Alte horus-opnsense-wireguard.md entfernen (ersetzt durch Ordner).
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
root
@@ -1,129 +0,0 @@
|
|||||||
# Horus ↔ OPNsense WireGuard (Site-to-Site)
|
|
||||||
|
|
||||||
Direkter WireGuard-Tunnel zwischen **OPNsense** (lokales Netz) und **Horus** (VPS), ohne Umweg über VM 101.
|
|
||||||
|
|
||||||
| | |
|
|
||||||
|---|---|
|
|
||||||
| **Horus** | `horus.jeanavril.com` / `207.180.222.207`, WG-Port **61951**, Tunnel-IP **10.1.1.1** |
|
|
||||||
| **OPNsense** | Tunnel-IP **10.1.1.22** (Peer `opnsense-jeanavril`) |
|
|
||||||
| **Peer auf Horus** | bereits angelegt (`/etc/wireguard/clients/opnsense-jeanavril/`) |
|
|
||||||
|
|
||||||
## Topologie
|
|
||||||
|
|
||||||
```
|
|
||||||
LAN/VLANs (192.168.x.0/24, 10.2.2.0/24)
|
|
||||||
↓
|
|
||||||
OPNsense (10.1.1.22) ←——WireGuard——→ Horus (10.1.1.1)
|
|
||||||
↓ ↓
|
|
||||||
10.2.2.0/24 → 192.168.10.10 (docbr0) Services / SSH / …
|
|
||||||
```
|
|
||||||
|
|
||||||
**10.2.2.0/24 (docbr0):** Horus schickt Traffic dorthin an OPNsense; OPNsense leitet weiter an **192.168.10.10** (bestehende Route/Gateway `VM101_DOCKER` — siehe [opnsense-docker-subnet-routing.md](opnsense-docker-subnet-routing.md)).
|
|
||||||
|
|
||||||
## Secrets abrufen (nicht im Git)
|
|
||||||
|
|
||||||
Private Key + Preshared Key liegen nur auf Horus:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
ssh jean@192.168.10.10 'ssh root@10.1.1.1 cat /etc/wireguard/clients/opnsense-jeanavril/client.conf'
|
|
||||||
```
|
|
||||||
|
|
||||||
Alternativ nur Einzelteile:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
ssh jean@192.168.10.10 'ssh root@10.1.1.1 cat /etc/wireguard/clients/opnsense-jeanavril/privatekey'
|
|
||||||
ssh jean@192.168.10.10 'ssh root@10.1.1.1 grep PresharedKey /etc/wireguard/wg0.conf | tail -1'
|
|
||||||
```
|
|
||||||
|
|
||||||
## Public Keys (Referenz)
|
|
||||||
|
|
||||||
| Rolle | Public Key |
|
|
||||||
|-------|------------|
|
|
||||||
| Horus (Server) | `qXxhgerS2ORypVadhKCBuxgIX5Pu4J75nSWazdtd+Qk=` |
|
|
||||||
| OPNsense (Client) | `walbWTYXAGOD1mOxPK+NwKT6qUhLyY0qieWBeTIbdXU=` |
|
|
||||||
|
|
||||||
## OPNsense einrichten
|
|
||||||
|
|
||||||
**VPN → WireGuard → Local → +**
|
|
||||||
|
|
||||||
| Feld | Wert |
|
|
||||||
|------|------|
|
|
||||||
| Enabled | ✓ |
|
|
||||||
| Name | `wg_horus` |
|
|
||||||
| Instance | (Default / neues Instance) |
|
|
||||||
| Listen port | leer oder `51820` (nur ausgehend nötig) |
|
|
||||||
| Tunnel Address | `10.1.1.22/32` |
|
|
||||||
| MTU | `1250` |
|
|
||||||
| Private key | aus `client.conf` `[Interface]` |
|
|
||||||
|
|
||||||
**VPN → WireGuard → Endpoints → +** (Peer Horus)
|
|
||||||
|
|
||||||
| Feld | Wert |
|
|
||||||
|------|------|
|
|
||||||
| Enabled | ✓ |
|
|
||||||
| Name | `horus` |
|
|
||||||
| Public Key | `qXxhgerS2ORypVadhKCBuxgIX5Pu4J75nSWazdtd+Qk=` |
|
|
||||||
| Shared Secret | PresharedKey aus `client.conf` |
|
|
||||||
| Allowed IPs | `10.1.1.0/24, 10.1.2.0/24, 10.1.3.0/24, 10.1.4.0/24, 10.8.0.0/24` |
|
|
||||||
| Endpoint Address | `horus.jeanavril.com` |
|
|
||||||
| Endpoint Port | `61951` |
|
|
||||||
| Persistent Keepalive | `25` |
|
|
||||||
|
|
||||||
Instance und Endpoint verknüpfen (Peer der Instance zuweisen — je nach OPNsense-Version unter **Local → Peers** oder Endpoint an Instance binden).
|
|
||||||
|
|
||||||
### Interface zuweisen
|
|
||||||
|
|
||||||
**Interfaces → Assignments → New → `wg_horus` (optX) → Save**
|
|
||||||
|
|
||||||
Interface aktivieren, ggf. **Block private networks** auf WG-Interface deaktivieren (Site-to-Site).
|
|
||||||
|
|
||||||
### Firewall
|
|
||||||
|
|
||||||
Mindestens:
|
|
||||||
|
|
||||||
| Regel | Interface | Direction | Source | Destination | Beschreibung |
|
|
||||||
|-------|-----------|-----------|--------|-------------|--------------|
|
|
||||||
| Pass | LAN / VLAN10 / … | in | Netz(e) | `10.1.1.0/24`, `10.8.0.0/24`, … | LAN → Horus-Netze |
|
|
||||||
| Pass | `optX` (WG) | in | `10.1.1.0/24` | LAN / VLANs | Horus → Heimnetz (Rückweg) |
|
|
||||||
|
|
||||||
Optional getrennt pro VLAN statt alias.
|
|
||||||
|
|
||||||
### Routing auf Horus (bereits gesetzt)
|
|
||||||
|
|
||||||
Horus kennt diese Netze hinter OPNsense:
|
|
||||||
|
|
||||||
`192.168.10.0/24`, `.20`, `.30`, `.40`, `.50`, `.60`, `10.2.2.0/24`, `10.1.1.22/32`
|
|
||||||
|
|
||||||
## Test
|
|
||||||
|
|
||||||
Auf OPNsense (Shell oder von LAN-Client):
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Nach Aktivierung — Handshake prüfen (auf Horus):
|
|
||||||
ssh jean@192.168.10.10 'ssh root@10.1.1.1 wg show wg0 | grep -A5 walbWTYX'
|
|
||||||
|
|
||||||
# Von LAN-PC:
|
|
||||||
ping 10.1.1.1
|
|
||||||
ssh root@10.1.1.1 # Key aus shared/ssh/horus-root
|
|
||||||
```
|
|
||||||
|
|
||||||
Handshake auf Horus sichtbar, sobald OPNsense aktiv ist (`latest handshake`).
|
|
||||||
|
|
||||||
## VM 101 (optional später)
|
|
||||||
|
|
||||||
VM 101 nutzt derzeit **10.1.1.5** als eigenen WG-Peer (`server5`) und advertised u.a. `10.2.0.0/16` an Horus.
|
|
||||||
|
|
||||||
Wenn OPNsense stabil läuft:
|
|
||||||
|
|
||||||
1. **Horus:** beim Peer `server5` (VM) die LAN-Routen aus `AllowedIPs` entfernen — nur `10.1.1.5/32` behalten (VM braucht Horus ggf. noch für Cert-Rsync).
|
|
||||||
2. **VM:** `wg0` abschalten, wenn alles über OPNsense geht und Cert-Sync angepasst ist.
|
|
||||||
|
|
||||||
Nicht beides parallel dieselben Subnetze an Horus announcen (Routing-Konflikt).
|
|
||||||
|
|
||||||
## Referenzen
|
|
||||||
|
|
||||||
| Thema | Doc |
|
|
||||||
|-------|-----|
|
|
||||||
| Horus SSH-Keys | [ssh/README.md](ssh/README.md#horus-vps-wireguard) |
|
|
||||||
| docbr0 / 10.2.2.0/24 | [../pve1/guests/vm101-ubuntu/docbr0-opnsense-routing.md](../pve1/guests/vm101-ubuntu/docbr0-opnsense-routing.md) |
|
|
||||||
| VLAN-Übersicht | [infrastruktur-netzwerk.md](infrastruktur-netzwerk.md) |
|
|
||||||
Reference in New Issue
Block a user