42 lines
2.1 KiB
Markdown
42 lines
2.1 KiB
Markdown
# Remote Access
|
|
|
|
A tab each for IKEv2, OpenVPN and WireGuard access: the settings, whether the router
|
|
runs the system, why an enabled one does not run yet, and the connected clients.
|
|
|
|
## Edit
|
|
|
|
Enables or disables the system and sets its address pool (for WireGuard the address of `wg0`) and
|
|
its port, with OpenVPN's protocol. The router applies a change in the background.
|
|
|
|
IKEv2 and OpenVPN also need the router's `wan.local_fqdn` and its VPN server certificate. A cloud
|
|
firewall in front of the router, such as an Azure network security group, must allow the OpenVPN
|
|
and WireGuard ports itself.
|
|
|
|
## IKEv2
|
|
|
|
The IPsec security associations, child SAs, connections and connection children of IKEv2 access.
|
|
|
|
**DNS domains** (Edit, one per line): the domains, with their subdomains, the clients resolve with
|
|
the router's DNS, such as `internal.cloudapp.net`; other names stay with the clients' own DNS. The
|
|
router pushes them over IKEv2, and the Apple VPN profile names them, so a Mac, iPhone or iPad needs
|
|
a newly downloaded profile after a change.
|
|
|
|
## OpenVPN
|
|
|
|
Users connect with the client profile downloaded on the [Users](users.md) tab, and sign in with
|
|
their password and, when enrolled, the code.
|
|
|
|
## WireGuard
|
|
|
|
- **Connections:** each peer with its user, IPs, endpoint, handshake and traffic.
|
|
- **Peers:** the devices of the VPN users, each with its user, public key and IPs.
|
|
- **Add peer:** the user, the device's public key and the IPs, which start as the next free
|
|
address of the `wg0` network. The router checks that keys are unique and IPs do not overlap.
|
|
- The eye opens the device's configuration; the download gives `<user>-<n>.conf`, with a
|
|
placeholder for the device's private key, which the router never has.
|
|
- The remove button removes a peer after a confirmation.
|
|
- **Server:** the router's public key with a copy icon, the endpoint and the allowed IPs a device
|
|
needs; **Show config** opens a device configuration with placeholders.
|
|
- In the configuration dialogs a switch leaves out the `[Interface]` and `PrivateKey` lines, which
|
|
WireGuard for Windows fills in for a new empty tunnel.
|