Wireguard is an extremely fast, secure and modern VPN solution. It is now included in linux kernel and is used by VPN providers like mozilla vpn and mullad. Wireguard follows the linux philosophy of doing one thing well. It deals with cryptography and network routing and doesn't handle identity management. It explicitly leaves identity management to application layer.
One major deterrent for wireguard adoption by enterprises is lack of 2FA. There are awesome products like tailscale, which offers a zero config VPN solution built on top of wireguard. They even have open sourced their code. You could create islands of intranets within your corporate network and is a great option for large enterprises.
The aim of this project is to explore wireguard in detail and create a simple system to link wireguard and okta together. Small companies who are already using wireguard either manually or via algo might find this useful as an added security measure.
Once okta is integrated, other OIDC providers will be integrated in a generic way and will be exposed as a go package in a new project.
- Periodically sync okta users and wireguard peers and add/delete peers as needed, using either
- event webhooks
- cronjob
Webhooks are more efficient but cron have lesser attack surface and is more robust. Hence, we'll use cron first.
- Figure out a way to do key rotation and provide means for users to download new keys after they authenticate with okta 2FA
Configuration settings required by the project so far. Subject to change
OKTASERVER_API_TOKEN=
OKTASERVER_WIREGUARD_GROUP_ID=
OKTASERVER_ORG_URL=
WG_INTERFACE_IP=10.49.0.1/24
ALLOWED_IPS=10.0.0.0/8- wgctrl-go - Package wgctrl enables control of WireGuard interfaces on multiple platforms.
- wireguard-go - Go implementation of wireguard protocol. Used by wgctrl-go internally
- go-sqlite3
Would like to thank contributors of below open source projects, who has travelled before me in this path
- Creation of wireguard client programmatically in the server using wgctrl-go package
- Fetching of users in okta and comparison of that list to the list of users in the sqlite db
- Save peer configuration as text file, to share with user