search

trailofbits / algo

Set up a personal VPN in the cloud
https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/
GNU Affero General Public License v3.0
28.91k stars 2.32k forks source link

Lightsail is not workign #14406

Closed vvorlov closed 2 years ago

vvorlov commented 2 years ago

Describe the bug

VPN is not working with Lightsail. Wireguard connected but there is no Internet after connection. Usual macOS client don't connect, freezes on Connecting... state.

To Reproduce

Steps to reproduce the behavior:

  1. Connect to Lightsail intance via ssh
  2. Run script: 
    
#!/bin/bash
export USERS=phone
export REPO_BRANCH=master
export STORE_PKI=true
curl -s https://raw.githubusercontent.com/trailofbits/algo/master/install.sh | sudo -E bash -x
1. I don't know why but you need to run the script twice. At first run it will install dependencies and at the second run it will configure the VPN.

3. Run `chmod 775` for every certs in `/opt/algo/configs/<IP>`

3. Download certs

scp -i eu-north-1.pem ubuntu@13.48.104.144:/opt/algo/configs/13.48.104.144/wireguard/phone.conf ~/Downloads/phone.conf

scp -i eu-north-1.pem ubuntu@13.48.104.144:/opt/algo/configs/13.48.104.144/ipsec/apple/phone.mobileconfig ~/Downloads/phone.mobileconfig 


4. Configure Wireguard or built-in macOS client.

**Expected behavior**

VPN should work but it doesn't

**Full log**

<!--- Put here the FULL LOG after you run the ./algo script below -->

ubuntu@ip-172-26-0-161:~$ export USERS=phone ubuntu@ip-172-26-0-161:~$ export REPO_BRANCH=master ubuntu@ip-172-26-0-161:~$ export STORE_PKI=true ubuntu@ip-172-26-0-161:~$ curl -s https://raw.githubusercontent.com/trailofbits/algo/master/install.sh | sudo -E bash -x

PLAY [localhost] ***

TASK [Gathering Facts] ***** ok: [localhost]

TASK [Playbook dir stat] *** ok: [localhost]

TASK [Ensure Ansible is not being run in a world writable directory] *** ok: [localhost] => { "changed": false, "msg": "All assertions passed" } [WARNING]: The value '' is not a valid IP address or network, passing this value to ipaddr filter might result in breaking change in future.

TASK [Ensure the requirements installed] *** ok: [localhost]

TASK [Set required ansible version as a fact] ** ok: [localhost] => (item=ansible-core==2.12.1)

TASK [Verify Python meets Algo VPN requirements] *** ok: [localhost] => { "changed": false, "msg": "All assertions passed" }

TASK [Verify Ansible meets Algo VPN requirements] ** ok: [localhost] => { "changed": false, "msg": "All assertions passed" } [WARNING]: Found variable using reserved name: no_log

PLAY [Ask user for the input] **

TASK [Gathering Facts] ***** ok: [localhost]

TASK [Set facts based on the input] **** ok: [localhost]

TASK [Set facts based on the input] **** ok: [localhost]

PLAY [Provision the server] ****

TASK [Gathering Facts] ***** ok: [localhost]

TASK [Install the requirements] **** changed: [localhost]

TASK [Include a provisioning role] *****

TASK [local : Set the facts] *** ok: [localhost]

TASK [local : Set the facts] *** ok: [localhost]

TASK [Set subjectAltName as a fact] **** ok: [localhost]

TASK [Add the server to an inventory group] **** changed: [localhost]

TASK [debug] *** ok: [localhost] => { "IP_subject_alt_name": "13.48.104.144" } [WARNING]: Reset is not implemented for this connection

TASK [Wait 600 seconds for target connection to become reachable/usable] *** ok: [localhost] => (item=localhost)

PLAY [Configure the server and install required software] **

TASK [common : Check the system] *** ok: [localhost]

TASK [common : include_tasks] ** included: /opt/algo/roles/common/tasks/ubuntu.yml for localhost

TASK [common : Gather facts] *** ok: [localhost]

TASK [common : Install unattended-upgrades] **** ok: [localhost]

TASK [common : Configure unattended-upgrades] ** changed: [localhost]

TASK [common : Periodic upgrades configured] *** changed: [localhost]

TASK [common : Disable MOTD on login and SSHD] ***** changed: [localhost] => (item={'regexp': '^session.optional.pam_motd.so.', 'line': '# MOTD DISABLED', 'file': '/etc/pam.d/login'}) changed: [localhost] => (item={'regexp': '^session.optional.pam_motd.so.', 'line': '# MOTD DISABLED', 'file': '/etc/pam.d/sshd'})

TASK [common : Ensure fallback resolvers are set] ** changed: [localhost]

TASK [common : Loopback for services configured] *** changed: [localhost]

TASK [common : systemd services enabled and started] *** ok: [localhost] => (item=systemd-networkd) ok: [localhost] => (item=systemd-resolved)

RUNNING HANDLER [common : restart systemd-networkd] **** changed: [localhost]

RUNNING HANDLER [common : restart systemd-resolved] **** changed: [localhost]

TASK [common : Check apparmor support] ***** ok: [localhost]

TASK [common : Set fact if apparmor enabled] *** ok: [localhost]

TASK [common : Define facts] *** ok: [localhost]

TASK [common : Set facts] ** ok: [localhost]

TASK [common : Set IPv6 support as a fact] ***** ok: [localhost]

TASK [common : Check size of MTU] ** ok: [localhost]

TASK [common : Set OS specific facts] ** ok: [localhost]

TASK [common : Install tools] ** changed: [localhost]

TASK [common : include_tasks] ** included: /opt/algo/roles/common/tasks/iptables.yml for localhost

TASK [common : Iptables configured] **** changed: [localhost] => (item={'src': 'rules.v4.j2', 'dest': '/etc/iptables/rules.v4'})

TASK [common : Iptables configured] **** changed: [localhost] => (item={'src': 'rules.v6.j2', 'dest': '/etc/iptables/rules.v6'})

TASK [common : Sysctl tuning] ** changed: [localhost] => (item={'item': 'net.ipv4.ip_forward', 'value': 1}) changed: [localhost] => (item={'item': 'net.ipv4.conf.all.forwarding', 'value': 1}) changed: [localhost] => (item={'item': 'net.ipv6.conf.all.forwarding', 'value': 1})

RUNNING HANDLER [common : restart iptables] **** changed: [localhost]

TASK [dns : Include tasks for Ubuntu] ** included: /opt/algo/roles/dns/tasks/ubuntu.yml for localhost

TASK [dns : Install dnscrypt-proxy] **** changed: [localhost]

TASK [dns : Ubuntu | Configure AppArmor policy for dnscrypt-proxy] ***** changed: [localhost]

TASK [dns : Ubuntu | Enforce the dnscrypt-proxy AppArmor policy] *** ok: [localhost]

TASK [dns : Ubuntu | Ensure that the dnscrypt-proxy service directory exist] *** changed: [localhost]

TASK [dns : Ubuntu | Add custom requirements to successfully start the unit] *** changed: [localhost]

TASK [dns : dnscrypt-proxy ip-blacklist configured] **** changed: [localhost]

TASK [dns : dnscrypt-proxy configured] ***** changed: [localhost] [WARNING]: flush_handlers task does not support when conditional

RUNNING HANDLER [dns : restart dnscrypt-proxy] ***** changed: [localhost]

TASK [dns : dnscrypt-proxy enabled and started] **** ok: [localhost]

TASK [wireguard : Ensure the required directories exist] *** changed: [localhost] => (item=configs/13.48.104.144/wireguard//.pki//preshared) changed: [localhost] => (item=configs/13.48.104.144/wireguard//.pki//private) changed: [localhost] => (item=configs/13.48.104.144/wireguard//.pki//public) changed: [localhost] => (item=configs/13.48.104.144/wireguard//apple/ios) changed: [localhost] => (item=configs/13.48.104.144/wireguard//apple/macos)

TASK [wireguard : Include tasks for Ubuntu] **** included: /opt/algo/roles/wireguard/tasks/ubuntu.yml for localhost

TASK [wireguard : WireGuard installed] ***** changed: [localhost]

TASK [wireguard : Set OS specific facts] *** ok: [localhost]

TASK [wireguard : Generate private keys] *** changed: [localhost] => (item=phone) changed: [localhost] => (item=13.48.104.144)

TASK [wireguard : Save private keys] *** changed: [localhost] => (item=None) changed: [localhost] => (item=None) changed: [localhost]

TASK [wireguard : Touch the lock file] ***** changed: [localhost] => (item=phone) changed: [localhost] => (item=13.48.104.144)

TASK [wireguard : Generate preshared keys] ***** changed: [localhost] => (item=phone) changed: [localhost] => (item=13.48.104.144)

TASK [wireguard : Save preshared keys] ***** changed: [localhost] => (item=None) changed: [localhost] => (item=None) changed: [localhost]

TASK [wireguard : Touch the preshared lock file] *** changed: [localhost] => (item=phone) changed: [localhost] => (item=13.48.104.144)

TASK [wireguard : Generate public keys] **** ok: [localhost] => (item=phone) ok: [localhost] => (item=13.48.104.144)

TASK [wireguard : Save public keys] **** changed: [localhost] => (item=None) changed: [localhost] => (item=None) changed: [localhost]

TASK [wireguard : WireGuard user list updated] ***** changed: [localhost] => (item=phone)

TASK [wireguard : set_fact] **** ok: [localhost]

TASK [wireguard : WireGuard users config generated] **** changed: [localhost] => (item=[0, 'phone'])

TASK [wireguard : include_tasks] *** included: /opt/algo/roles/wireguard/tasks/mobileconfig.yml for localhost => (item=ios) included: /opt/algo/roles/wireguard/tasks/mobileconfig.yml for localhost => (item=macos)

TASK [wireguard : WireGuard apple mobileconfig generated] ** changed: [localhost] => (item=[0, 'phone'])

TASK [wireguard : WireGuard apple mobileconfig generated] ** changed: [localhost] => (item=[0, 'phone'])

TASK [wireguard : Generate QR codes] *** ok: [localhost] => (item=[0, 'phone'])

TASK [wireguard : WireGuard configured] **** changed: [localhost]

TASK [wireguard : WireGuard enabled and started] *** changed: [localhost]

RUNNING HANDLER [wireguard : restart wireguard] **** changed: [localhost]

TASK [strongswan : include_tasks] ** included: /opt/algo/roles/strongswan/tasks/ubuntu.yml for localhost

TASK [strongswan : Set OS specific facts] ** ok: [localhost]

TASK [strongswan : Ubuntu | Install strongSwan] **** changed: [localhost]

TASK [strongswan : Ubuntu | Charon profile for apparmor configured] **** changed: [localhost]

TASK [strongswan : Ubuntu | Enforcing ipsec with apparmor] ***** ok: [localhost] => (item=/usr/lib/ipsec/charon) ok: [localhost] => (item=/usr/lib/ipsec/lookip) ok: [localhost] => (item=/usr/lib/ipsec/stroke)

TASK [strongswan : Ubuntu | Enable services] *** ok: [localhost] => (item=apparmor) ok: [localhost] => (item=strongswan-starter) ok: [localhost] => (item=netfilter-persistent)

TASK [strongswan : Ubuntu | Ensure that the strongswan service directory exists] *** changed: [localhost]

TASK [strongswan : Ubuntu | Setup the cgroup limitations for the ipsec daemon] *** changed: [localhost]

TASK [strongswan : Ensure that the strongswan user exists] ***** ok: [localhost]

TASK [strongswan : Install strongSwan] ***** ok: [localhost]

TASK [strongswan : Setup the config files from our templates] ** changed: [localhost] => (item={'src': 'strongswan.conf.j2', 'dest': 'strongswan.conf', 'owner': 'root', 'group': 'root', 'mode': '0644'}) changed: [localhost] => (item={'src': 'ipsec.conf.j2', 'dest': 'ipsec.conf', 'owner': 'root', 'group': 'root', 'mode': '0644'}) changed: [localhost] => (item={'src': 'ipsec.secrets.j2', 'dest': 'ipsec.secrets', 'owner': 'strongswan', 'group': 'root', 'mode': '0600'}) changed: [localhost] => (item={'src': 'charon.conf.j2', 'dest': 'strongswan.d/charon.conf', 'owner': 'root', 'group': 'root', 'mode': '0644'})

TASK [strongswan : Get loaded plugins] ***** ok: [localhost]

TASK [strongswan : Disable unneeded plugins] *** changed: [localhost] => (item=connmark) changed: [localhost] => (item=bypass-lan) changed: [localhost] => (item=rc2) changed: [localhost] => (item=sha1) changed: [localhost] => (item=md5) changed: [localhost] => (item=counters) changed: [localhost] => (item=resolve) changed: [localhost] => (item=sshkey) changed: [localhost] => (item=agent) changed: [localhost] => (item=xcbc) changed: [localhost] => (item=mgf1) changed: [localhost] => (item=xauth-generic) changed: [localhost] => (item=eap-mschapv2) changed: [localhost] => (item=updown) changed: [localhost] => (item=dnskey) changed: [localhost] => (item=constraints) changed: [localhost] => (item=pkcs1) changed: [localhost] => (item=aesni) changed: [localhost] => (item=drbg) changed: [localhost] => (item=attr) changed: [localhost] => (item=gmp) changed: [localhost] => (item=fips-prf)

TASK [strongswan : Ensure that required plugins are enabled] *** changed: [localhost] => (item=aes) changed: [localhost] => (item=x509) changed: [localhost] => (item=pkcs7) changed: [localhost] => (item=nonce) changed: [localhost] => (item=pkcs8) changed: [localhost] => (item=gcm) changed: [localhost] => (item=stroke) changed: [localhost] => (item=pem) changed: [localhost] => (item=revocation) changed: [localhost] => (item=socket-default) changed: [localhost] => (item=hmac) changed: [localhost] => (item=pkcs12) changed: [localhost] => (item=random) changed: [localhost] => (item=pubkey) changed: [localhost] => (item=kernel-netlink) changed: [localhost] => (item=pgp) changed: [localhost] => (item=sha2) changed: [localhost] => (item=openssl)

TASK [strongswan : debug] ** ok: [localhost] => { "subjectAltName": "IP:13.48.104.144,IP:2a05:d016:68d:f200:c553:15be:6c28:e8d8" }

TASK [strongswan : Ensure the pki directories exist] *** changed: [localhost] => (item=ecparams) changed: [localhost] => (item=certs) changed: [localhost] => (item=crl) changed: [localhost] => (item=newcerts) changed: [localhost] => (item=private) changed: [localhost] => (item=public) changed: [localhost] => (item=reqs)

TASK [strongswan : Ensure the config directories exist] **** changed: [localhost] => (item=apple) changed: [localhost] => (item=manual)

TASK [strongswan : Ensure the files exist] ***** changed: [localhost] => (item=.rnd) changed: [localhost] => (item=private/.rnd) changed: [localhost] => (item=index.txt) changed: [localhost] => (item=index.txt.attr) changed: [localhost] => (item=serial)

TASK [strongswan : Generate the openssl server configs] **** changed: [localhost]

TASK [strongswan : Build the CA pair] ** changed: [localhost]

TASK [strongswan : Copy the CA certificate] **** changed: [localhost]

TASK [strongswan : Generate the serial number] ***** changed: [localhost]

TASK [strongswan : Build the server pair] ** changed: [localhost]

TASK [strongswan : Build the client's pair] **** changed: [localhost] => (item=phone)

TASK [strongswan : Build openssh public keys] ** changed: [localhost] => (item=phone)

TASK [strongswan : Build the client's p12] ***** changed: [localhost] => (item=phone)

TASK [strongswan : Build the client's p12 with the CA cert included] *** changed: [localhost] => (item=phone)

TASK [strongswan : Copy the p12 certificates] ** changed: [localhost] => (item=phone)

TASK [strongswan : Get active users] *** changed: [localhost]

TASK [strongswan : Copy the keys to the strongswan directory] ** changed: [localhost] => (item={'src': 'cacert.pem', 'dest': 'cacerts/ca.crt', 'owner': 'strongswan', 'group': 'root', 'mode': '0600'}) changed: [localhost] => (item={'src': 'certs/13.48.104.144.crt', 'dest': 'certs/13.48.104.144.crt', 'owner': 'strongswan', 'group': 'root', 'mode': '0600'}) changed: [localhost] => (item={'src': 'private/13.48.104.144.key', 'dest': 'private/13.48.104.144.key', 'owner': 'strongswan', 'group': 'root', 'mode': '0600'})

TASK [strongswan : Register p12 PayloadContent] **** ok: [localhost] => (item=phone)

TASK [strongswan : Set facts for mobileconfigs] **** ok: [localhost]

TASK [strongswan : Build the mobileconfigs] **** changed: [localhost] => (item=None) changed: [localhost]

TASK [strongswan : Build the client ipsec config file] ***** changed: [localhost] => (item=phone)

TASK [strongswan : Build the client ipsec secret file] ***** changed: [localhost] => (item=phone)

TASK [strongswan : Restrict permissions for the local private directories] ***** ok: [localhost]

TASK [strongswan : strongSwan started] ***** ok: [localhost]

RUNNING HANDLER [strongswan : restart strongswan] ** changed: [localhost]

RUNNING HANDLER [strongswan : daemon-reload] *** ok: [localhost]

TASK [Dump the configuration] ** changed: [localhost]

TASK [Create a symlink if deploying to localhost] ** changed: [localhost]

TASK [debug] *** ok: [localhost] => { "msg": [ [ "\"# Congratulations! #\"", "\"# Your Algo server is running. #\"", "\"# Config files and certificates are in the ./configs/ directory. #\"", "\"# Go to https://whoer.net/ after connecting #\"", "\"# and ensure that all your traffic passes through the VPN. #\"", "\"# Local DNS resolver 172.28.68.46, fd00::c:442e #\"", "" ], " \"# The p12 and SSH keys password for new users is r15RG4_Sw #\"\n", " \"# The CA key password is ueHAJDCWyIa9bbAg #\"\n", " " ] }

PLAY RECAP ***** localhost : ok=118 changed=65 unreachable=0 failed=0 skipped=65 rescued=0 ignored=0

davidemyers commented 2 years ago

Since you created the Lightsail instance yourself (rather then letting Algo create it for you) make sure you open the necessary ports in the Lightsail firewall. See AlgoVPN and Firewalls.

vvorlov commented 2 years ago

Great, thank you a lot!