Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/valdikss/nat-traversal-github-actions-openvpn-wireguard

OpenVPN and WireGuard server on GitHub Actions: representative NAT traversal case
https://github.com/valdikss/nat-traversal-github-actions-openvpn-wireguard

nat nat-hole-punching nat-traversal openvpn udp-hole-punching wireguard

Last synced: 16 days ago
JSON representation

OpenVPN and WireGuard server on GitHub Actions: representative NAT traversal case

Awesome Lists containing this project

README 

        
OpenVPN and WireGuard server on GitHub Actions: representative NAT traversal case

=========================



It's not possible to run server software on GitHub Actions using regular methods: the worker virtual machine is placed behind Network Address Translation (NAT), which prevents it from receiving direct inbound TCP/UDP connections.  

This repository consists of GitHub Actions jobs for OpenVPN and WireGuard VPN servers which traverse NAT, making possible to establish VPN connection to the Actions worker machine directly, without any additional tunnel, third-party service, or port forwarding software.



This is a **step-by-step, thoroughly documented practical UDP NAT traversal showcase using GitHub Actions with OpenVPN/WireGuard servers as an example, with only stock software from Ubuntu repositories**.



NAT used on GitHub Actions is one of the most common ones: it's not the friendliest and not the ugliest.



> Independent Mapping, Port Dependent Filter, random port, will hairpin



Once you learn the traversal principle used in this repository, you'll understand the general idea behind any modern NAT traversal implementation.



## How to use



It is assumed that you run Linux.



1. Fork this repository and clone your fork

2. Place your SSH public key into `authorized_keys` file, git commit it

3. Make sure you have `stun-client` by hanpfei installed (`apt install stun-client` on Debian/Ubuntu, `dnf install stun` on Fedora), as well as `openvpn` and/or `wireguard`

3. Run `./run.sh openvpn` for OpenVPN server or `./run.sh wireguard` for WireGuard server

4. Navigate to **Actions** tab of your repository, open corresponding job and check either `Print OpenVPN connection string` or `Print WireGuard configuration file` for VPN connection instructions

5. Connect to the VPN using the instructions from the Action

6. After connecting to the VPN, run `ssh [email protected]` to connect to your Actions worker



NOTE: your IP address will be visible in the commit history for everyone. Set the repository as private if you find this inappropriate for your threat model.



## How does it work



The Action jobs ([openvpn](https://github.com/ValdikSS/nat-traversal-github-actions-openvpn-wireguard/blob/master/.github/workflows/openvpn-server.yml), [wireguard](https://github.com/ValdikSS/nat-traversal-github-actions-openvpn-wireguard/blob/master/.github/workflows/wireguard-server.yml)) in this repository:



* Wait for a specific commit message with IP address and port of the client

* Set up OpenVPN UDP/WireGuard server behind Actions worker NAT

* Determine external IP address and NAT port mapping for VPN port using STUN client

* Punch NAT with empty UDP packet every 28 seconds towards client's IP address and port from the VPN server port using `nping` until the client is connected



The client-side run.sh script:



* Checks for NAT type on the client

* Determines mapped external source port using STUN

* git commits & pushes client's external IP address and mapped port discovered with STUN, as well as local source port to include it in configuration files and one-liners generated by the Actions job

* Keeps NAT mapping alive for non-port-preserving NATs



## Questions and answers



#### ‣ Does it work?



Yes, it bypasses NAT for UDP traffic of GitHub Actions worker running on Microsoft Azure infrastructure behind NAT of the following type:



> Independent Mapping, Port Dependent Filter, random port, will hairpin



You will be able to connect to WireGuard/OpenVPN server running on your Actions worker directly, which is not possible otherwise.



#### ‣ But can I connect to it behind another NAT, from the client side?



Yes, you can connect to it if you're behind the most common NAT with "Independent Mapping" characteristics, either port-preserving or non-port-preserving (random port).



`run.sh` script will do everything for you, including NAT type identification.



#### ‣ Independent mapping? Port preserving? I know only Cone and Symmetric NAT!



The cone/port-restricted/symmetric NAT nomenclature is a bit outdated and does not describe all the NAT types found on the real Internet precisely.  

Actions worker is placed after port-restricted NAT (which also does not preserve the source port).



*For NAT type identification, refer to [RFC4787](https://datatracker.ietf.org/doc/html/rfc4787) and [RFC5128](https://datatracker.ietf.org/doc/html/rfc5128)*



#### ‣ Where can I get more information?



The Actions workflow files (jobs) has detailed comments for each step, read it for [openvpn](https://github.com/ValdikSS/nat-traversal-github-actions-openvpn-wireguard/blob/master/.github/workflows/openvpn-server.yml) and [wireguard](https://github.com/ValdikSS/nat-traversal-github-actions-openvpn-wireguard/blob/master/.github/workflows/wireguard-server.yml)



General NAT traversal information:



* https://bford.info/pub/net/p2pnat/

* https://tailscale.com/blog/how-nat-traversal-works/



Even more detailed writeup, covering all NAT aspects, will follow later.