/2020/10/wireguard-topologies/

Calculator for the workaround: https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calcul…

WireGuard is honestly very easy to set up. All of the commands feel very straightforward: https://www.procustodibus.com/blog/2020/11/wireguard-point-to-point-co… You can definitely run an HTTP server behind WireGuard. WireGuard just adds a network interface that your server can listen on (e.g. your server would listen on a private address like 10.0.0.1).

Good article. Is there an easy solution to route everything except the local net through WireGuard? I find the resulting long list of AllowedIPs a bit cumbersome (and impossible to verify). https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calcul…

Isn't this use case covered in the article that you mentioned? Specifically under the very last heading. https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calcul… That is you could specify a single Wireguard peer that you send all the traffic to by setting AllowedIPs to 0.0.0.0/0 and also set more specific routes than 0.0.0.0/0 in the main routing table of your device in order to send traffic to certain networks via a different gateway.

I found the blog articles on https://www.procustodibus.com/blog/ super helpful and well written. You don't have to use their service to implement what they describe, in most cases.

I don't think you need Tailscale for this. You need tailscale when: 1) You have a lot of road-warriors 2) You need decent ACLs that isn't just IP based. 3a) You don't ability to directly connect to a site (just one needs to be accessible) 3b) You can't add 3rd site to relay traffic or punch holes in NAT. 4) You're afraid of terminals and/or text editors. Here is a good write-up on the subject: https://www.procustodibus.com/blog/2021/11/wireguard-nftables/

There's this handy website that calculates the allowed CIDRs with exclusions https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calcul…

Is this what you're looking for?: https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#intern…

It seems like you can by using the PIV applet found in yubikeys: https://www.procustodibus.com/blog/2023/02/wireguard-yubikey/ You can read more about the type of cryptography that wireguard uses here: https://www.wireguard.com/protocol/

Take a look a these (not tested these configurations personally): - High Availability WireGuard on AWS [https://www.procustodibus.com/blog/2021/02/ha-wireguard-on-aws/] - High Availability WireGuard on Azure [https://www.procustodibus.com/blog/2021/06/ha-wireguard-on-azure/] - High Availability WireGuard Site to Site [https://www.procustodibus.com/blog/2021/10/ha-wireguard-site-to-site/]

Yes, it is wrong. You just misunderstand how routing works. Say you’re at work, and the office router (192.168.1.1) gives you access to 10.3.0.0/16. This is where your company’s cloud is or whatever. You want all your traffic to go through your home network for whatever convoluted reason, except for the 10.3 stuff. You just add PreUp = ip route add 10.3.0.0/16 via 192.168.1.1 dev eth0 And AllowedIPs = 0.0.0.0/0 (Edit: remember to add a post up) And bam, you’re done. No crazy allowedip rules. When your computer generates packets to the company cloud, your OS won’t even try to talk to the VPN. Because the route table makes it go somewhere else entirely. I don’t know if this was the exact use-case you described in your blog, but I’m sure you can figure it out from here. Oh and this is also fully documented online in many places, including the AllowedIPs Calculator: https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calcul…

Edit: Sorry for what an opinionated mini rant this comment has become while typing it ;; > The so called ‘rootless’ Podman seems to be advertised as being on the same level of isolation as Jails – but only if You run that Podman with properly configured and enabled SELinux/AppArmor solutions. That ignores user namespacing, the subsequent namespacing for mounts, networks, etc. So I'm confused as to where the it-only-is-secure-with-selinux comes from. > Then the Jails are better isolated again How so. - - - > Even ‘rootless’ Podman has full access to all Linux kernel syscalls from https://podman.io/blogs/2019/10/15/generate-seccomp-profiles.html Most container tools use a default seccomp filter which was initially written by Jesse Frazelle for Docker - - - > Jails have restricted use of FreeBSD kernel syscalls without any additional tools Which ones > You can NOT dedicate any physical interface to the ‘rootless’ Podman container I'm confused by what you mean "physical" here. Can also disable networking, which is mentioned for jails for some reason. So is other VPN-like options, not mentioned for Podman. https://www.procustodibus.com/blog/2022/10/wireguard-in-podman/ as an example > firewall https://discuss.linuxcontainers.org/t/how-does-nftables-work-inside-an… > comparing CVE counts and nothing else Come on - - - This article seems like it would strongly contribute to people misunderstanding things.

It's not just that they're suspect or unreliable. They're complete bullshit. The actual use of VPN technology is to create virtual networks that are private (hence the name). It's a system level technology. There are several types of network topologies you can set up, when I was learning about this I found this article which is quite nice: https://www.procustodibus.com/blog/2020/10/wireguard-topologies. You can proxy traffic through a VPN, but the only scenario I can think of in which it makes sense is if you are an OSINT researcher and you need a safe system on which to conduct your research. If you need to proxy traffic and "hide" your IP, just use a flipping proxy. It's an application level technology (e.g. for torrenting, every torrent client under the sun supports a SOCKS5 proxy). If you don't have the patience to set up a VPS yourself, you can even use something like Outline (https://getoutline.org) which automates that (and it has a mobile client app as well). If you need privacy (and to actually hide your IP), then use Tor.