feat(vpn-gateway): switch from openvpn to wireguard (#1330)

thiagoalmeidasa · Nov 26, 2024 · 24c8853 · 24c8853
1 parent aeee2e4
commit 24c8853
Show file tree

Hide file tree

Showing 3 changed files with 34 additions and 32 deletions.
diff --git a/kubernetes/apps/vpn-gateway/gateway/app/helmrelease.yaml b/kubernetes/apps/vpn-gateway/gateway/app/helmrelease.yaml
@@ -36,7 +36,6 @@ spec:
           image:
             repository: docker.io/qmcgaw/gluetun
             tag: v3.39.1@sha256:6a8058e626763cbf735ac2f78c774dbb24fec2490bd9d9f7d67e22592cb4a991
-
         envFrom:
           - secretRef:
               name: vpn-gateway-pod-gateway
@@ -49,7 +48,7 @@ spec:
             cpu: 100m
             memory: 40Mi
           limits:
-            cpu: 150m
+            cpu: 100m
             memory: 100Mi
         networkPolicy:
           enabled: false
@@ -60,10 +59,13 @@ spec:
       - media
     settings:
       NOT_ROUTED_TO_GATEWAY_CIDRS: "10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
-      VPN_BLOCK_OTHER_TRAFFIC: true
-      VPN_INTERFACE: "tun0"
+      VPN_BLOCK_OTHER_TRAFFIC: false
+      # 51820 is for wireguard
+      VPN_TRAFFIC_PORT: 51820
+      # 1194 is for openvpn
+      # VPN_TRAFFIC_PORT: 1194
+      VPN_INTERFACE: "wg0"
       VPN_LOCAL_CIDRS: "10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
-      VPN_TRAFFIC_PORT: "1194"
       VXLAN_PORT: 4789
     webhook:
       image:

diff --git a/kubernetes/apps/vpn-gateway/gateway/app/networkpolicy.yaml b/kubernetes/apps/vpn-gateway/gateway/app/networkpolicy.yaml
@@ -15,11 +15,8 @@ spec:
     - toCIDR:
         - 0.0.0.0/0
       toPorts:
-        # - ports:
-        #     - port: "443"
-        #       protocol: TCP
         - ports:
-            - port: "1194"
+            - port: "51820"
               protocol: UDP
     - toEntities:
         - cluster

diff --git a/kubernetes/apps/vpn-gateway/gateway/app/secret.sops.yaml b/kubernetes/apps/vpn-gateway/gateway/app/secret.sops.yaml
@@ -4,22 +4,25 @@ metadata:
     name: vpn-gateway-pod-gateway
     namespace: vpn-gateway
 stringData:
-    #ENC[AES256_GCM,data:5VFXKxnw/q7JK9YS8Cj8nA==,iv:FJUXcsJr8RsoEtw8Nk3aVzPHmJqeK7DtuvZrulf8yrI=,tag:37NE6etcm99LeDQIVh1u/g==,type:comment]
-    VPN_SERVICE_PROVIDER: ENC[AES256_GCM,data:1NDHCZfQwQ==,iv:elyfMMYD2Bctf0xgLHGQnAJGnKZdKy3CRAQ6yMzU6I4=,tag:tTBy1lkOYhZ8gXNBs2nt5w==,type:str]
-    OPENVPN_USER: ENC[AES256_GCM,data:tpvt2k2UJ+M1NAklrF0UTAeK9Z7kgKS1,iv:bDiTU7tXIK9k6bslmPZFZVARPPAuqdLcEGK3+eBVfTY=,tag:sevVKtUzwo0DgJOo5gxfHw==,type:str]
-    OPENVPN_PASSWORD: ENC[AES256_GCM,data:bH9OIvwI+3SMnYHY7qwHwPMEifQce/Y2,iv:Fag9Gc2LoazB91yjES4ypVB3g17WXrcUoqBfu/3KTQk=,tag:kFWcBu4H3JApSGVatZT+6A==,type:str]
-    SERVER_COUNTRIES: ENC[AES256_GCM,data:oyZUy/wH,iv:q/VULXV2PMVRbfGap22bgZsQth2IC653X5ZZHfeVmc0=,tag:Z3Dl1jcci3dxC3F4ruxZpQ==,type:str]
-    SERVER_CATEGORIES: ENC[AES256_GCM,data:BjNK,iv:ntZXVdqB5jn5Ry+VgR8a00JrJ110wY4rNhkVH08EXLE=,tag:BRL6Nl+p2KAAuMpJMOl7vA==,type:str]
-    VPN_INTERFACE: ENC[AES256_GCM,data:mBr96Q==,iv:h2/pCbKymTHd7BDZniDQdFWb2NkyMHmhYdei6qJdsRg=,tag:Qrp6b1yUKVz4iVUear59CA==,type:str]
-    #ENC[AES256_GCM,data:zWHtsN8M6uLA,iv:VYOvQMnJXTc4qzEIJOWtzPKZ8JpcKAniS/iNBIkEuJQ=,tag:mMmpkTMMvfEV1ePJvzPWEw==,type:comment]
-    FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOT: ENC[AES256_GCM,data:iL9q,iv:D27dYOU6YYSewcBAc3PbFj4EJaR2g76yuaTHFvqoJT0=,tag:f0ot/D1OSyy1LybOaW7v6Q==,type:str]
-    FIREWALL_DEBUG: ENC[AES256_GCM,data:pnM=,iv:AR3mLavCb3dl+cg90mj1oh9xOulUEdp7P6t6ro3mBTk=,tag:91o5WVOU87xRPFEHrJqi9w==,type:str]
-    #ENC[AES256_GCM,data:IxdurA==,iv:IZbhb/NoB/bjj8vfSuroWpEX6nDWm0P9VatZTUqcR8M=,tag:BXXcbBOEQ/eT8c91yO1ImQ==,type:comment]
-    BLOCK_MALICIOUS: ENC[AES256_GCM,data:walS,iv:14oHbLGuhyRZZLYd9Ua5mY3Tw0sUcOGYDeV4EgSv+4w=,tag:qu9IVE007cg5ZmoISQL/5w==,type:str]
-    DOT: ENC[AES256_GCM,data:3pzX,iv:lE69Dwaods/ucF1Mrs2OKG3im+euIYkixR+B7ggT3o8=,tag:Ccuvc1rd39wtXgyZAnXpAQ==,type:str]
-    #ENC[AES256_GCM,data:6dAvqa/huZUlnKmCEwLv01YoDkU=,iv:O87dI8JGt6qEhAO8wFCG4c2C1IGHRJrGJfEl/15ap3g=,tag:7c9frBIvxyZS/JyiHg7uWQ==,type:comment]
-    DNS_ADDRESS: ENC[AES256_GCM,data:eObZXyNQY4HTYdcSOQ==,iv:WwG2auzVBB6xfY9pQalIKfWtCTfkofHq0R3BFMjD7Hc=,tag:br+ZrpvP8wdK7ClWb3/jJA==,type:str]
-    DNS_UPDATE_PERIOD: ENC[AES256_GCM,data:sVXQ,iv:R8HAIAxkKQkzKTq6euCyHBgn6RpEGb654/I7WaQa4fE=,tag:JNPmyiBQTb/JfECY79/JGw==,type:str]
+    #ENC[AES256_GCM,data:+kfM87645s/j2WpJcTbbfGHw,iv:h0GPqIvlcAxHJrMkm1mYzOz/QlP79rZF7vHydRW+vDE=,tag:FqFWgRWoJXXTbYBjfc/uYQ==,type:comment]
+    #ENC[AES256_GCM,data:DT4dWnqnkt2wNgMWj/8oxAMIuxRNf9PaMUtaC/Eh,iv:a5EZpogFwTtA1dmbPtTmRKXUPjpz49BBsSfSaDQtUDY=,tag:IRGhPMZ1Tdx8KZwtCHqGEw==,type:comment]
+    #ENC[AES256_GCM,data:oAc25tdTpXJzYGDzA/6SyGxZF40txapUZunbtF4P6dneFRpYpL/4,iv:67mlHMuFlF2aZ/utAI4tyrrsN75Kzv6HQLRViyxM2/Y=,tag:9Mw+/s3/vCmYHEVjn9+aGA==,type:comment]
+    #ENC[AES256_GCM,data:FmPYZrh4yN2Q3YyxscxQTUdcgDuDqs9/D3hCsL1CJcAIA1xskT9vxB/5uA==,iv:mBuxauE3XfkyicuhIFO3opIS0tY/h1AEyrH4qg0cP+g=,tag:q8WzLnNJK/s83YQGfOa4QQ==,type:comment]
+    SERVER_COUNTRIES: ENC[AES256_GCM,data:Gb1+5/UU,iv:AGvvoJggPVRWdRZci+HS8JbAcYkHb0zHjl3NQWVnc7Q=,tag:5FaYzYaJ16jOxU3g6zkwfw==,type:str]
+    SERVER_CATEGORIES: ENC[AES256_GCM,data:w3Ii,iv:GcVSMVaU+pja3/KdoM3zpDjXu4u2YPH3qqACvmSu7R0=,tag:/tAkhJNeMLVBX0jt/ybhaA==,type:str]
+    VPN_INTERFACE: ENC[AES256_GCM,data:X2bn,iv:rHbZGyt3tOKwMJa7tOzpiRfqvxjGcLgaWCnigq7IfZ4=,tag:mc32O5BopedHsGSF5KUzcQ==,type:str]
+    VPN_TYPE: ENC[AES256_GCM,data:k6xfZf0GodKb,iv:YuhLG0kPpYCfQQmKscMaSGnNHLUMHxreeFfQMhWdW+4=,tag:G0rZ9Jy1pArIfY6QyZVgiA==,type:str]
+    #ENC[AES256_GCM,data:ajDpx70gMswD,iv:7ZgD91wyvQu5LUjLhPqK0c2OXh5FmqL5zPcTYN6BqBg=,tag:2Mn7o3oJtkjfAioOmz4gfQ==,type:comment]
+    FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOT: ENC[AES256_GCM,data:Hpfm,iv:v0GvRd87gbMU3FTUKqEEJYhKoENLXcbEmaxrx5S3ia8=,tag:PD+XNENwBx9C3IJbZ8tCNw==,type:str]
+    FIREWALL_DEBUG: ENC[AES256_GCM,data:YSQ=,iv:pb1BA7S5q82Aabp5753QlTw/Wfa6BYGqBK5228HY6ic=,tag:LQIPbIKxeVyreXekg51KUA==,type:str]
+    #ENC[AES256_GCM,data:+2Wfzg==,iv:20ezH8XUlva0dSvRHtFYPl8DzQfCY1xnkrgE8NAh6tQ=,tag:8BSfnLgRATfvD598krcfZg==,type:comment]
+    BLOCK_MALICIOUS: ENC[AES256_GCM,data:2ips,iv:ScCbjhDyzMvmACel+OYokcsNXjX+eLP5pzlzSEalmRo=,tag:Ax78eg96KwXU6P6Vgt2Qzg==,type:str]
+    DOT: ENC[AES256_GCM,data:5PP2,iv:58Ry9h3ju5DJ4RzV2x0te3UNmRxWARurh+BpKKut6L8=,tag:XnH46wpJqrsjG/5kfckwTQ==,type:str]
+    #ENC[AES256_GCM,data:FugieG4A7CjjsMbGLABPM41/htE=,iv:W49DawpbM0ZLo5o6F3Fo9LGQdBPrZ7Kt9br/3MLqDmg=,tag:GtuU+3ylGsm7ifSG+o/QxQ==,type:comment]
+    DNS_ADDRESS: ENC[AES256_GCM,data:aiS615U17Q9PnR/9AQ==,iv:ukMbjzxROd6vpFEDjfPKowaYrMJN5C/h5c2y9Bbgyes=,tag:9yiXci3qwbNlwLiDWm5+GQ==,type:str]
+    VPN_SERVICE_PROVIDER: ENC[AES256_GCM,data:OfJkXIapVA==,iv:YUV7PJcXiWZu3xZzR2B3phe5QdNUzbLkv+6oobqAX/g=,tag:mngDjn3XF8d2cTenZkvd4g==,type:str]
+    WIREGUARD_PRIVATE_KEY: ENC[AES256_GCM,data:OHFLYjCOagPY7Rvm+tdYanINdrLlMVGEPwOv2OC75qT+Jxb8dIAtpxM/PnU=,iv:IaYgfqE86LgOIBr8ntrpbUUXWPwPH4hNe9k+2wL4noI=,tag:CF8iSK8Pz01t7q9Hg2B7LQ==,type:str]
+    WIREGUARD_DNS: ENC[AES256_GCM,data:+2/sgrFM2FhW7Xc5jA==,iv:66RJ8bpXA8E5jM0CpNEj5OeBQej7ZaUCeKPpnvfyISA=,tag:mOE4Vu0dluAvadUvcK0GRw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -29,14 +32,14 @@ sops:
         - recipient: age1w02zzfg0y4ast9mgnd9w0yuym0wqx6q967kmrmq355w4cnw0xytq2x369r
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0NXR1Vk5NNFJRVVFKdVVr
-            NnFNT0ViYmRURXJoMnl2V1czSFBnYkpvaGhjCnRpd0diU1E3dzczRnpac0xzOWxC
-            VDk0c25VMWU0SlJJK1ptOWhFVUxhSkEKLS0tIEpZWm0vcWVuNVFyTzFUSnlhNVNk
-            elhpNTVTT2JGMU93NEsxUkhMTmVqd2sKdnm/tgyDSiK192IXLfjbiTVvd9MUR8om
-            5gwC7fdjDat+69tpSxFeFdBssSlny72m8zvLhOACCGXggV6mNcbqtQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0eERDeDF6aGw0cElCNzIy
+            ejU4UTFRTlV3Sldhb0tyNTdvSmZEOHVFbjJnCnp3UmUxelgwN2pSdElZRE1xeTRW
+            emk2NUVqTkJISHhYakV0YmxLOEFXaDAKLS0tIEtLTXpFSVRXRFpWNEtTajJqdVY0
+            Y2N6RXd2UkQweVlDbU0vZmVXTmVMZkUKNWQxBG32e2ZngeTczz/556ZTElfG62M8
+            ujEeH5hKYfDUMKTEItfxgtsy3NwlVCEkvoo8Kf/H6BDuXdKMJW5bpg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-23T22:59:39Z"
-    mac: ENC[AES256_GCM,data:/7OThln1M5TXa+A+6eIxKvPvqusQCZbegWzkrfygTYC7a2r3VCiDgk+gIVwv+EBUbwzhwGCZyz/tMTQIuj4/VdRvfWWE5MP+aXv5Rsg1FP6bJ5VbfKwWSS1r+X7H4TvsJQzna7LPE2yTwMPd0mTbMxr8SLGJ1x/5FbdGdJXotGE=,iv:rvLzCYAVfFwF23++pxNYUuf9+OxWxv7vqHVe57L9PMA=,tag:DiGqZPZ7bBzkTEewdP5ZGQ==,type:str]
+    lastmodified: "2024-11-26T23:54:39Z"
+    mac: ENC[AES256_GCM,data:e0b4yT3j15RjYfkn6lZ5tm7ACO+HutLWWvG3xSt8xxjcyqT7e2HeX6FMcIMzIsZ8ynyUbT39EvRqxXss7D5cJ2rvaFfPK4D72a603K7KmG+nHMUxHEjrcgxqDnvU3WaIPgcbxYvILI5lGSLpMC2yai2BSMgm5RbiD4/H3tF6CF0=,iv:BF3C1bR+4FbL02nZEKFNxWR09PfroBd2tLt2SGKZr/E=,tag:fVeSWlKk14VoJvvRQtV5GA==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.0