Comments (7)
The admin would be able to create multiple configuration templates.
The user would then be able to choose between the different configs (provided by the admin) just like selecting their platform.
from subspace.
Who would make the decision on who gets split vs full routed configurations? The end user or settings based on user information on the server side?
from subspace.
I just discovered this project and tested, works like a charm. It would be nice to have this feature.
- Different configurations based on templates defined by admin
- Be able to give access to different subnets depending on users (Is it possible on Wireguard ?)
from subspace.
So in terms of different configurations:
- Wireguard is designed to provide a secure tunnel from point A to point B
- Subspace provides Config files which can be used by a peer to connect to the server and become the server (IP Masquerade)
An end user can edit THEIR config client side to push whatever traffic they want to the Server. The server "AllowedIP" piece is to dictate that if i see PublicKey
x, it must also have PrivateIP
y. Subspace currently does very little in terms of controlling the flow of what goes where other than masquerading the entire Wireguard Interface as the server itself, thus all traffic exiting Subspace appears to be the Server and not a Peer.
If you wanted different routes etc, then you would have to control ip tables
on the serverside based on information about a clients PublicKey
or `Email
from subspace.
@jack1902 , currently on client side I have default route over wireguard interface. I suppose that generally it is admin responsibilities to manage such routes. It will save a lot of time for admins if there would be an ability to advertise only specific routes for group of users over UI( some kind of simple RBAC on network layer ).
from subspace.
The server "AllowedIP" piece is to dictate that if i see
PublicKey
x, it must also havePrivateIP
y. Subspace currently does very little in terms of controlling the flow of what goes where other than masquerading the entire Wireguard Interface as the server itself, thus all traffic exiting Subspace appears to be the Server and not a Peer.If you wanted different routes etc, then you would have to control
ip tables
on the serverside based on information about a clientsPublicKey
or `Email
Wouldn't it be possible to create different PrivateIP subnets per group/config template? Because wireguard ensures that the client is using an IP from that subnet, it would be easy to generate a ip tables rule set, that only allows the routes the admin wants for this config.
However I don't think that is necessary, because I would see it like stepan111 as an option to easily advertise specific routes. Sometimes I just don't want to route everything through wireguard, just the IPs of my company.
from subspace.
Currently, due to the way this project is layed out, it literally generates some configs and adds a rule to iptables to allow the whole subnet access. In order to achieve what you are asking it would need a major overhaul (something i currently don't have the time to achieve, unless others are willing to create a PR as a POC of what you are asking for)
Wireguard doesn't "ensure" that a client is using an IP from a specific subnet, you can actually assign the same PrivateIP to two clients and wireguard will work (it will cause all sorts of network packet loss, but thats besides the point). Subspace is ensuring that each client gets a unique IP Address to ensure that never happens. if you wanted to create different routes based on IP Address using a single Wireguard interface you would need to configure iptables (something that isn't currently done outside of a few simple commands in the docker containers entrypoint)
Ideally all these commands would be executed by something like go-iptables
but that requires changes to subspace which I currently don't have the time to dedicate (it requires frontend additions aswell to support the features you are asking for, and this project doesn't use any Javascript which makes this really frustrating to add)
from subspace.
Related Issues (20)
- --http-addr won't use ports >1023 HOT 2
- Suggestion: Linux & MacOS devices should have "PersistentKeepalive" in their profiles HOT 1
- Corrections to README to account for existing bugs, at least until addressed? HOT 2
- NAT_ENABLED error reported when set to false HOT 2
- Guidance needed, SAML and keycloak HOT 1
- Question: HA and user sync on SAML HOT 2
- Idea: custom DNS entries in the wg0.conf output; instead of the dnsmasq-forwarded DNS? HOT 1
- login does not continue past /signin HOT 2
- Make a new release? HOT 2
- Button to regenerate conf files? HOT 1
- DNS generation problem
- Terraform module implemented HOT 1
- Subspace webUI not listening on IPv4 address HOT 2
- SAML error with Jumpcloud HOT 3
- Custom ENV options not working correctly HOT 3
- dnsmasq config gets generated on each restart
- The container keeps restarting
- Static Route support HOT 1
- SSL_ERROR_INTERNAL_ERROR_ALERT HOT 1
- Abadonware?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from subspace.