linux-cloud-router/docs/remote-access.md

Remote Access

A tab each for IKEv2, OpenVPN and WireGuard access: the settings, whether the router runs the system, why an enabled one does not run yet, and the connected clients.

Edit

Enables or disables the system and sets its address pool (for WireGuard the address of wg0) and its port, with OpenVPN's protocol. The router applies a change in the background.

IKEv2 and OpenVPN also need the router's wan.local_fqdn and its VPN server certificate. A cloud firewall in front of the router, such as an Azure network security group, must allow the OpenVPN and WireGuard ports itself.

IKEv2

The IPsec security associations, child SAs, connections and connection children of IKEv2 access.

DNS domains (Edit, one per line): the domains, with their subdomains, the clients resolve with the router's DNS, such as internal.cloudapp.net; other names stay with the clients' own DNS. The router pushes them over IKEv2, and the Apple VPN profile names them, so a Mac, iPhone or iPad needs a newly downloaded profile after a change.

OpenVPN

Users connect with the client profile downloaded on the Users tab, and sign in with their password and, when enrolled, the code.

WireGuard

• Connections: each peer with its user, IPs, endpoint, handshake and traffic.
• Peers: the devices of the VPN users, each with its user, public key and IPs.
  • Add peer: the user, the device's public key and the IPs, which start as the next free address of the wg0 network. The router checks that keys are unique and IPs do not overlap.
  • The eye opens the device's configuration; the download gives <user>-<n>.conf, with a placeholder for the device's private key, which the router never has.
  • The remove button removes a peer after a confirmation.
• Server: the router's public key with a copy icon, the endpoint and the allowed IPs a device needs; Show config opens a device configuration with placeholders.
• In the configuration dialogs a switch leaves out the [Interface] and PrivateKey lines, which WireGuard for Windows fills in for a new empty tunnel.