Multi server Wireguard mesh with ansible

A playbook which given an inventory file with:

a list of hosts
- for each host a wireguard_ip variable with the desired host (private) Wireguard IP
wireguard_mask_bits variable with the number of the wireguard (private) network mask bits
wireguard_port variable with the UDP port to use

will:

install wireguard in all hosts
generate public/private key pairs in all hosts
generate the pre-shared keys for all host pairs
create a wg0 virtual network device and a wg0 network

optionally, when the ufw_enabled variable is set to true:

enable ufw on all hosts
reject everything by default
allow ssh protocol from all sources
allow traffic from all the inventory wireguard IPs

More details and explanation can be found in this blog post: https://jawher.me/wireguard-ansible-systemd-ubuntu/

Example

In this example, we'll create 3 Hetzner cloud CX11 servers (~3€/month) using Hetzner's cli, 1 in each of their 3 datacenters (Nuremberg, Falkenstein & Helsinki):

env_id=wireguard-test
server_type=cx11
image=ubuntu-20.04

args=()

for k in $(hcloud ssh-key list -o=noheader -ocolumns=name); do
  args+=("--ssh-key=$k")
done

for datacenter in nbg1-dc3 fsn1-dc14 hel1-dc2; do
    hcloud server create "${args[@]}" \
    --datacenter="${datacenter}" \
    --type="${server_type}" \
    --image="${image}" \
    --label=env="${env_id}" \
    --name="${env_id}-${datacenter}"
done

Inventory

Next you need to prepapre an inventory file with the 3 servers we created in inventories/inventory.yml:

Run hcloud server list -l env=wireguard-test:

ID         NAME                       STATUS    IPV4             IPV6                      DATACENTER
10889123   wireguard-test-nbg1-dc3    running   xxx.xx.xxx.xx    2a01:xxxx:xxxx:xxxx::/64   nbg1-dc3
10889126   wireguard-test-fsn1-dc14   running   xxx.xx.xxx.xxx   2a01:xxxx:xxxx:xxxx::/64   fsn1-dc14
10889127   wireguard-test-hel1-dc2    running   xx.xxx.xx.xxx    2a01:xxxx:xxxx:xxxx::/64   hel1-dc2

And use the server names and IPv4s to build your inventory:

all:
  hosts:

    host1:
      pipelining: true
      ansible_ssh_user: root
      ansible_host: "$host1_public_ip"
      ansible_ssh_port: 22

      wireguard_ip: 192.168.0.1

    host2:
      pipelining: true
      ansible_ssh_user: root
      ansible_host: "$host2_public_ip"
      ansible_ssh_port: 22

      wireguard_ip: 192.168.0.2

    host3:
      pipelining: true
      ansible_ssh_user: root
      ansible_host: "$host3_public_ip"
      ansible_ssh_port: 22

      wireguard_ip: 192.168.0.3

  vars:
    ansible_become_method: su 

    wireguard_mask_bits: 24
    wireguard_port: 51871

Apply

Run make apply

Test connectivity

Run make test, which will perform ping tests between the 3 servers using their wireguard private IPs.

You could also ssh to each/any host and run ping manually if you prefer.

jawher/automation-wireguard

Multi server Wireguard mesh with ansible

Example

Inventory

Apply

Test connectivity