elghazal-a/autowire

Automatically configure Wireguard interfaces in distributed system. It supports Consul as backend.

This project is at an early stage development and is not production ready even though we're running it in our production. Run it at your own risk.

Autowire

Run WireGuard VPN with zero configuration.

This project provides a convenient way to automatically configure WireGuard. If you're running a Consul cluster and willing to configure WireGuard as VPN solution, you'll find this project very helpful.

Autowire picks an IP Address from the available pool of addresses, configures the local WireGuard interface as well as the peers and starts it. Autowire leverages distributed locking of Consul to ensure that picked IP address is not used by any other WireGuard peer. This method is described in the leader election guide.

Autowire also takes advantage of Consul blocking queries to watch nodes and KV, this allows Autowire to automatically reconfigure WireGuard Peers when nodes join or leave the Consul cluster.

Autowire uses Consul KV to store WireGuard interface and Peers configurations. This makes WireGuard config distributed and available to all nodes of the cluster.

Installation

Autowire doesn't install WireGuard. It's expected to be installed and available in the $PATH Autowire is meant to be installed on every node of the cluster where WireGuard is need to be configured. It's better to schedule it as system daemon in all cluster nodes.

1. Download a pre-compiled release from the release page.
2. Extract the binary.
3. Run it with ./autowire.

Configuration

Example usage:

• if-name: Network interface whose IP Address will be used for WireGuard endpoints
• wg-range: IP Address range. Autowire will pick address within this range
• wg-config-folder: Folder where WireGuard configurations will be stored
• wg-port: WireGuard Port

Find out the updated list of configurations in config.go

autowire --if-name enp0s2 --wg-range 192.168.10.0/24 --wg-config-folder /etc/wireguard --wg-port 51820

ToDo

• Code Refactoring and cleaning and enhance logging
• Write automated tests
• Support more backends (etcd, zookeeper,...)
• Support IPv6
• And a lot more coming

autowire's Issues

Wireguard PostDown

Autowire doesn't have an option to submit "PostDown" commands.

Server Config

[Interface]
Address = 10.200.200.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

support etcd backend

is there any plan to support etcd as a backend?

Add SAML support

Using Okta/O365/Google with rotating keys is a lot more secure than sharing static keys.

Thank you!

Rebind Consul to wireguard interface

First off congratulations on execution of a genius idea.
I was looking for a solution to exactly that problem.

One minor feature that I would like to see added would be to no also autoconfigure wireguard via consul but also move all consul instances over to the new wireguard network.

Is this even possible or would this create a chicken-egg problem where one relies on the other?

health check failed when runnnig autowire

error messages

chchang@warp:~$ ./autowire -wg-endpoint-ip 123.123.123.123 -wg-range 192.168.10.0/24 -wg-config-folder /tmp/wireguard -wg-port 12000
2021/08/04 10:34:31 INFO: Connecting to consul 127.0.0.1:8500
2021/08/04 10:34:31 ERROR: health check failed for 127.0.0.1:8500
2021/08/04 10:34:31 FATAL: Get "http://127.0.0.1:8500/v1/health/state/any": dial tcp 127.0.0.1:8500: connect: connection refused

why connect to tcp port 8500 ??