# Remote Access

A tab each for IKEv2, OpenVPN and WireGuard access: the settings, whether the router
runs the system, why an enabled one does not run yet, and the connected clients.

## Edit

Enables or disables the system and sets its address pool (for WireGuard the address of `wg0`) and
its port, with OpenVPN's protocol. The router applies a change in the background.

IKEv2 and OpenVPN also need the router's `wan.local_fqdn` and its VPN server certificate. A cloud
firewall in front of the router, such as an Azure network security group, must allow the OpenVPN
and WireGuard ports itself.

## IKEv2

The IPsec security associations, child SAs, connections and connection children of IKEv2 access.

**DNS domains** (Edit, one per line): the domains, with their subdomains, the clients resolve with
the router's DNS, such as `internal.cloudapp.net`; other names stay with the clients' own DNS. The
router pushes them over IKEv2, and the Apple VPN profile names them, so a Mac, iPhone or iPad needs
a newly downloaded profile after a change.

## OpenVPN

Users connect with the client profile downloaded on the [Users](users.md) tab, and sign in with
their password and, when enrolled, the code.

## WireGuard

- **Connections:** each peer with its user, IPs, endpoint, handshake and traffic.
- **Peers:** the devices of the VPN users, each with its user, public key and IPs.
  - **Add peer:** the user, the device's public key and the IPs, which start as the next free
    address of the `wg0` network. The router checks that keys are unique and IPs do not overlap.
  - The eye opens the device's configuration; the download gives `<user>-<n>.conf`, with a
    placeholder for the device's private key, which the router never has.
  - The remove button removes a peer after a confirmation.
- **Server:** the router's public key with a copy icon, the endpoint and the allowed IPs a device
  needs; **Show config** opens a device configuration with placeholders.
- In the configuration dialogs a switch leaves out the `[Interface]` and `PrivateKey` lines, which
  WireGuard for Windows fills in for a new empty tunnel.