I have three VM's. VM-A,VM-B & VM-X. I have a application running on the backend server VM-X. VM-A is the Main frontend server which has high capacity. VM-B is just a standby server of low capacity. My application is demand only for 14hrs a Day. As I'm using AWS, my plan was to shutdown VM-A(after work hrs.) & keep VM-B as the frontend other time so that the applications is available for some users. On VM-A I have a custom XDP tool which connects to VM-B via IPIP Tunnel. At the VM-X I'm running the below commands for IPIP Tunnel
ip tunnel add ipip0 mode ipip remote **VM-A-PublicIP** local **VM-X-Private-IP** ifconfig ipip0 mtu 1480 up ip netns add proxy ip link set ipip0 netns proxy ip netns exec proxy ip link set dev ipip0 up ip netns exec proxy ip link set dev ipip0 promisc on ip netns exec proxy ip addr add **VM-A-PrivateIP/32** dev ipip0 ip netns exec proxy ip route add default dev ipip0
My Application on VM-X runs within this name space with the command
ip netns exec proxy service myapp start
I want to connect VM-B & VM-X with wireguard.
My wireguard conf file on VM-B is as below
[Interface] Address = 192.168.90.1/24 SaveConfig = false ListenPort = 51890 PrivateKey = ICDVm5kbkuO8kuD256ZQKg2IkxQL3h7sLkIw6YpGF2E= PostUp = iptables -t nat -I PREROUTING -i enp0s3 -p udp --dport 1234 -j DNAT --to 192.168.90.2 PreDown = iptables -t nat -D PREROUTING -i enp0s3 -p udp --dport 1234 -j DNAT --to 192.168.90.2 [Peer] PublicKey = ZvJyJRy7nD8si6VRH10s9JN3PeMRaz6OYj5F0SHTImY= AllowedIPs = 192.168.90.0/24 Endpoint = **VM-X-PublicIP**:51890
--- My wireguard conf on VM-X is as below.
[Interface] Table = off Address = 192.168.90.2/24 SaveConfig = false ListenPort = 51890 PrivateKey = kBnr5zNvVX1uSiKUSkqJRQ+6LV/vsqF3D3r3q/PUlHo= PostUp = /etc/wireguard/wg_gs90routing.sh PreDown = /etc/wireguard/wg_gs90unrouting.sh [Peer] PublicKey = 3MqWlddTdYSZ8uXP2RP8c8ufgP9cLFi14aUBbwg3unI= AllowedIPs = 0.0.0.0/0 Endpoint = **VM-B-PublicIP**:51890
ip route add 192.168.90.0/24 dev wg-gs1 scope link table wg-gs1 ip route add 0.0.0.0/0 dev wg-gs1 via 192.168.90.2 table wg-gs1 ip rule add from all fwmark 0x1001 lookup wg-gs1 iptables -t mangle -A PREROUTING -i wg-gs1 -j MARK --set-mark 0x1001 iptables -t mangle -A PREROUTING -i wg-gs1 -j CONNMARK --save-mark iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark iptables -t nat -A PREROUTING -i wg-gs1 -m addrtype --dst-type LOCAL --limit-iface-in -p udp -j DNAT --to 192.168.128.192:1234 conntrack -F
Can someone help me where & what changes should I do in VM-B & VM-X to make wireguard tunnel run, without making any changes for IPIP tunnel of VM-A & VM-X. I'm very much new in this, my friend who looks up after all this is not available due to which I have to set it myself. Someone please help me. I googled but couldn't get anything relevant