chore: update
This commit is contained in:
@@ -0,0 +1,255 @@
|
||||
# VPN Setup for Monitoring Stack
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
Internet (public)
|
||||
├─ [Prod/Pre-prod] (accessible)
|
||||
│ └─→(1514/tcp)→ monitoring-uber (port ouvert)
|
||||
│
|
||||
├─ [VPN Server] (nouveau VPS, 1 CPU 2GB RAM)
|
||||
│ └─ WireGuard 0.0.0.0:51820/udp
|
||||
│
|
||||
└─ [monitoring-uber] (185.103.167.138)
|
||||
├─ Client VPN (10.0.0.2)
|
||||
└─ Services: Wazuh, Dozzle, Beszel, S3 (VPN only)
|
||||
|
||||
VPN Network: 10.0.0.0/24
|
||||
├─ VPN Server: 10.0.0.1
|
||||
├─ monitoring-uber: 10.0.0.2
|
||||
└─ Admins: 10.0.0.3+
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
**Mode:** VPN + Internet normal (pas de kill switch)
|
||||
- Admins connectés au VPN → accès à services VPN (10.0.0.0/24)
|
||||
- Admins gardent aussi accès à Internet normal (pas de restriction)
|
||||
- Si VPN tombe → retrouvent Internet automatiquement
|
||||
|
||||
---
|
||||
|
||||
## Implementation Steps
|
||||
|
||||
### Phase 1: VPN Server Setup (nouveau VPS)
|
||||
|
||||
```bash
|
||||
# 1. Login to VPS
|
||||
ssh root@<VPN_SERVER_IP>
|
||||
|
||||
# 2. Run firewall setup
|
||||
chmod +x /path/to/firewall-vpn-server.sh
|
||||
./firewall-vpn-server.sh
|
||||
|
||||
# 3. Setup WireGuard server
|
||||
chmod +x /path/to/wireguard-server-setup.sh
|
||||
./wireguard-server-setup.sh
|
||||
|
||||
# Output will show:
|
||||
# - Server Public Key (note this)
|
||||
# - Example: aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdE=
|
||||
```
|
||||
|
||||
Save the **Server Public Key** — you'll need it for clients.
|
||||
|
||||
### Phase 2: monitoring-uber VPN Client
|
||||
|
||||
```bash
|
||||
# 1. Login to monitoring-uber
|
||||
ssh root@185.103.167.138
|
||||
|
||||
# 2. Run firewall setup
|
||||
chmod +x /path/to/firewall-monitoring-uber.sh
|
||||
./firewall-monitoring-uber.sh
|
||||
|
||||
# 3. Setup WireGuard client
|
||||
# Syntax: wireguard-client-setup.sh <VPN_SERVER_IP> <VPN_SERVER_PUBKEY>
|
||||
chmod +x /path/to/wireguard-client-setup.sh
|
||||
./wireguard-client-setup.sh <VPN_SERVER_IP> "<SERVER_PUBKEY>"
|
||||
|
||||
# Example:
|
||||
# ./wireguard-client-setup.sh 123.45.67.89 "aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdE="
|
||||
|
||||
# Output will show:
|
||||
# - Client Public Key (note this)
|
||||
# - Example: XyZ9876543210AbCdEfGhIjKlMnOpQrStUvWxYz=
|
||||
```
|
||||
|
||||
### Phase 3: Add monitoring-uber to VPN Server
|
||||
|
||||
```bash
|
||||
# Back on VPS, add monitoring-uber as a peer
|
||||
ssh root@<VPN_SERVER_IP>
|
||||
|
||||
# Use the Client Public Key from Phase 2
|
||||
wg set wg0 peer <CLIENT_PUBKEY> allowed-ips 10.0.0.2/32
|
||||
|
||||
# Verify
|
||||
wg show
|
||||
|
||||
# Example output:
|
||||
# interface: wg0
|
||||
# public key: aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdE=
|
||||
# private key: (hidden)
|
||||
# listening port: 51820
|
||||
#
|
||||
# peer: XyZ9876543210AbCdEfGhIjKlMnOpQrStUvWxYz=
|
||||
# endpoint: <monitoring-uber-ip>:xxxxx
|
||||
# allowed ips: 10.0.0.2/32
|
||||
# latest handshake: X seconds ago
|
||||
# transfer: X B received, X B sent
|
||||
```
|
||||
|
||||
### Phase 4: Verify VPN Connection
|
||||
|
||||
```bash
|
||||
# On monitoring-uber
|
||||
ping 10.0.0.1
|
||||
|
||||
# Should respond
|
||||
# PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
|
||||
# 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=XX.X ms
|
||||
|
||||
# Check interface
|
||||
ip addr show wg0
|
||||
```
|
||||
|
||||
### Phase 5: Rebind Services to VPN IP
|
||||
|
||||
```bash
|
||||
# On monitoring-uber
|
||||
chmod +x /path/to/rebind-services-to-vpn.sh
|
||||
./rebind-services-to-vpn.sh
|
||||
|
||||
# This will update docker-compose-security.yml:
|
||||
# - Wazuh Dashboard: 0.0.0.0:443 → 10.0.0.2:443
|
||||
# - Dozzle: 0.0.0.0:8080 → 10.0.0.2:8080
|
||||
# - Beszel: 0.0.0.0:9090 → 10.0.0.2:9090
|
||||
# - S3/RustFS: 0.0.0.0:9000/9001 → 10.0.0.2:9000/9001
|
||||
# - Wazuh Manager: stays on 0.0.0.0:1514 (for agents)
|
||||
|
||||
# Restart services
|
||||
cd /home/ubuntu/docker
|
||||
docker compose -f docker-compose-security.yml down
|
||||
docker compose -f docker-compose-security.yml up -d
|
||||
|
||||
# Verify
|
||||
docker ps
|
||||
```
|
||||
|
||||
### Phase 6: Create Admin VPN Clients
|
||||
|
||||
```bash
|
||||
# Generate config for each admin
|
||||
chmod +x /path/to/wireguard-admin-client.sh
|
||||
|
||||
# Syntax: wireguard-admin-client.sh <name> <vps_ip> <vps_pubkey>
|
||||
./wireguard-admin-client.sh admin1 123.45.67.89 "aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdE="
|
||||
./wireguard-admin-client.sh admin2 123.45.67.89 "aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890AbCdE="
|
||||
|
||||
# Output: admin1.conf, admin2.conf
|
||||
|
||||
# For each admin, add to VPN server:
|
||||
ssh root@<VPN_SERVER_IP>
|
||||
wg set wg0 peer <ADMIN1_PUBKEY> allowed-ips 10.0.0.3/32
|
||||
wg set wg0 peer <ADMIN2_PUBKEY> allowed-ips 10.0.0.4/32
|
||||
|
||||
# Verify
|
||||
wg show
|
||||
```
|
||||
|
||||
### Phase 7: Admin Connection
|
||||
|
||||
Each admin:
|
||||
|
||||
1. Download WireGuard app: https://www.wireguard.com/install/
|
||||
2. Import config file (admin1.conf, admin2.conf, etc.)
|
||||
3. Connect to VPN
|
||||
4. Access services:
|
||||
- **Wazuh Dashboard**: https://10.0.0.2
|
||||
- **Dozzle**: http://10.0.0.2:8080
|
||||
- **Beszel**: http://10.0.0.2:9090
|
||||
- **S3/RustFS Console**: http://10.0.0.2:9001
|
||||
|
||||
## Firewall Rules Summary
|
||||
|
||||
### VPS VPN Server
|
||||
|
||||
| Protocol | Port | Source | Action |
|
||||
|----------|------|--------|--------|
|
||||
| UDP | 51820 | Any | ACCEPT (WireGuard) |
|
||||
| TCP | 22 | Any | ACCEPT (SSH) |
|
||||
| ICMP | echo-request | Any | ACCEPT |
|
||||
| Any | Any | Any | REJECT |
|
||||
|
||||
NAT masquerade enabled for VPN → Internet routing.
|
||||
|
||||
### monitoring-uber (185.103.167.138)
|
||||
|
||||
| Protocol | Port | Source | Action |
|
||||
|----------|------|--------|--------|
|
||||
| TCP | 1514 | 185.103.166.119 | ACCEPT (Prod Wazuh Agent) |
|
||||
| TCP | 1514 | 185.103.166.112 | ACCEPT (Pre-prod Wazuh Agent) |
|
||||
| UDP | 51820 | Any | ACCEPT (VPN) |
|
||||
| TCP | 443 | 10.0.0.0/24 | ACCEPT (Wazuh Dashboard — VPN) |
|
||||
| TCP | 8080 | 10.0.0.0/24 | ACCEPT (Dozzle — VPN) |
|
||||
| TCP | 9090 | 10.0.0.0/24 | ACCEPT (Beszel — VPN) |
|
||||
| TCP | 9000-9001 | 10.0.0.0/24 | ACCEPT (S3 — VPN) |
|
||||
| TCP | 22 | Any | ACCEPT (SSH) |
|
||||
| Any | Any | Any | DROP (Deny all) |
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### VPN connection not establishing
|
||||
|
||||
```bash
|
||||
# On monitoring-uber
|
||||
systemctl status wg-quick@wg0
|
||||
journalctl -u wg-quick@wg0 -n 20
|
||||
|
||||
# Restart
|
||||
systemctl restart wg-quick@wg0
|
||||
```
|
||||
|
||||
### Can't access services over VPN
|
||||
|
||||
```bash
|
||||
# On monitoring-uber, check bindings
|
||||
netstat -tlnp | grep -E "(443|8080|9090|9000)"
|
||||
|
||||
# Should show 10.0.0.2 (not 0.0.0.0)
|
||||
```
|
||||
|
||||
### Wazuh agents can't connect
|
||||
|
||||
Make sure firewall allows 1514/tcp from prod/pre-prod:
|
||||
|
||||
```bash
|
||||
# On monitoring-uber
|
||||
iptables -L INPUT -v | grep 1514
|
||||
```
|
||||
|
||||
Should show rules for prod (185.103.166.119) and pre-prod (185.103.166.112).
|
||||
|
||||
## Persistence & Boot
|
||||
|
||||
All rules are saved with:
|
||||
- `iptables-save` → `/etc/iptables/rules.v4`
|
||||
- WireGuard: `systemctl enable wg-quick@wg0`
|
||||
|
||||
Both survive reboots.
|
||||
|
||||
## Next Steps
|
||||
|
||||
- [ ] Deploy VPS VPN Server
|
||||
- [ ] Run firewall + WireGuard setup on VPS
|
||||
- [ ] Get Server Public Key
|
||||
- [ ] Deploy firewall + WireGuard client on monitoring-uber
|
||||
- [ ] Add monitoring-uber peer on VPS
|
||||
- [ ] Verify VPN connection (ping 10.0.0.1)
|
||||
- [ ] Rebind services to VPN IP
|
||||
- [ ] Restart docker containers
|
||||
- [ ] Generate admin client configs
|
||||
- [ ] Add admin peers on VPS
|
||||
- [ ] Test admin VPN connection
|
||||
- [ ] Test service access (Wazuh, Dozzle, Beszel, S3)
|
||||
Reference in New Issue
Block a user