Are there any simple tools to manage a small WireGuard VPN with a handful of servers and something like low double-digit number of clients? By servers I mean Linux servers/VMs that expose some web services and clients are simply desktop/notebooks that need to access the servers, but don't expose services to the VPN.
From the description, this tool isn't what I want. I have configured a simple version by hand with Wireguard, but it did seem like raw WireGuard is too low-level for my purpose and my networking knowledge. Setting up the keys does need some level of automation for anything larger than a sandbox. And I didn't figure out a way to resolve domains within the VPN without interfering with the DNS on the clients for everything else.
I've never used it myself, but a sister comment mentioned related projects working with wireguard and innernet seems to be exactly that use case from a casual glance.
You can specify full cidr rules, so it should be possible to prohibit connections between nodes by segmenting the IPs
There are easier options around if all you wish is ssh access to your servers though.
Personally I'd recommend gravitational teleport, mainly because the name is so hilarious
Teleport also has some really neat approval workflows where you can say "2 of these 3 people need to approve a request for people in group Y to access servers in group X". The incoming request can ping you on slack and then you go to the teleport webui (U2F authenticated with SSO) to approve.
It also has some neat stuff around eBPF session recording if you want to be able to playback user sessions for high security environments. Teleport is good tech.
Bothers me that I can not set up a backup U2F stick.
Also, I had issues to configure it for my situation with no static IP and behind a proxy. I have it working but not really exactly how I wanted it. Maybe its my lack of understanding, I'm sure it could be made to do exactly what I want somehow.
All said, it pretty nice but I reverted to using the FIDO2 based keys sticks directly.
You might want to look at tailscale.com - I'm not 100% certain I understand exactly what you want - but it does allow any client to expose services; assuming non-server wireguard/tailscale-clients don't expose services/have firewall set up -I think it does what you need?
The problem is people keep thinking WireGuard is a VPN when it's more of a network tunnel + routing, like OpenSSH's -w option. A "real" VPN has a ton more features to provide the user experience needed for typical VPNs. I believe OpenVPN is still king here, probably one or two others as well.
Agreed. At a minimum it would be good to provide a way to protect wireguard credentials at rest, so they aren't just sitting out in the open on disk as a single factor for access to the network. If I had more experience I would love to submit a patch for the default client software, but I don't have much experience, and you don't want inexperienced crypto programming, especially for new features....
From the description, this tool isn't what I want. I have configured a simple version by hand with Wireguard, but it did seem like raw WireGuard is too low-level for my purpose and my networking knowledge. Setting up the keys does need some level of automation for anything larger than a sandbox. And I didn't figure out a way to resolve domains within the VPN without interfering with the DNS on the clients for everything else.