Wireguard
A way to connect two computers together relatively safely.
Wireguard is a VPN protocol built into the Linux kernel, which makes it relatively painless to set up. What I find it particularly good for is putting services that run on machines in my basement onto the internet by way of a bastion server.
Installation
sudo apt install wireguard iptables
Create a keypair for the machine:
wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod go= /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key
On the Server
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <server private key value>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; iptables -A FORWARD -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; iptables -D FORWARD -o %i -j ACCEPT
[Peer]
PublicKey = <client public key value>
AllowedIPs = 10.8.0.2/24
Let it through the firewall, and turn on IP forwarding:
sudo ufw allow 51820/udp
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
sudo sysctl --system
On the Client
[Interface]
PrivateKey = <client private key value>
Address = 10.8.0.2/24
[Peer]
PublicKey = <server public key value>
AllowedIPs = 10.8.0.0/24
Endpoint = 0.0.0.0:51820
PersistentKeepalive = 25
Bringing the Interface Up
sudo systemctl enable --now wg-quick@wg0