1

I have three VM's. VM-A,VM-B & VM-X. I have a application running on the backend server VM-X. VM-A is the Main frontend server which has high capacity. VM-B is just a standby server of low capacity. My application is demand only for 14hrs a Day. As I'm using AWS, my plan was to shutdown VM-A(after work hrs.) & keep VM-B as the frontend other time so that the applications is available for some users. On VM-A I have a custom XDP tool which connects to VM-B via IPIP Tunnel. At the VM-X I'm running the below commands for IPIP Tunnel

ip tunnel add ipip0 mode ipip remote **VM-A-PublicIP** local **VM-X-Private-IP**
ifconfig ipip0 mtu 1480 up
ip netns add proxy
ip link set ipip0 netns proxy
ip netns exec proxy ip link set dev ipip0 up
ip netns exec proxy ip link set dev ipip0 promisc on
ip netns exec proxy ip addr add **VM-A-PrivateIP/32** dev ipip0
ip netns exec proxy ip route add default dev ipip0

My Application on VM-X runs within this name space with the command ip netns exec proxy service myapp start

I want to connect VM-B & VM-X with wireguard. My wireguard conf file on VM-B is as below

[Interface]
Address = 192.168.90.1/24
SaveConfig = false
ListenPort = 51890
PrivateKey = ICDVm5kbkuO8kuD256ZQKg2IkxQL3h7sLkIw6YpGF2E=
PostUp = iptables -t nat -I PREROUTING -i enp0s3 -p udp --dport 1234 -j DNAT --to 192.168.90.2
PreDown = iptables -t nat -D PREROUTING -i enp0s3 -p udp --dport 1234 -j DNAT --to 192.168.90.2

[Peer]
PublicKey = ZvJyJRy7nD8si6VRH10s9JN3PeMRaz6OYj5F0SHTImY=
AllowedIPs = 192.168.90.0/24
Endpoint = **VM-X-PublicIP**:51890

--- My wireguard conf on VM-X is as below.

[Interface]
Table = off
Address = 192.168.90.2/24
SaveConfig = false
ListenPort = 51890
PrivateKey = kBnr5zNvVX1uSiKUSkqJRQ+6LV/vsqF3D3r3q/PUlHo=
PostUp = /etc/wireguard/wg_gs90routing.sh
PreDown = /etc/wireguard/wg_gs90unrouting.sh

[Peer]
PublicKey = 3MqWlddTdYSZ8uXP2RP8c8ufgP9cLFi14aUBbwg3unI=
AllowedIPs = 0.0.0.0/0
Endpoint = **VM-B-PublicIP**:51890

wg_gs90routing.sh file

ip route add 192.168.90.0/24 dev wg-gs1 scope link table wg-gs1
ip route add 0.0.0.0/0 dev wg-gs1 via 192.168.90.2 table wg-gs1
ip rule add from all fwmark 0x1001 lookup wg-gs1
iptables -t mangle -A PREROUTING -i wg-gs1 -j MARK --set-mark 0x1001
iptables -t mangle -A PREROUTING -i wg-gs1 -j CONNMARK --save-mark
iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
iptables -t nat -A PREROUTING -i wg-gs1 -m addrtype --dst-type LOCAL --limit-iface-in -p udp -j DNAT --to 192.168.128.192:1234
conntrack -F

Can someone help me where & what changes should I do in VM-B & VM-X to make wireguard tunnel run, without making any changes for IPIP tunnel of VM-A & VM-X. I'm very much new in this, my friend who looks up after all this is not available due to which I have to set it myself. Someone please help me. I googled but couldn't get anything relevant

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy