IncusOS - Expose wireguard interface to instances

IncusOS
1

I have setup a wireguard interface for my IncusOS host (using incus admin os system network edit) and am now trying to 1) expose VMs to the wireguard network and 2) route all egress traffic through wireguard.

I believe, that 1) should be easily doable with proxies or network forwards, but I have no good idea how to solve 2).
I had thought about creating a bridge network that provides NAT on the wireguard interface - but I don’t really understand incus’s bnetworks well enough to know where to start.

So far I have not yet dared to look into OVN networking - if possible I’d like to solve this with bridge networking, but if not, I’m willing to take that step. :slight_smile:

Here’s the configuration for my wireguard interface:

$ incus admin os system network show incusos:
config:
# [...]
  wireguard:
  - addresses:
    - 10.234.200.2/32
    name: wg0
    peers:
    - allowed_ips:
      - 10.234.100.1/24
      endpoint: <REDACTED>:31900
      persistent_keepalive: 30
      public_key: <REDACTED>
    port: 51820
    private_key: <REDACTED>
    roles:
    - instances
    routes:
    - to: 10.234.100.1/24
      via: 10.234.100.1
# [...]
2

Start with describing the original problem.

3

2 should be easier than 1, no?

If you change the default route out to be the wireguard interface, then all traffic should go through there. And then you can probably use an ACL to prevent any traffic from getting to the local network that the main real NIC is connected to.

It should be something like this:

 routes:
    - to: 0.0.0.0/0
      via: 10.234.100.1
# [...]

The other VPN endpoint will need to be able to act as a default route, that is, it will need to have ip forwarding enabled and allowed through it’s firewalls.

For 1, you need to set up what’s called a point to site network. This is the original guide I used way back when I did point to site: WireGuard Point to Site Routing | Pro Custodibus

Or maybe this post is better: WireGuard Site to Site Configuration | Pro Custodibus

You need to understand how to configure wireguard to do this on Incus.

4

Thanks so much for the response.

Do you mean to set the route on the wireguard interface? I tried that, but the route doesn’t seem to be used (tested with checking the public IP from a container: dig +short -4 @resolver1.opendns.com a myip.opendns.com), which makes sense, because at that point I should have two routes for 0.0.0.0/0, one on the physical interface eth0 and one on the wireguard interface. Do I need to set route metrics manually?

As for 1 - the wireguard (point-to-point) routing works already. My plan was to simply forward traffic from the wireguard interface to containers, but I think I should be able to do that with proxy devices (so, different ports per instance). However, point-to-site routing looks even better, I’ll look into that.

5

If you have a shell on the IncusOS host, can you use ip routeto see what the default routes are?

It might be that the created wireguard interface isn’t the default route, yes.

6

There really is no easy way to get a shell on the IncusOS afaik. Unless you know a way to get it (apart from booting without TPM which I can’t do on that production server).