307 lines
7.7 KiB
Markdown
307 lines
7.7 KiB
Markdown
# VPN Setup for Monitoring Stack
|
|
|
|
## Architecture
|
|
|
|
```
|
|
Internet (public)
|
|
├─ [Prod/Pre-prod] (accessible)
|
|
│ └─→(1514/tcp)→ monitoring-uber (port ouvert)
|
|
│
|
|
├─ [VPN Server] (nouveau VPS, 1 CPU 2GB RAM)
|
|
│ └─ WireGuard 0.0.0.0:51820/udp
|
|
│
|
|
└─ [monitoring-uber] (185.103.167.138)
|
|
├─ Client VPN (10.0.0.2)
|
|
└─ Services: Wazuh, Dozzle, Beszel, S3 (VPN only)
|
|
|
|
VPN Network: 10.0.0.0/24
|
|
├─ VPN Server: 10.0.0.1
|
|
├─ monitoring-uber: 10.0.0.2
|
|
└─ Admins: 10.0.0.3+
|
|
```
|
|
|
|
## Configuration
|
|
|
|
**Mode:** VPN + Internet normal (pas de kill switch)
|
|
- Admins connectés au VPN → accès à services VPN (10.0.0.0/24)
|
|
- Admins gardent aussi accès à Internet normal (pas de restriction)
|
|
- Si VPN tombe → retrouvent Internet automatiquement
|
|
|
|
---
|
|
|
|
## Implementation Steps
|
|
|
|
### Phase 1: VPN Server Setup (nouveau VPS)
|
|
|
|
```bash
|
|
# 1. Login to VPS
|
|
ssh root@<VPN_SERVER_IP>
|
|
|
|
# 2. Run firewall setup
|
|
chmod +x /path/to/firewall-vpn-server.sh
|
|
./firewall-vpn-server.sh
|
|
|
|
# 3. Setup WireGuard server
|
|
chmod +x /path/to/wireguard-server-setup.sh
|
|
./wireguard-server-setup.sh
|
|
|
|
# Output will show:
|
|
# - Server Public Key (note this)
|
|
# - Example: aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdE=
|
|
```
|
|
|
|
Save the **Server Public Key** — you'll need it for clients.
|
|
|
|
### Phase 2: monitoring-uber VPN Client
|
|
|
|
```bash
|
|
# 1. Login to monitoring-uber
|
|
ssh root@185.103.167.138
|
|
|
|
# 2. Run firewall setup
|
|
chmod +x /path/to/firewall-monitoring-uber.sh
|
|
./firewall-monitoring-uber.sh
|
|
|
|
# 3. Setup WireGuard client
|
|
# Syntax: wireguard-client-setup.sh <VPN_SERVER_IP> <VPN_SERVER_PUBKEY>
|
|
chmod +x /path/to/wireguard-client-setup.sh
|
|
./wireguard-client-setup.sh <VPN_SERVER_IP> "<SERVER_PUBKEY>"
|
|
|
|
# Example:
|
|
# ./wireguard-client-setup.sh 123.45.67.89 "aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdE="
|
|
|
|
# Output will show:
|
|
# - Client Public Key (note this)
|
|
# - Example: XyZ9876543210AbCdEfGhIjKlMnOpQrStUvWxYz=
|
|
```
|
|
|
|
### Phase 3: Add monitoring-uber to VPN Server
|
|
|
|
```bash
|
|
# Back on VPS, add monitoring-uber as a peer
|
|
ssh root@<VPN_SERVER_IP>
|
|
|
|
# Use the Client Public Key from Phase 2
|
|
wg set wg0 peer <CLIENT_PUBKEY> allowed-ips 10.0.0.2/32
|
|
|
|
# Verify
|
|
wg show
|
|
|
|
# Example output:
|
|
# interface: wg0
|
|
# public key: aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdE=
|
|
# private key: (hidden)
|
|
# listening port: 51820
|
|
#
|
|
# peer: XyZ9876543210AbCdEfGhIjKlMnOpQrStUvWxYz=
|
|
# endpoint: <monitoring-uber-ip>:xxxxx
|
|
# allowed ips: 10.0.0.2/32
|
|
# latest handshake: X seconds ago
|
|
# transfer: X B received, X B sent
|
|
```
|
|
|
|
### Phase 4: Verify VPN Connection
|
|
|
|
```bash
|
|
# On monitoring-uber
|
|
ping 10.0.0.1
|
|
|
|
# Should respond
|
|
# PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
|
|
# 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=XX.X ms
|
|
|
|
# Check interface
|
|
ip addr show wg0
|
|
```
|
|
|
|
### Phase 5: Rebind Services to VPN IP
|
|
|
|
```bash
|
|
# On monitoring-uber
|
|
chmod +x /path/to/rebind-services-to-vpn.sh
|
|
./rebind-services-to-vpn.sh
|
|
|
|
# This will update docker-compose-security.yml:
|
|
# - Wazuh Dashboard: 0.0.0.0:443 → 10.0.0.2:443
|
|
# - Dozzle: 0.0.0.0:8080 → 10.0.0.2:8080
|
|
# - Beszel: 0.0.0.0:9090 → 10.0.0.2:9090
|
|
# - S3/RustFS: 0.0.0.0:9000/9001 → 10.0.0.2:9000/9001
|
|
# - Wazuh Manager: stays on 0.0.0.0:1514 (for agents)
|
|
|
|
# Restart services
|
|
cd /home/ubuntu/docker
|
|
docker compose -f docker-compose-security.yml down
|
|
docker compose -f docker-compose-security.yml up -d
|
|
|
|
# Verify
|
|
docker ps
|
|
```
|
|
|
|
### Phase 6: Ajouter un admin VPN
|
|
|
|
La clé privée ne doit **jamais quitter la machine de l'admin**. La procédure se fait en deux temps.
|
|
|
|
#### Étape A — Sur la machine de l'admin (à faire par l'admin)
|
|
|
|
Installer WireGuard si besoin :
|
|
- Windows/Mac : https://www.wireguard.com/install/
|
|
- Linux : `sudo apt install wireguard`
|
|
|
|
Générer les clés **localement** :
|
|
|
|
```bash
|
|
# Linux / Mac
|
|
wg genkey | tee privatekey | wg pubkey > publickey
|
|
cat privatekey # à garder secret
|
|
cat publickey # à envoyer à l'administrateur VPN
|
|
```
|
|
|
|
```powershell
|
|
# Windows (PowerShell, WireGuard installé)
|
|
cd "C:\Program Files\WireGuard"
|
|
.\wireguard.exe /genkey | Out-File -Encoding ascii privatekey.txt
|
|
Get-Content privatekey.txt | .\wireguard.exe /pubkey | Out-File -Encoding ascii publickey.txt
|
|
type publickey.txt # à envoyer à l'administrateur VPN
|
|
```
|
|
|
|
Créer le fichier de config `admin_nom.conf` **sur sa machine** :
|
|
|
|
```ini
|
|
[Interface]
|
|
Address = 10.0.0.X/32 # IP assignée par l'administrateur VPN
|
|
PrivateKey = <SA_CLE_PRIVEE>
|
|
DNS = 8.8.8.8
|
|
|
|
[Peer]
|
|
PublicKey = VQa6g1foaXhJgYWbwyJ9R/EAmmXg0nOnhPhbIIPLlmg=
|
|
AllowedIPs = 10.0.0.0/24
|
|
Endpoint = 45.150.111.158:51820
|
|
PersistentKeepalive = 25
|
|
```
|
|
|
|
Importer ce fichier dans l'app WireGuard → **Tunnel prêt, pas encore actif**.
|
|
|
|
#### Étape B — Sur le serveur VPN (à faire par l'administrateur)
|
|
|
|
L'admin envoie sa **clé publique** et l'administrateur l'ajoute :
|
|
|
|
```bash
|
|
ssh root@45.150.111.158
|
|
|
|
# Assigner une IP libre (voir tableau ci-dessous) et ajouter le peer
|
|
wg set wg0 peer <PUBKEY_ADMIN> allowed-ips 10.0.0.X/32
|
|
|
|
# Persister la config (survie au reboot)
|
|
wg-quick save wg0
|
|
|
|
# Vérifier
|
|
wg show
|
|
```
|
|
|
|
L'admin peut maintenant activer le tunnel dans l'app WireGuard.
|
|
|
|
#### IPs assignées
|
|
|
|
| Admin | IP VPN | Clé publique |
|
|
|--------|------------|--------------|
|
|
| admin1 | 10.0.0.3 | (voir admin1.conf) |
|
|
| admin2 | 10.0.0.10 | `SL6qEf2K0/3a26wBkvQpOmgILHxxLS1N8M5hJAqfRCc=` |
|
|
|
|
Prochaine IP libre : **10.0.0.11**
|
|
|
|
### Phase 7: Admin Connection
|
|
|
|
Each admin:
|
|
|
|
1. Download WireGuard app: https://www.wireguard.com/install/
|
|
2. Import config file (admin1.conf, admin2.conf, etc.)
|
|
3. Connect to VPN
|
|
4. Access services:
|
|
- **Wazuh Dashboard**: https://10.0.0.2
|
|
- **Dozzle**: http://10.0.0.2:8080
|
|
- **Beszel**: http://10.0.0.2:9090
|
|
- **S3/RustFS Console**: http://10.0.0.2:9001
|
|
|
|
## Firewall Rules Summary
|
|
|
|
### VPS VPN Server
|
|
|
|
| Protocol | Port | Source | Action |
|
|
|----------|------|--------|--------|
|
|
| UDP | 51820 | Any | ACCEPT (WireGuard) |
|
|
| TCP | 22 | Any | ACCEPT (SSH) |
|
|
| ICMP | echo-request | Any | ACCEPT |
|
|
| Any | Any | Any | REJECT |
|
|
|
|
NAT masquerade enabled for VPN → Internet routing.
|
|
|
|
### monitoring-uber (185.103.167.138)
|
|
|
|
| Protocol | Port | Source | Action |
|
|
|----------|------|--------|--------|
|
|
| TCP | 1514 | 185.103.166.119 | ACCEPT (Prod Wazuh Agent) |
|
|
| TCP | 1514 | 185.103.166.112 | ACCEPT (Pre-prod Wazuh Agent) |
|
|
| UDP | 51820 | Any | ACCEPT (VPN) |
|
|
| TCP | 443 | 10.0.0.0/24 | ACCEPT (Wazuh Dashboard — VPN) |
|
|
| TCP | 8080 | 10.0.0.0/24 | ACCEPT (Dozzle — VPN) |
|
|
| TCP | 9090 | 10.0.0.0/24 | ACCEPT (Beszel — VPN) |
|
|
| TCP | 9000-9001 | 10.0.0.0/24 | ACCEPT (S3 — VPN) |
|
|
| TCP | 22 | Any | ACCEPT (SSH) |
|
|
| Any | Any | Any | DROP (Deny all) |
|
|
|
|
## Troubleshooting
|
|
|
|
### VPN connection not establishing
|
|
|
|
```bash
|
|
# On monitoring-uber
|
|
systemctl status wg-quick@wg0
|
|
journalctl -u wg-quick@wg0 -n 20
|
|
|
|
# Restart
|
|
systemctl restart wg-quick@wg0
|
|
```
|
|
|
|
### Can't access services over VPN
|
|
|
|
```bash
|
|
# On monitoring-uber, check bindings
|
|
netstat -tlnp | grep -E "(443|8080|9090|9000)"
|
|
|
|
# Should show 10.0.0.2 (not 0.0.0.0)
|
|
```
|
|
|
|
### Wazuh agents can't connect
|
|
|
|
Make sure firewall allows 1514/tcp from prod/pre-prod:
|
|
|
|
```bash
|
|
# On monitoring-uber
|
|
iptables -L INPUT -v | grep 1514
|
|
```
|
|
|
|
Should show rules for prod (185.103.166.119) and pre-prod (185.103.166.112).
|
|
|
|
## Persistence & Boot
|
|
|
|
All rules are saved with:
|
|
- `iptables-save` → `/etc/iptables/rules.v4`
|
|
- WireGuard: `systemctl enable wg-quick@wg0`
|
|
|
|
Both survive reboots.
|
|
|
|
## Next Steps
|
|
|
|
- [ ] Deploy VPS VPN Server
|
|
- [ ] Run firewall + WireGuard setup on VPS
|
|
- [ ] Get Server Public Key
|
|
- [ ] Deploy firewall + WireGuard client on monitoring-uber
|
|
- [ ] Add monitoring-uber peer on VPS
|
|
- [ ] Verify VPN connection (ping 10.0.0.1)
|
|
- [ ] Rebind services to VPN IP
|
|
- [ ] Restart docker containers
|
|
- [ ] Generate admin client configs
|
|
- [ ] Add admin peers on VPS
|
|
- [ ] Test admin VPN connection
|
|
- [ ] Test service access (Wazuh, Dozzle, Beszel, S3)
|