wireguard-ui VS Nebula

# This file was generated using wireguard-ui (https://github.com/ngoduykhanh/wireguard-ui) # Please don't modify it manually, otherwise your change might get replaced. [Interface] Address = 10.25.0.1/24,2001:db8:abcd:AA10::1/60 ListenPort = 51820 PrivateKey = MTU = 1420 PostUp = iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT PostUp = iptables -t nat -A POSTROUTING -s 10.25.0.0/24 -o eth0 -j MASQUERADE PostUp = iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT PostDown = Table = auto [Peer] PublicKey = PresharedKey = AllowedIPs = 10.25.0.2/32,192.168.32.0/24,192.168.56.0/24,2001:db8:abcd:aa11::/64 # AllowedIPs are for site to site connection [Peer] PublicKey = PresharedKey = AllowedIPs = 10.25.0.3/32,10.0.0.0/16,2001:db8:abcd:aa12::/64 [Peer] PublicKey = PresharedKey = AllowedIPs = 10.25.0.4/32,2001:db8:abcd:aa13::/64 [Peer] PublicKey = PresharedKey = AllowedIPs = 10.25.0.5/32,2001:db8:abcd:aa14::/64 [Peer] PublicKey = PresharedKey = AllowedIPs = 10.25.0.6/32,2001:db8:abcd:aa15::/64

My previous experience was using this wireguard-ui container, super easy to create clients, and spits out a config file and/or QR code. Couldn't be any easier and removes all of the mumbo jumbo from the client's hands. And how that I'm looking at that package again I think I could potentially map it to the router's API, assuming there is one available for the VPN configs.

Wireguard log Uname info: Linux wireguard 6.2.0-20-generic #20-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 6 07:48:48 UTC 2023 x86_64 GNU/Linux 2023-08-13 22:01:40 **** It seems the wireguard module is already active. Skipping kernel header install and module compilation. **** 2023-08-13 22:01:41 **** Server mode is selected **** 2023-08-13 22:01:41 **** PersistentKeepalive will be set for: all **** 2023-08-13 22:01:42 **** SERVERURL var is either not set or is set to "auto", setting external IP to auto detected value of 78.72.85.114 **** 2023-08-13 22:01:42 **** External server port is set to 51820. Make sure that port is properly forwarded to port 51820 inside this container **** 2023-08-13 22:01:42 **** Internal subnet is set to 10.13.13.0 **** 2023-08-13 22:01:42 **** AllowedIPs for peers 0.0.0.0/0 **** 2023-08-13 22:01:42 **** PEERDNS var is either not set or is set to "auto", setting peer DNS to 10.13.13.1 to use wireguard docker host's DNS. **** 2023-08-13 22:01:42 **** Server mode is selected **** 2023-08-13 22:01:42 **** No changes to parameters. Existing configs are used. **** 2023-08-13 22:01:42 [custom-init] No custom files found, skipping... 2023-08-13 22:01:46 .:53 2023-08-13 22:01:46 CoreDNS-1.10.1 2023-08-13 22:01:46 linux/amd64, go1.20.7, 2023-08-13 22:01:47 [#] ip link add wg0 type wireguard 2023-08-13 22:01:47 [#] wg setconf wg0 /dev/fd/63 2023-08-13 22:01:47 [#] ip -4 address add 10.13.13.1 dev wg0 2023-08-13 22:01:47 [#] ip link set mtu 1420 up dev wg0 2023-08-13 22:01:47 [#] ip -4 route add 10.13.13.5/32 dev wg0 2023-08-13 22:01:47 [#] ip -4 route add 10.13.13.4/32 dev wg0 2023-08-13 22:01:47 [#] ip -4 route add 10.13.13.3/32 dev wg0 2023-08-13 22:01:47 [#] ip -4 route add 10.13.13.2/32 dev wg0 2023-08-13 22:01:47 [#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE 2023-08-13 22:01:47 [ls.io-init] done. wireguard ui logs 2023-08-13 21:50:03 ⇨ http server started on [::]:5000 2023-08-13 22:01:20 [#] ip link delete dev wg0 2023-08-13 22:01:21 [#] iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE 2023-08-13 22:01:27 [#] ip link add wg0 type wireguard 2023-08-13 22:01:27 [#] wg setconf wg0 /dev/fd/63 2023-08-13 22:01:27 [#] ip -4 address add 10.252.1.0/24 dev wg0 2023-08-13 22:01:27 [#] ip link set mtu 1450 up dev wg0 2023-08-13 22:01:27 [#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE 2023-08-13 22:01:29 Wireguard UI 2023-08-13 22:01:29 App Version : dev 2023-08-13 22:01:29 Git Commit : b55543f 2023-08-13 22:01:29 Git Ref : N/A 2023-08-13 22:01:29 Build Time : 08-13-2023 20:01:29 2023-08-13 22:01:29 Git Repo : https://github.com/ngoduykhanh/wireguard-ui 2023-08-13 22:01:29 Authentication : true 2023-08-13 22:01:29 Bind address : 0.0.0.0:5000 2023-08-13 22:01:29 Email from : 2023-08-13 22:01:29 Email from name : WireGuard UI 2023-08-13 22:01:29 Custom wg.conf : 2023-08-13 22:01:29 Base path : / 2023-08-13 22:01:29 ⇨ http server started on [::]:5000

you can always setup wireguard on your vps. its not that hard, this article by digital ocean article is quite thorough. That article has a lot on information so it looks harder than it actually is. You could also use something like this to help set things up faster. ive used that ui before but dont actively host it, only when i need to add peers. If you do actively host the ui make sure you dont expose it to the internet. Not because there is some security issue just because its imo not best practice. You can also use hamachi or any of the other hamachi like services

Maybe this, https://github.com/ngoduykhanh/wireguard-ui

I have 2 VPS servers running Debian 11. I have installed Wireguard, and Wureguard UI I can connect those two sites, but there is no traffic going between them. I want to create Site to site tunnel. And than later I Will also want to create Client VPN so I can use it on my laptop when needed. but currently I am not able to get any traffic between those 2 VPS servers.

A couple of days ago I stumbled upon this awesome project (https://github.com/ngoduykhanh/wireguard-ui). I immediately tried to get it running in order to access my local home network from the outside.

# This file was generated using wireguard-ui (https://github.com/ngoduykhanh/wireguard-ui)

Hello, i am running wireguard in a container on a raspberry4 with the docker-compose.yml from linuxserver. I'd like now to use a gui but I am stuck with the docker-compose example from ngoduykhanh / wireguard-ui

Personally, I’ve stopped using pi VPN quite a while ago. I’ve only used there console interface. Don’t know if there’s a official GUI by now. But there are a few gui alternatives available. I’ve been using this: https://github.com/ngoduykhanh/wireguard-ui

Nebula - Peer-to-peer overlay network. Developed and used internally by Slack. Similar to Tailscale but completely open source. Doesn't use WireGuard. Written in Go.

(I am a Nebula maintainer.) We recently merged support for gVisor-based services, although it's very new, and I don't know of much experimentation that's been done with it yet: https://github.com/slackhq/nebula/pull/965

Nebula, originally from Slack[0].

Wireguard rightly gets a lot of attention, but Nebula is a really simple and easy to deploy mesh network that is often overlooked.

It does lack a management GUI and that stuff is very much DIY.

[0] https://github.com/slackhq/nebula

Fair enough about the android mobile client... My use case only involves meshing linux appliances across various networks so we only need the nebula core binaries which are under MIT license

https://github.com/slackhq/nebula/blob/master/LICENSE

That's not at all confusing with Slack's Nebula. https://github.com/slackhq/nebula

Sounds like a bunch of your pain points are just related to needing an online CA or ICA. But, looking through the Nebula docs I don't know that it supports things like CRL addresses where you could host the CRL, or OCSP responders. Someone got support for an OCSP responder but never submitted a PR with completed code: https://github.com/slackhq/nebula/issues/72

Nebula is a scalable, cross-platform overlay networking tool focused on performance, simplicity, and security. This portable tool is equally adapted for linking a small number of computers or scaling to connect tens of thousands. It integrates encryption, security groups, certificates, and tunneling into a powerful, cohesive connectivity solution. Thanks for the recommendation go to jmeador42.

Replying to my own comment as I can no longer edit it:

The folks over at Slack had an interesting discussion regarding the the "battle of the VPNs" article published by Netmaker I sourced in my parent comment:

https://github.com/slackhq/nebula/discussions/911

Interesting. I thought recognized the logo, apparently seems to be a commercial support offering of https://github.com/slackhq/nebula and they support the "nebula" iOS app. I had been using for nebula/defined in the past.

Nebula: Is super easy to get running. It uses an interesting angle, working on the service and not just the device level. Unfortunately their NAT support seems to be still quite problematic and I am not going to maintain all those forwarded ports manually. There is a PR to support PCP but even if that ever gets applied I am not sure how well that will play with older routers. While it should be battle proven at slack, the community seems to be not that active. It still has the in-house tool that just got released.