Update Configuration for New VPN Server Deployments (Phase I) #4

fkooman commented 2024年10月14日 16:21:43 +02:00

Announcement

Changes:

• Enable ProxyGuard (WireGuard+TCP)
• Disable OpenVPN+UDP
• Set WireGuard MTU to 1392
• Switch default VPN protocol from OpenVPN to WireGuard
• Only allow TLS >= 1.3 for client / API communication

Effects:

• Old(er) Windows 7 clients will be unable to connect to the server(s)
  because of missing TLSv1.3 support
• Only macOS/iOS client will use OpenVPN, but only when using TCP
• WireGuard+UDP works on more networks because the MTU is lowered, so
  networks with MTU issues, i.e. MTU < 1500, will work (better) without
  needing to switch to TCP

[Announcement](https://lists.geant.org/sympa/arc/eduvpn-deploy/2024-10/msg00001.html) Changes: * Enable ProxyGuard (WireGuard+TCP) * Disable OpenVPN+UDP * Set WireGuard MTU to 1392 * Switch default VPN protocol from OpenVPN to WireGuard * Only allow TLS >= 1.3 for client / API communication Effects: * Old(er) Windows 7 clients will be unable to connect to the server(s) because of missing TLSv1.3 support * Only macOS/iOS client will use OpenVPN, but only when using TCP * WireGuard+UDP works on more networks because the MTU is lowered, so networks with MTU issues, i.e. MTU < 1500, will work (better) without needing to switch to TCP

fkooman commented 2024年10月14日 16:35:29 +02:00

The vpn-user-portal config.php diff:

--- ../vpn-user-portal/config/config.php.example	2024年05月21日 19:28:51.108465256 +0200
+++ resources/vpn-user-portal/config.php	2024年10月11日 22:55:15.787914616 +0200
@@ -250,6 +250,11 @@
 // 'listenPort' => 51820,
 // //'listenPort' => 443,
 // ],
+ 'WireGuard' => [
+ 'enableProxy' => true,
+ 'setMtu' => 1392,
+ 'listenPort' => 443,
+ ],
 
 // OPTIONAL, DEFAULT = 'FileSessionModule'
 // 'sessionModule' => 'FileSessionModule',
@@ -320,6 +325,7 @@
 // supported)
 // OPTIONAL, DEFAULT = openvpn
 // 'preferredProto' => 'wireguard',
+ 'preferredProto' => 'wireguard',
 
 // ****************************************************************
 // * WireGuard *
@@ -354,6 +360,7 @@
 // 1,2,4,8,16,32 or 64
 // DEFAULT: [1194]
 // 'oUdpPortList' => [1194],
+ 'oUdpPortList' => [],
 
 // TCP ports used by OpenVPN server
 // together with "udpPortList" the number of ports MUST be

The vpn-user-portal `config.php` diff: ``` --- ../vpn-user-portal/config/config.php.example 2024年05月21日 19:28:51.108465256 +0200 +++ resources/vpn-user-portal/config.php 2024年10月11日 22:55:15.787914616 +0200 @@ -250,6 +250,11 @@ // 'listenPort' => 51820, // //'listenPort' => 443, // ], + 'WireGuard' => [ + 'enableProxy' => true, + 'setMtu' => 1392, + 'listenPort' => 443, + ], // OPTIONAL, DEFAULT = 'FileSessionModule' // 'sessionModule' => 'FileSessionModule', @@ -320,6 +325,7 @@ // supported) // OPTIONAL, DEFAULT = openvpn // 'preferredProto' => 'wireguard', + 'preferredProto' => 'wireguard', // **************************************************************** // * WireGuard * @@ -354,6 +360,7 @@ // 1,2,4,8,16,32 or 64 // DEFAULT: [1194] // 'oUdpPortList' => [1194], + 'oUdpPortList' => [], // TCP ports used by OpenVPN server // together with "udpPortList" the number of ports MUST be ```

fkooman commented 2024年10月15日 15:56:02 +02:00

Trying a few (older) platforms to check compatibility with TLS v1.3 and the new default VPN protocol configuration.

Device	OS	App Version	Browser Works?	App Works?
Samsung Galaxy A6	Android 10	3.3.3	Yes (Chrome)	Yes
iPhone 6s	iOS 15.8.3	3.0.8 (1859)	Yes (Safari)	Yes
MacBook Pro (Early 2015)	macOS 12.7.6	3.0.8 (1860)	Yes (Safari, Firefox)	Yes
-	Windows 7	3.7	Only Firefox ESR/Chrome, NOT IE	No
-	Windows 7	4.2	Only Firefox ESR/Chrome, NOT IE	Yes

Trying a few (older) platforms to check compatibility with TLS v1.3 and the new default VPN protocol configuration. | Device | OS | App Version | Browser Works? | App Works? | | --- | --- | ---- | --- | --- | | Samsung Galaxy A6 | Android 10 | 3.3.3 | Yes (Chrome) | Yes | | iPhone 6s | iOS 15.8.3 | 3.0.8 (1859) | Yes (Safari) | Yes | | MacBook Pro (Early 2015) | macOS 12.7.6 | 3.0.8 (1860) | Yes (Safari, Firefox) | Yes | - | Windows 7 | 3.7 | Only Firefox ESR/Chrome, NOT IE | No | | - | Windows 7 | 4.2 | Only Firefox ESR/Chrome, NOT IE | Yes |

twaijn commented 2024年10月17日 14:53:20 +02:00

I would recommend running Wireguard over 500/UDP since in my experience IPsec/IKE is typically allowed from firewalled visitor networks whereas the new QUIC protocol is not yet.

I would recommend running Wireguard over 500/UDP since in my experience IPsec/IKE is typically allowed from firewalled visitor networks whereas the new QUIC protocol is not yet.

fkooman commented 2024年10月17日 15:02:34 +02:00

I would recommend running Wireguard over 500/UDP since in my experience IPsec/IKE is typically allowed from firewalled visitor networks whereas the new QUIC protocol is not yet.

Should we ask this on eduvpn-deploy@ list to see what others are saying? Without any "hard data" it seems difficult to make an informed choice...

> I would recommend running Wireguard over 500/UDP since in my experience IPsec/IKE is typically allowed from firewalled visitor networks whereas the new QUIC protocol is not yet. Should we ask this on eduvpn-deploy@ list to see what others are saying? Without any "hard data" it seems difficult to make an informed choice...

twaijn commented 2024年10月17日 15:08:58 +02:00

I would recommend running Wireguard over 500/UDP since in my experience IPsec/IKE is typically allowed from firewalled visitor networks whereas the new QUIC protocol is not yet.

Should we ask this on eduvpn-deploy@ list to see what others are saying? Without any "hard data" it seems difficult to make an informed choice...

Sure thing. I also know eduVPN is mostly used in educational settings and the eduroam policy requires that IPsec and HTTPS should work, but QUIC (TCP/443) is not required: https://eduroam.org/wp-content/uploads/2020/02/GN3-12-192_eduroam-policy-service-definition_ver28_26072012.pdf

And after going live with eduVPN, we got first-hand reports from such networks: https://www.eui.eu/ServicesAndAdmin/ComputingService/Network/eduroam/ProtocolsServices

> > I would recommend running Wireguard over 500/UDP since in my experience IPsec/IKE is typically allowed from firewalled visitor networks whereas the new QUIC protocol is not yet. > > Should we ask this on eduvpn-deploy@ list to see what others are saying? Without any "hard data" it seems difficult to make an informed choice... Sure thing. I also know eduVPN is mostly used in educational settings and the eduroam policy requires that IPsec and HTTPS should work, but QUIC (TCP/443) is not required: https://eduroam.org/wp-content/uploads/2020/02/GN3-12-192_eduroam-policy-service-definition_ver28_26072012.pdf And after going live with eduVPN, we got first-hand reports from such networks: https://www.eui.eu/ServicesAndAdmin/ComputingService/Network/eduroam/ProtocolsServices

fkooman commented 2024年10月17日 15:33:54 +02:00

Right. So when connecting from eduroam, having udp/500, udp/1194 (haha), or udp/4500 would probably yield the biggest success. Now when connecting from "random" networks, e.g. home, hotel, coffee place, ..., I'm not sure...

My feeling (not really based on anything tangible) is that eventually udp/443 will be opened more and more, so things will get better over time with this port. As far as udp/500 and udp/4500 go, I'd expect that to get worse over time...

Right. So when connecting from _eduroam_, having `udp/500`, `udp/1194` (haha), or `udp/4500` would probably yield the biggest success. Now when connecting from "random" networks, e.g. home, hotel, coffee place, ..., I'm not sure... My feeling (not really based on anything tangible) is that eventually `udp/443` will be opened more and more, so things will get better over time with this port. As far as `udp/500` and `udp/4500` go, I'd expect that to get _worse_ over time...

t-w commented 2024年10月17日 17:41:26 +02:00

Is it possible to simply use multiple ports for Wireguard? On one of my personal servers, I have simply redirected around 20-30 ports to the Wireguard port using a firewall rule, and can then select which one works on the client. Often port 53 or 123 also worked.

Is it possible to simply use multiple ports for Wireguard? On one of my personal servers, I have simply redirected around 20-30 ports to the Wireguard port using a firewall rule, and can then select which one works on the client. Often port 53 or 123 also worked.

fkooman commented 2024年10月17日 21:15:34 +02:00

Is it possible to simply use multiple ports for Wireguard? On one of my personal servers, I have simply redirected around 20-30 ports to the Wireguard port using a firewall rule, and can then select which one works on the client. Often port 53 or 123 also worked.

It might be yeah, but not really something I'd like to deploy out of the box, of course would be very nice to document this here!

> Is it possible to simply use multiple ports for Wireguard? On one of my personal servers, I have simply redirected around 20-30 ports to the Wireguard port using a firewall rule, and can then select which one works on the client. Often port 53 or 123 also worked. It might be yeah, but not really something I'd like to deploy out of the box, of course would be very nice to document this [here](https://docs.eduvpn.org/server/v3/firewall.html)!

t-w commented 2024年10月18日 13:20:48 +02:00

Yes, I could document that there (it's just a redirect line). But this is not yet usable with eduvpn, a configuration option in the vpn-user-portal is still missing, and the client still needs to know how to handle it. I had done this manually with a "normal" Wireguard client. So that would be a new feature for eduvpn.

Yes, I could document that there (it's just a redirect line). But this is not yet usable with eduvpn, a configuration option in the vpn-user-portal is still missing, and the client still needs to know how to handle it. I had done this manually with a "normal" Wireguard client. So that would be a new feature for eduvpn.

fkooman commented 2024年10月18日 13:50:36 +02:00

Yes, I could document that there (it's just a redirect line). But this is not yet usable with eduvpn, a configuration option in the vpn-user-portal is still missing, and the client still needs to know how to handle it. I had done this manually with a "normal" Wireguard client. So that would be a new feature for eduvpn.

I am not sure it is worth the added complexity instead of just switching to TCP at that point. Perhaps when we can't find a (substantial) better port, we can just stick with udp/51820 and trust tcp/443 with proxyguard will take care of the rest.

> Yes, I could document that there (it's just a redirect line). But this is not yet usable with eduvpn, a configuration option in the vpn-user-portal is still missing, and the client still needs to know how to handle it. I had done this manually with a "normal" Wireguard client. So that would be a new feature for eduvpn. I am not sure it is worth the added complexity instead of just switching to TCP at that point. Perhaps when we can't find a (substantial) better port, we can just stick with udp/51820 and trust tcp/443 with proxyguard will take care of the rest.

fkooman commented 2024年10月29日 10:35:16 +01:00

So, it might be best to keep the WireGuard port at 51820 out of the box until we have some real data that suggests we should move to another port. We'll have WireGuard+TCP fallback in any case, so that should be no problem.

So, it might be best to keep the WireGuard port at 51820 out of the box until we have some real data that suggests we should move to another port. We'll have WireGuard+TCP fallback in any case, so that should be no problem.