summaryrefslogtreecommitdiffstats
path: root/src/plugins/wireguard/README.rst
blob: ead412519b7287f6a575cc36e489a37eb90853a3 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
.. _wireguard_plugin_doc:

Wireguard vpp-plugin
====================

Overview
--------

This plugin is an implementation of `wireguard
protocol <https://www.wireguard.com/>`__ for VPP. It allows one to
create secure VPN tunnels. This implementation is based on
`wireguard-openbsd <https://git.zx2c4.com/wireguard-openbsd/>`__.

Crypto
------

The crypto protocols:

-  blake2s `[Source] <https://github.com/BLAKE2/BLAKE2>`__

OpenSSL:

-  curve25519
-  chachapoly1305

Plugin usage example
--------------------

Create wireguard interface
~~~~~~~~~~~~~~~~~~~~~~~~~~

::

   > vpp# wireguard create listen-port <port> private-key <priv_key> src <src_ip4> [generate-key]
   > *wg_interface*
   > vpp# set int state <wg_interface> up
   > vpp# set int ip address <wg_interface> <wg_ip4>

Add a peer configuration:
~~~~~~~~~~~~~~~~~~~~~~~~~

::

   > vpp# wireguard peer add <wg_interface> public-key <pub_key_other> endpoint <ip4_dst> allowed-ip <prefix> port <port_dst> persistent-keepalive [keepalive_interval]
   > vpp# *peer_idx*

Add routes for allowed-ip:
~~~~~~~~~~~~~~~~~~~~~~~~~~

::

   > ip route add <prefix> via <wg_ip4> <wg_interface>

Show config
~~~~~~~~~~~

::

   > vpp# show wireguard interface
   > vpp# show wireguard peer

Remove peer
~~~~~~~~~~~

::

   > vpp# wireguard peer remove <peer_idx>

Delete interface
~~~~~~~~~~~~~~~~

::

   > vpp# wireguard delete <wg_interface>

Main next steps for improving this implementation
-------------------------------------------------

1. Use all benefits of VPP-engine.
2. Add peers roaming support