feature suggestion: Auto configuration of wireguard bridges between pfsense installs
-
I suggested this on reddit and it was requested that I make an entry here so it can be tracked / commented on / evaluated. So I'm posting it here as a feature suggestion. It would be super helpful to be able to point two pfsense at each other in some manner and automatically(ish?) get the configuration right in wireguard. I'm not sure exactly what this would look like but figured I should propagate it over here in case it's workable.
-
You might also add it as a feature request here:
https://redmine.pfsense.org -
That's unlikely to happen in an automated way.
If the two could already communicate in a secure way to do this, why would they need a VPN? If there is no VPN, then there is no way to securely transfer the configuration.
Adding a WireGuard tunnel on both is just a matter of a few clicks in current builds. It's not exactly going to need a lot of hand-holding and not much could be automated or put behind a wizard.
-
@jimp It would seem useful to at least enable the 'scan from qr code' mode for setting up mobile devices, the android application at the least has this feature available.
But more broadly, we run a number of small/large pfsense devices floating around a university network. While I can remotely manage the web interface no problem, that's decidedly separate from joining together say, management networks separated by several vlans into one private encrypted space that we can attach to for accessing idracs, switch management consoles, etc.
-
Yeah the QR code for mobile client setup is a different matter. We are already looking at that, it's discussed in another thread here.
Steve
-
Sounds like they want pfSense to read someone else's QR code and parse it out, and that is highly unlikely to happen. It would be a lot more dev work and dependencies to feed a QR code into pfSense (and for us to carry image processing libraries) than it would to just enter the handful required config fields that you only have to do once.
-
Ah I read that as having pfSense generate a QR code that the Android WG app can use to read in the required settings. Which seems like a far more practical use case.
Steve
-
@jimp I was in fact talking about having pfsense present a qr code you could scan on your phone.
But it would be handy to have that same data as something you can cut/paste in a text format for joining two pfsense boxes. I have less of an idea what that would look like.
