https://github.com/christf/wg-broker

This repository contains a wireguard broker that dynamically accepts connections. This is useful for building freifunk networks.
https://github.com/christf/wg-broker

Last synced: about 1 month ago
JSON representation

This repository contains a wireguard broker that dynamically accepts connections. This is useful for building freifunk networks.

• Host: GitHub
• URL: https://github.com/christf/wg-broker
• Owner: christf
• License: apache-2.0
• Created: 2018-10-08T06:53:27.000Z (about 6 years ago)
• Default Branch: master
• Last Pushed: 2023-07-04T21:10:23.000Z (over 1 year ago)
• Last Synced: 2024-08-02T12:50:03.814Z (4 months ago)
• Language: Shell
• Size: 30.3 KB
• Stars: 7
• Watchers: 5
• Forks: 2
• Open Issues: 3
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-starred - christf/wg-broker - This repository contains a wireguard broker that dynamically accepts connections. This is useful for building freifunk networks. (others)

README

        
# wg-broker

This repository contains a wireguard broker that dynamically accepts connections. This is useful for building freifunk networks.

## Dependencies

- jq

- openbsd-netcat

- socat

Debian: `apt install netcat-openbsd jq socat`

# Protocol Documentation

The wireguard broker allows peers to form a VPN network. A blacklist / 

whitelist could be implemented on the server.

For now, one peer that initializes the connection offers a wireguard public key 

to the control port of the wg-broker:

```

{

  "version":1,

  "pubkey": "THIS_IS_THE_PUBLIC_KEY_AS_GENERATED_BY_WIREGUARD_IN_BASE64_ENCODING="

}

```

The peer replies with a json message. In case of a successful setup this 

structure is returned:

```

{

  "version":1,

  "port": ,

  "time": ,

}

```

or, in case of an error a message containing an error object. Currently only 

one error can be returned:

```

{

  "version": 1,

  "error": {

    "code":1,

    "reason": "Remote peer is not accepting additional connections"

  }

}

```

In case of a successful setup, the initiating host is expected to:

* in case the own clock differs a lot from the peer, set its current system 

  time to the one provided by the broker. This compensates the situation 

  that NTP usually only works when already connected to the freifunk network.

* configure a new wireguard interface to connect to the hostname and port 

  utilizing the private/public key that was provided in the initial message.