Xor290/projet_gestion_commande

Fork 0

Files

T

Xor290 78bd98e72f chore: update

2026-06-10 17:50:44 +02:00

5.5 KiB

Raw Blame History

VPN Deployment Summary

Infrastructure

Role	Hostname	IP Public	IP VPN	Status
VPN Server	vpn-uber	45.150.111.158	10.0.0.1/24	✓ Active
Monitoring	monitoring-uber	185.103.167.138	10.0.0.2/24	✓ Connected
Admins	(clients)	—	10.0.0.3+	Ready

Server Credentials

VPN Server (vpn-uber)

IP Public: 45.150.111.158
Port: 51820/udp
Server Private Key: (secured at /etc/wireguard/privatekey)
Server Public Key: VQa6g1foaXhJgYWbwyJ9R/EAmmXg0nOnhPhbIIPLlmg=
Network: 10.0.0.0/24
Interface IP: 10.0.0.1

SSH Access:

ssh root@45.150.111.158
# Password: yqZ98EJL1h3ISlfT6l (from host.ini)

Monitoring Server (monitoring-uber)

IP Public: 185.103.167.138
VPN IP: 10.0.0.2/24
Status: Connected to VPN ✓
Firewall: Configured (iptables)
Interface: wg0 UP

SSH Access:

ssh root@185.103.167.138
# Password: rL9lY6YkcDQmfRuZ3Z (from host.ini)

VPN Configuration

Firewall Rules

VPN Server (vpn-uber):

INPUT:
  ✓ 22/tcp (SSH)
  ✓ 51820/udp (WireGuard)
  ✗ Everything else → REJECT

OUTPUT:
  ✓ All

FORWARD:
  ✓ wg0 interface (VPN traffic)
  ✓ NAT masquerade (10.0.0.0/24 → Internet)

Monitoring Server (monitoring-uber):

INPUT:
  ✓ 1514/tcp FROM 185.103.166.119 (Prod agents)
  ✓ 1514/tcp FROM 185.103.166.112 (Pre-prod agents)
  ✓ 51820/udp (VPN)
  ✓ 443/tcp FROM 10.0.0.0/24 (Wazuh Dashboard)
  ✓ 8080/tcp FROM 10.0.0.0/24 (Dozzle)
  ✓ 9090/tcp FROM 10.0.0.0/24 (Beszel)
  ✓ 9000-9001/tcp FROM 10.0.0.0/24 (S3/RustFS)
  ✗ Everything else → DROP

OUTPUT:
  ✓ All (Internet)

WireGuard Routing

VPN Server (10.0.0.1)
    ↓
Monitoring (10.0.0.2) — Connected ✓
    ↓
Admin Clients (10.0.0.3+) — Ready to connect

Current Peers:

peer: 4WLn2BR9ZGhM195mIvLbZR7tP/mb7ks4+mZ5ppZ21xw= (monitoring-uber)
  allowed ips: 10.0.0.2/32
  status: Connected ✓ (45ms latency, 0% loss)

Services Accessible via VPN

Once connected to VPN from admin client:

Service	URL	Port	Status
Wazuh Dashboard	https://10.0.0.2	443	✓ (VPN only)
Dozzle	http://10.0.0.2:8080	8080	✓ (VPN only)
Beszel	http://10.0.0.2:9090	9090	✓ (VPN only)
S3/RustFS Console	http://10.0.0.2:9001	9001	✓ (VPN only)
S3/RustFS API	http://10.0.0.2:9000	9000	✓ (VPN only)

Mode: VPN + Internet normal (no kill switch)

Admins can access services via VPN
Admins keep normal Internet access
If VPN drops → automatic fallback to Internet

Next Steps for Admins

1. Generate Client Configs

./wireguard-admin-client.sh admin1 45.150.111.158 "VQa6g1foaXhJgYWbwyJ9R/EAmmXg0nOnhPhbIIPLlmg="

Creates: admin1.conf

2. Add Client to VPN Server

SSH to VPN server:

ssh root@45.150.111.158

Then:

# Get client's public key from admin1.conf (PrivateKey → PublicKey)
wg set wg0 peer <CLIENT_PUBKEY> allowed-ips 10.0.0.3/32
wg show

3. Admin Setup

Install WireGuard app (wireguard.com/install)
Import admin1.conf
Connect to VPN
Test access to services

Testing

From Monitoring Server

# Test VPN connection
ping 10.0.0.1
# Response: 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=45.0 ms

# Check VPN status
ip addr show wg0
ip route show | grep wg0

# VPN traffic
tcpdump -i wg0

From VPN Server

# Monitor active connections
wg show

# Check interface
ip addr show wg0

# Verify firewall rules
iptables -L
iptables -L -t nat

Troubleshooting

Monitoring not connecting to VPN

# Check WireGuard daemon
ssh root@185.103.167.138
systemctl status wg-quick@wg0
journalctl -u wg-quick@wg0 -n 20

# Restart
systemctl restart wg-quick@wg0

VPN Server not accepting peers

# On VPN server, verify WireGuard is running
wg show

# Check if peer was added correctly
wg show wg0

# If not showing, re-add:
wg set wg0 peer <CLIENT_PUBKEY> allowed-ips 10.0.0.X/32

Admin client can't connect

Verify VPN server is listening: netstat -ulnp | grep 51820
Verify firewall allows 51820/udp: ufw status or iptables -L
Check client config has correct server IP and pubkey
Try reconnecting after 2-3 seconds

Files & Scripts Used

firewall-vpn-server.sh — VPN server firewall (iptables)
wireguard-server-setup.sh — WireGuard server install + config
firewall-monitoring-uber.sh — Monitoring firewall (iptables)
wireguard-client-setup.sh — WireGuard client install
wireguard-admin-client.sh — Generate admin client configs
VPN_SETUP.md — Full setup guide (phases 1-7)

Persistence

All configurations survive reboot:

Firewall: /etc/iptables/rules.v4 (loaded via iptables-restore)
WireGuard: Enabled at boot via systemctl enable wg-quick@wg0
Routes: Persistent in wg0 config

Security Notes

Firewall rules block unauthorized access
WireGuard handshake: 45ms latency (acceptable)
No kill switch enabled (VPN + Internet normal)
Services (Wazuh, Dozzle, Beszel, S3) accessible ONLY via VPN
Agents (prod/pre-prod) still have direct access to Wazuh manager (1514/tcp)

Status

✓ VPN Server deployed on vpn-uber (45.150.111.158) ✓ Monitoring-uber connected to VPN (10.0.0.2) ✓ Firewall configured on both servers ✓ VPN connection tested (45ms, 0% loss) ✓ Ready for admin client setup

5.5 KiB Raw Blame History