questions

[Mariaab1]

Hello it's me again 😅,

I have a series of questions:

1. Is it necessary to always use a cluster? I removed the "clustering" object from my config.json, but it still asks for it:

root@vpn-clonada:/opt/wag_8_1# ./wag start 2024/10/15 11:54:02 no listen url was specified for the etcd cluster TLS manager, new wag servers will not be able to join

2. Why don’t the assigned IPs follow a sequential order?

Is there any way to change this?

3. Why does WireGuard set the iptables FORWARD chain policy to DROP every time the service is started?

4. When I create a user, a configuration file is generated, but it only allows a specific IP:

However, if I later add rules granting access to a network segment:

The changes don’t take effect:

However, if I manually modify the WireGuard configuration file, everything works as expected:

Does this mean that any changes I make must be manually applied to each user's WireGuard configuration file in order to take effect?

Thank you!🐧

[NHAS]

1. Wag uses ETCd to manage its data, you can have a single node cluster. But its always a cluster
2. The IPs dont get assigned sequentially, as its easier to find "gaps" where devices use to have an associated IP but have since been deleted, its a pretty fast way to select ip addresses over all. This cant be changed.
3. Wag wants to make sure that random traffic isnt forwarded and that only wireguard interface traffic is being forwarded, you can make this change yourself, but this is how wag functions at the moment.
4. Wireguard plain has no mechanism to update configuration files. You have to update your wireguard config yourself, wag gives you tools to be able to do this automatically, but cant do it just via wireguard.

Checkout the /routes/ path in the vpn tunnel.

[Mariaab1]

Okay, thank you very much. Sorry, I hadn’t noticed that it could be opened as a "discussion".

I also wanted to mention that when I generate a token for a new user and add them to an existing group, once I execute the curl command to register them, they are registered but the group I indicated is ignored:

Additionally, I wanted to let you know that maybe you might want to add a trim function when adding users to groups, as it does not recognize them if there’s a blank space

However, if I remove the trailing space...🎉

[NHAS]

Ah cool, I'll fix the whitespace issue. Just working on some other bigger changes that are taking precedence, that group issue is a known one but its more of an intended design weirdly enough.

Its for when you have oidc members that dont initially have groups assigned to them before log in, and sometimes you want to give them access to say the SSO provider as well

[Mariaab1]

Ah, yes, I understand. Well, if I spot anything else, I'll let you know 😌

I wanted to ask you one last thing (for now 😅), I have this error:

But the thing is that in the config JSON, it's clearly defined:

The problem is that when the user tries to connect, they use an authentication method that isn't set:

2024/10/21 09:09:46 prueba 172.16.101.11 Invalid MFA type requested: webauthn

And when I try to configure it from the GUI, the list of options doesn't appear 😔:

(It doesn't look exactly like that because I've reinstalled it from scratch, and now it works. So the screenshot is recreated, but basically, the dropdown didn't expand and was empty)

thank you!

[NHAS]

I can understand the confusion, this is because we're moving away from using the JSON config file and more towards the web UI.

You can see that in your list of "Enabled MFA Methods" there is no enabled method. Try enabling totp, if that is still broken then its a bug :)

[Mariaab1]

Hello!

Then I would say yes (about the bug).I’ve tried again and this is the actual error. Even though I have "DefaultMethod" set in config.json, this happens in the GUI.

I was also wondering if, in case I need to migrate it, simply copying the "default.wag-node.etcd" directory would be enough. I've done some tests, and so far it seems to work.

Thank you very much!

[NHAS]

Sweet. That's a good bug find. At the moment I'm working on some big changes that remove ebpf from wag. So I'll go and fix this as an issue after that work is largely completed