3 ms·
That's really interesting. So you essentially implemented a Virtual Private Cloud(VPC) on top of the "PHY" network of your hosts? Does that mean that all your
by ghthor 7y ago
That's really interesting. So you essentially implemented a Virtual Private Cloud(VPC) on top of the "PHY" network of your hosts?
Does that mean that all your nodes have to be accessible to the public internet?
- mongrelion 7y agoNot necessarily, no. All hosts talk to each other on their private (v)NIC.
- adevx 7y agoIn my case yes and yes, but mostly because I spread out over two cloud providers.
- kevin_nisbet 7y agoBut it only needs to be accessible on the port WireGuard uses for communications, and WireGuard also has a nice property where it acts passively for non-wireguard packets. So someone on the internet doesn't necessarily know the node is reachable from the internet if they try and scan it for example. Edit: IIRC only one end of the connection needs a stable endpoint as well. IIRC WireGuard supports mobility (changing IP addresses) for one end of the connection.
- monkeybutt 7y agoafaik, both ends can move, they just send packets to the latest IP they received a valid packet from.
- ralala 7y agoI'm also doing this with internet-connected vms, but I have closed all ports using Iptables