WireGuard Part 7: Creating Full Mesh Networks with WireGuard and Netmaker

This article was last updated on: February 7, 2024 pm

Synopsis of the series:

  1. WireGuard Part 1: What is a VPN?
  2. WireGuard Part 2: Introduction to WireGuard - Fast, Modern, Secure VPN Tunnels
  3. WireGuard Part 3: WireGuard Installation
  4. WireGuard article series (4): WireGuard is quick to get started
  5. WireGuard Part 5: Introduction to Netmaker - A Platform for Creating and Managing WireGuard Networks
  6. WireGuard article series (6): Netmaker installation

Finally, an important milestone has been reached, creating a Full Mesh network with WireGuard + Netmaker. Implement:

  • Multi-cloud server intranet interconnection
  • Home network routers are interconnected to the internal network
  • Full Mesh Network Node Access other home devices (e.g. computers, NAS) through routers
  • Office equipment intranet interconnection
  • Mobile phone intranet interconnection

The specific architecture diagram is shown in the following figure:

我的 WireGuard 网络架构概述

Start configuring!

Create a Full Mesh network

Start by creating a network through the Netmaker Dashboard and configure it as follows:

Netmaker 创建网络

  1. Network name: fill in on demand (can be automatically generated)
  2. IPv4 address range: fill in on demand (can be automatically generated)
  3. Enable: UDP punching (for devices that require NAT to access the Full Mesh network)
  4. Down: Is Local Network (shut down if all devices are not connected to the local network)
  5. Off: Dual-stack (recommended to reduce complexity)

Once created, you can click again Network Details Edit the details, as shown below:

Include:

  • IPv6 address range
  • Network interface name
  • Listening port
  • Postup
  • Postdown
  • Keepalive
  • Default external DNS
  • MTU
  • Whether to allow node registration without access keys (shutdown recommended for security reasons)

View the status of the node where Netmaker is located

After the network is created, the node where Netmaker resides automatically joins as a client Nodes page to view its status and information, as follows:

Netmaker Node 状态

Netmaker Node 详细信息

You can view its DNS records on the DNS page as follows: (The network name I actually configured is: private)

Netmaker DNS 记录

Create an access key

at Home / Access Keys page, create a specified number of clients (such as 10, then this key will automatically expire after 10 uses, and other clients can no longer use this key to join the network), as shown below:

Netmaker 创建访问密钥

After creation, the specific command to join the network will pop up, as follows:

Netclient 加入网络的命令

The specific command is as follows:

Linux：

1
curl -sfL https://raw.githubusercontent.com/gravitl/netmaker/master/scripts/netclient-install.sh | VERSION=v0.9.1 KEY=$NETMAKER_TOKEN sh -

Docker:

1
docker run -d --network host  --privileged -e TOKEN=$NETMAKER_TOKEN -v /etc/netclient:/etc/netclient --name netclient gravitl/netclient:v0.9.1

Windows (PowerShell Admin):

1
. { iwr -useb  https://raw.githubusercontent.com/gravitl/netmaker/master/scripts/netclient-install.ps1 } | iex; Netclient-Install -version "v0.9.1" -token "$NETMAKER_TOKEN"

Manual installation:

1
./netclient join -t $NETMAKER_TOKEN

Join the network through Netclient

According to the above architecture diagram, the nodes that need to be added are sorted out as follows:

  1. Linux: Huawei, Tianyi, Tencent, Alibaba, Baidu cloud servers, joined through Linux, Docker, or manual installation.
  2. Windows: Office computers (according to the architecture diagram, home computers and NAS are directly routed through the home router, without installing netclient and wireguard), and join through Windows or manual installation.
  3. OpenWrt: Home router, joined by manual installation.
  4. Android: Phone, unable to install netclient for the time being, passExternal clientsway to join.

Linux and Windows needless to say, just join in.

Linux

After Linux executes the command, it will prompt that the join is successful, at the same time

On the one hand, move netclient to /etc/netclient/ and pull the configuration file from Netmaker as follows:

1
2
3
4
5
6
7
8
9
# tree .
.
├── config
│   ├── backup.netconfig-private
│   ├── netconfig-private
│   ├── nettoken-private
│   ├── secret-private
│   └── wgkey-private
└── netclient

On the other hand, configure NetClient as a systemd service and start it, going to Netmaker every 15s to check in. The details are as follows:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
# ls -l *netclient*
-rw-r--r-- 1 root root 166 Dec  7 02:04 netclient.service
-rw-r--r-- 1 root root 172 Dec  7 02:04 netclient.timer

# cat netclient.service
[Unit]
Description=Network Check
Wants=netclient.timer

[Service]
Type=simple
ExecStart=/etc/netclient/netclient checkin -n all

[Install]
WantedBy=multi-user.target

# cat netclient.timer
[Unit]
Description=Calls the Netmaker Mesh Client Service
Requires=netclient.service

[Timer]
Unit=netclient.service

OnCalendar=*:*:0/15

[Install]
WantedBy=timers.target

The log of check in success is as follows:

1
2
3
4
# ./netclient checkin -n all
2021/12/12 23:10:10 [netclient] running checkin for all networks
2021/12/12 23:10:11 [netclient] checked in successfully for private
2021/12/12 23:10:12 [netclient] checked in successfully for private

Windows

Windows operations are similar, with directories in:C:\ProgramData\Netclient, the system services are as follows:

Netclient Windows 服务

⚠️ note：

My computer is performing PowerShell script downloads with or without an agent configured winsw.exe The process has not been able to download the complete whole, in this case, the remedy is as follows.

  1. Download WinSW-x64.exe:https://github.com/winsw/winsw/releases/download/v2.11.0/WinSW-x64.exe and rename to winsw.exe
  2. Copy the file to:C:\ProgramData\Netclient directory
  3. Run PowerShell with an administrator, run:C:\ProgramData\Netclient\winsw.exe install Installed as a Windows service
  4. Then run:C:\ProgramData\Netclient\winsw.exe start to start.
  5. Verify that it is installed and started in Windows Services:

OpenWrt

For router OpenWrt, you can compile the netclient that can be run by yourself, and then run it manually to join successfully.

After successful joining, in order to run periodically, you can add the following to periodic checkins in crontab:

1
2
* * * * * /etc/netclient/netclient checkin --network all &> /dev/null
* * * * * sleep 15; /etc/netclient/netclient checkin --network all &> /dev/null

These two planned tasks were realized in disguise Check in is performed every 15 seconds Purpose.

brief summary

At this point, in addition to home computers and NAS devices on the home network, as well as mobile phones, others have joined the Full Mesh network and can ping each other.wg show You can also see the information of peers. As follows:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
# ping 10.88.60.1
PING 10.88.60.1 (10.88.60.1) 56(84) bytes of data.
64 bytes from 10.88.60.1: icmp_seq=1 ttl=64 time=46.1 ms
64 bytes from 10.88.60.1: icmp_seq=2 ttl=64 time=46.0 ms
64 bytes from 10.88.60.1: icmp_seq=3 ttl=64 time=46.1 ms
64 bytes from 10.88.60.1: icmp_seq=4 ttl=64 time=46.0 ms
^C
--- 10.88.60.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 45.963/46.034/46.073/0.044 ms

# wg show
interface: nm-private
  public key: <hidden>
  private key: (hidden)
  listening port: 51821
  fwmark: 0x221b

peer: kXmPHKYv6L5c<hidden>nIex7Yd5JFyq6NZB6dFE=
  endpoint: <hidden>:51821
  allowed ips: 10.88.60.8/32
  latest handshake: 25 seconds ago
  transfer: 1.74 MiB received, 618.27 KiB sent
  persistent keepalive: every 20 seconds

peer: OK7B2QzY8r<hidden>SfIr/tqinSGBd55gjsmgjo=
  endpoint: <hidden>:51821
  allowed ips: 10.88.60.3/32
  latest handshake: 29 seconds ago
  transfer: 1.25 MiB received, 316.43 KiB sent
  persistent keepalive: every 20 seconds

peer: +SMVJLu<hidden>KkUVSk2aKPdTJ9rd+lK1C4=
  endpoint: <hidden>:51822
  allowed ips: 10.88.60.6/32
  latest handshake: 52 seconds ago
  transfer: 316.42 KiB received, 1.25 MiB sent
  persistent keepalive: every 20 seconds

peer: U73tngxoP<hidden>YzAhIS8hTfO3Chno3U04=
  endpoint: <hidden>:51821
  allowed ips: 10.88.60.7/32
  latest handshake: 56 seconds ago
  transfer: 316.65 KiB received, 1.25 MiB sent
  persistent keepalive: every 20 seconds

peer: 5lnsgrK3b<hidden>9x7bdM2nsqqC2CYUY=
  endpoint: <hidden>:51821
  allowed ips: 10.88.60.1/32
  latest handshake: 1 minute, 9 seconds ago
  transfer: 443.09 KiB received, 1.16 MiB sent
  persistent keepalive: every 20 seconds

peer: 6d9cRCdKcb<hidden>QvfM6AwqoNRADC4VM=
  endpoint: <hidden>:51821
  allowed ips: 10.88.60.4/32
  latest handshake: 1 minute, 36 seconds ago
  transfer: 1.25 MiB received, 316.25 KiB sent
  persistent keepalive: every 20 seconds

peer: SiNrI37GI<hidden>+G9h0H6IuZJ2iTtGWo=
  endpoint: <hidden>:61401
  allowed ips: 10.88.60.9/32
  latest handshake: 3 days, 1 hour, 47 minutes, 21 seconds ago
  transfer: 3.22 MiB received, 9.55 MiB sent
  persistent keepalive: every 20 seconds

Join the network through an external client

For mobile phones, it is currently necessary to join the network through an external client. The specific steps are as follows:

  1. Select a Node with a static IP address over the public network Ingress Gateway(can be understood as WireGuard’s relay server), used to receive traffic from mobile phones and forward, the configuration is also very simple, in Nodes page, click the following to configure a node:
    将某一 Node 配置为 Ingress Gateway
  2. Download and install the WireGuard native client on your phone (Android device);
  3. Create an External Client that generates a WireGuard configuration file that the WireGuard client can download or scan the QR code to connect. As shown in the following figure:
    Netmaker Ext. Client

Node accesses the home intranet through a router

Here the computers and NAS of the home intranet do not directly join the Full Mesh network (you can also join directly, the steps are the same as above), but access the Full Mesh network through the router.

So far, we have only built a point-to-point mesh network, and each node can be directly connected to each other through WireGuard’s private network IP. But we can be a little bolder and give each node access to the LAN IP of the home network. Taking OpenWrt as an example, suppose OpenWrt runs at home and the LAN IP at home is 192.168.2.0/24How to make all other nodes access this LAN?

In fact, it is very simple, you can set a node as an Egress Gateway, allowing the interiorTraffic for the network is forwarded toexteriorThe specified IP range. HereinteriorThis refers to the WireGuard private network, which is in this article 10.88.60.0/24；exteriorNetwork refers to the home LAN network segment.

The operation steps are as follows:

Netmaker 创建 Egress Gateway

Fill in the LAN CIDR block (for example:192.168.2.0/24 ) and an egress NIC (e.g., eth0). As shown in the following figure:

Netmaker 创建 Egress Gateway - 2

Once configured, the relevant iptables rules are added to the Postup and Postdown configurations of the OpenWrt node. As shown in the following figure:

Egress Gateway 自动配置路由规则

wg show Check it out below:

peer: kXmPHKYv6L5cX<hidden>d5JFyq6NZB6dFE=
  endpoint: <hidden>:51821
  allowed ips: 10.88.60.8/32, 192.168.2.0/24
  latest handshake: 25 seconds ago
  transfer: 1.74 MiB received, 618.27 KiB sent
  persistent keepalive: every 20 seconds

The specific rules are:

1
2
3
4
5
# Postup
iptables -A FORWARD -i nm-private -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Postdown
iptables -D FORWARD -i nm-private -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

In addition to this, the relevant routing tables are added to all other nodes:

1
2
$ ip route|grep "192.168.2.0/24"
192.168.2.0/24 dev nm-private scope link

Eventually, all nodes will have access to OpenWrt’s LAN IP.

summary

At this point, we have finally completed an important milestone in the WireGuard series: configuring the Full Mesh network with WireGuard + Netmaker and opening up the home LAN. 🎉🎉🎉