Share single service via WireGuard
from syaochan@feddit.it to selfhosted@lemmy.world on 15 Sep 21:29
https://feddit.it/post/21750924

I wanted to share a service I’m hosting, but didn’t feel comfortable just leaving publicly accessible, even behind a reverse proxy. In the meantime I did not want to give access to my whole lan with a VPN, or redirect all internet traffic from a client thru my network. So the idea is to run a WireGuard instance on my OpenWRT router in a completely isolated zone (input, output and forward set to reject on firewall) and then forward a single port from the service host’s. Client is android, so using WG Tunnel and split tunnel just for the relevant app should not impair client’s network access. Initial tests seems to be ok, is there anything I may have overlooked? Please feel free to comment.

#selfhosted

threaded - newest

frankhe78@feddit.it on 15 Sep 21:48 next collapse

Seems fine with me. I have been playing around with some MikroTik devices doing exactly this. It should also be possible to achieve the same using OpenWRT. You do indeed have to isolate things using different subnets and route certain IP-adresses between those IPv4 subnets. Nothing too complicated.

litchralee@sh.itjust.works on 15 Sep 21:59 next collapse

Let me make sure I understand everything correctly. You have an OpenWRT router which terminates a Wireguard tunnel, which your phone will connect to from somewhere on the Internet. When the Wireguard tunnel lands within the router in the new subnet 192.168.2 0/24, you have iptable rules that will:

  • Reject all packets on the INPUT chain (from subnet to OpenWRT)
  • Reject all packets on the OUTPUT chain (from OpenWRT to subnet)
  • Route packets from phone to service on TCP port 8080, on the FORWARD chain
  • Allow established connections, on the FORWARD chain
  • Reject all other packets on the FORWARD chain

So far, this seems alright. But where does the service run? Is it on your LAN subnet or the isolated 192.168.2.0/24 subnet? The diagram you included suggests that the service runs on an existing machine on your LAN, so that would imply that the router must also do address translation from the isolated subnet to your LAN subnet.

That’s doable, but ideally the service would be homed onto the isolated subnet. But perhaps I misunderstood part of the configuration.

Lemmchen@feddit.org on 16 Sep 08:11 next collapse

OpenZiti allows to only allow predefined ports/services via VPN: netfoundry.io/docs/openziti

signalsayge@infosec.pub on 16 Sep 10:30 next collapse

Tailscale would probably be easier for this. Install tailscale on the server and configure only that service available in the tailscale dashboard. I’ve used this method for ssh access to family members devices.

I’m sure you could run the same setup using headscale (tailscale self hosted), it would require a bit more setup though and dynamic dns would probably have to be working.

stratself@lemdro.id on 16 Sep 11:07 collapse

Is there a way for a Wireguard peer to advertise AllowedIPs similar to Tailscale’s subnet routings? If that’s right, perhaps you can configure your host’s address as one of the AllowedIPs on the OpenWRT peer, and skip port forwarding too