Adding Wireguard Tunnel #524

janchri · 2023-01-19T01:28:47Z

Wireguard is an easy way to connect peers together even behind NATs and all kinds of firewall constructs. A possible use case might be, that one already has a VPS configured somewhere (AWS, Ionos, Netcup, Strato....) and wants to use the server to capture all the data from OpenDTU. This is possible with the fork! One has to simply configure the regular Wireguard VPN network (maybe already done!) and set the MQTT broker of the OpenDTU to the "local Wireguard IP address" of the endpoint/server.

The implementation of the Wireguard function is basically a copy/fork of https://github.com/ciniml/WireGuard-ESP32-Arduino . However, due to strict compile rules within the OpenDTU project, I had to fork the WireGuard-ESP32-Arduino and remove some minor "errors/flaws".
In platformio.ini, one can see I used a forked version of the above Wireguard Arduino library. Additionally to that, I implemented the backend following more or less the general "work flow of OpenDTU". Finally, the frontend is updated, too.

Unfortunatley, if one wants to reconfigure the Wireguard parameters online, the OpenDTU has to reboot. I have really tried to fix this problem, however, "live" changes can occasionally create kernel panics/runtime errors and forced reboots. But, I assume that changing the parameters quite frequently is not needed at all and, therefore, I think the current status is a viable solution.

Happy to discuss the approach and the general idea of using Wireguard + OpenDTU. For me, it does make great sense, as I do not have to buy, configure, and support an additional device such as an Raspi, etc. pp.

…sensitive server data

T3rm1 · 2023-03-16T21:07:48Z

Why did you choose Wireguard to achieve what you described?
What I did is simply host a MQTT broker on the VPS and set up TLS with a free certificate from Let's Encrypt and enabled password authentication.
What would be the benefit of Wireguard here?

janchri · 2023-03-16T21:17:09Z

It is probably quite a personal opinion, but I do not like to open ports at my VPS. My VPS is a remote entry point into my mixed local/remote network, where everyone can communicate with each other. So I really need a "closed environment".
Typically, I only open a random SSH Port and a random Wireguard Port. Rest is closed and a user has to tunnel into my network using Wireguard or SSH to be able to roam around in my local/remote network or use any services like bitwarden/nextcloud etc.

EDIT: I can also access from anywhere and all my devices the regular opendtu local website. Which comes at handy from time to time. Of course, one can make this happen having a tunnel into your home local network as well. But with wireguard everything is nicely organized and orchestrated and imho very secure.

3DJupp · 2023-07-17T10:01:01Z

I would not choose wireguard on a small microcontroller like the esp32/8266 etc.
Most routers using OpenWRT or similar should have the ability of implementing wireguard.
I mean, of course, that is indeed possible, but you might need some WRT device behind the ESP anyway. (or other Router/Access Point manufacturer)

CommanderRedYT

Whats the reason for implementing Shelly in the same MR as Wireguard?

CommanderRedYT · 2023-10-24T13:05:07Z

platformio.ini

@@ -28,6 +28,7 @@ lib_deps =
    nrf24/RF24 @ ^1.4.5
    olikraus/U8g2 @ ^2.34.13
    buelowp/sunset @ ^1.1.7
+    https://github.com/janchri/WireGuard-ESP32-Arduino


You might want to pin the exact version so this stays reproducible

ESPHome uses this in their platformio.ini:

droscy/[email protected] ; wireguard

@janchri would it be better to use the Library that Tomoyuki Sakurai created for ESP-IDF and Simone Rosetto already maintains for ESPHOME ?

And that is also fork because of some esphome optimizations, but works perfectly.
Maybe it make sense to start new attempt with this "esphome" fork...

Adminius · 2024-09-26T08:45:37Z

@janchri any news? I would like to use it wireguard ;)

stefan123t · 2024-09-26T17:53:40Z

webapp/src/locales/de.json

+        "InverterSettings": "Wechselrichter Einstellungen",
+        "SecuritySettings": "Sicherheitseinstellungen",
+        "DTUSettings": "DTU Einstellungen",
+        "DeviceManager": "Geräte-Manager",


Einstellungen is already the title of the Settings menü. Do not repeat it in every entry.

stefan123t · 2024-09-26T17:55:14Z

webapp/src/locales/fr.json

@@ -343,6 +362,36 @@
        "SynchronizeTime": "Synchroniser l'heure",
        "SynchronizeTimeHint": "<b>Astuce :</b> Vous pouvez utiliser la synchronisation horaire manuelle pour définir l'heure actuelle d'OpenDTU si aucun serveur NTP n'est disponible. Mais attention, en cas de mise sous tension, l'heure est perdue. Notez également que la précision de l'heure sera faussée, car elle ne peut pas être resynchronisée régulièrement et le microcontrôleur ESP32 ne dispose pas d'une horloge temps réel."
    },
+    "wireguardadmin": {


french translation has been filled with english stubs.

stefan123t · 2024-09-26T18:04:01Z

I would not choose wireguard on a small microcontroller like the esp32/8266 etc. Most routers using OpenWRT or similar should have the ability of implementing wireguard. I mean, of course, that is indeed possible, but you might need some WRT device behind the ESP anyway. (or other Router/Access Point manufacturer)

@3DJupp same for me, I do not see the application of this on the OpenDTU ESP32 (yet?).
We already have to cope with limited memory and may not include a lot of libraries.

@janchri For my understanding (I am not very familiar with Wireguard yet, I mostly use OpenVPN / IPSec with pre-shared keys) this implements a Wireguard Client for an OpenDTU placed in a User Home LAN, which will connect to a Wireguard server somewhere else e.g. on another LAN Router / Access Point, i.e. your Admin Home LAN or the VPS. So you can later contact/connect to and administrate the remote OpenDTU in the other User's Home LAN from your Admin Home LAN / VPS, right ?

Whats the reason for implementing Shelly in the same MR as Wireguard?

@CommanderRedYT the Shelly 3EM is supported by OpenDTU-onBattery too. I would suggest to drop this from the PR or cherry pick / pull the Wireguard specifica only.

CommanderRedYT · 2024-09-26T18:11:59Z

So in general wireguard is easily possible on any kind of esp32 (maybe even esp8266), it just takes very few kB of program space if not less. I haven't fully looked into this, but for example ESPHome has a integration for this. You can find it here

Adminius · 2024-09-26T18:12:12Z

@stefan123t my use case: I have Wireguard server. Some ESPHome esp32 are already connected via WG/internet to my local network, because this ESP32 are far away from my home, but managed by me.
My sister uses openDTU-onBattery. I tried to put extra RasPi with Tailscale or Wiregare to manage and check the installation some time. But to run RasPi with ~4Watt only to manage some times opnDTU is overkill (and it died a while ago)
That why I came with idea again to use Wiregate on esp32 directly.

stefan123t · 2024-09-26T18:19:59Z

So in general wireguard is easily possible on any kind of esp32 (maybe even esp8266), it just takes very few kB of program space if not less. I haven't fully looked into this, but for example ESPHome has a integration for this. You can find it here

@CommanderRedYT thanks for the explanation. So this way you only get access to the individual OpenDTU instance and not the whole Users Home LAN. And you do not have to configure the Users Home LAN Router to access his/her LAN from your Wireguard Server.
I just had a quick peek at your OpenDTU React App (Android) which would then also allow to connect to your Admin Home LAN and that way both (OpenDTU and OpenDTU-React-Native App) would be able to connect to each other ?

Note that it comes with three CAVEATs:

licensing / trademark policy for WireGuard vs. GPL-v2 in OpenDTU and NRF24 libraries
need to install a WireGuard server on your Admin Home LAN anyway
time has to be synchronized properly for it to work (nonce's), e.g. using SNTP.

These were listed on your esphome link:

Please note that “WireGuard” and the “WireGuard” logo are registered trademarks of Jason A. Donenfeld. See “WireGuard” Trademark Usage Policy for additional information.

Actually the ESPHOME maintained implementation is BSD 3-Clause licensed: https://github.com/droscy/esp_wireguard/

Warning
To successfully use this component you must have WireGuard® also on your remote host (already installed and ready to accept connections). If you don’t have it please read the section Remote peer setup.

Warning
This component requires the system clock to be synchronized.
See Time Component to setup a time source and do not use homeassistant time-platform if Home Assistant is on the remote peer because the time synchronization is a prerequisite to establish the VPN link.
The SNTP Time Source is a valid time-platform choice.

Adminius · 2024-09-30T20:22:51Z

and now?
@janchri doesn't answer, and had almost one year no activity...

I would say start a new implementation based on ESPHome lib?

janchri · 2024-09-30T20:39:19Z

Hi, I am so sorry. Was totally not aware that this pull request is still up for debate. Feel free to use any part of the code I prepared so far. The wireguard implementation is not writen by myself, instead it was forked by another repo and I simply fixed minor compile time issues. If there is any other solution, like ESPHome, it might be a good idea to use this as a base.

stefan123t · 2024-09-30T20:59:28Z

@Adminius / @CommanderRedYT who would like to provide a new PR based on the droscy/[email protected] ; wireguard platformio.ini ?
Most of the Vue code could probably be used verbatim and the Shelly parts can be left out as they are in OpenDTU-OnBattery afaik.

Adminius · 2024-10-01T09:46:30Z

who would like to provide a new PR based

If @CommanderRedYT has no time, I'll try, but I also have limited time...

CommanderRedYT · 2024-10-01T12:06:30Z

I might have time in evenings, but as I also have other projects I cannot estimate how long it would take. I can try it however, but I would open another PR for this.

Adminius · 2024-10-01T12:17:35Z

new PR make sense. and copy&paste some (UI/settings) from this

janchri and others added 19 commits January 15, 2023 23:22

quick & dirty wireguard version for openDTU

ee20151

Plaformio_override.ini update

f69ecb5

Fix timezone/configTime() in beginWireGuard()

b8376cb

Add wireguard to Configuration.h & WebApi

245cdb0

Fix linking error -> class name was wrong in WebApi_wireguard.cpp

cddde6c

fix typo

177fa4d

Minor fixes due to code quality

1cf3abc

Create new Class Files for Wireguard; improve encapsulation

1147b34

wireguardclass created; better encapsulation

3e0a9da

changed gitignore for debugging, added private keys

f71f8c0

minor fix: typo + defaults_wireguard.h added for storing secret keys/…

3497dcb

…sensitive server data

Merge branch 'tbnobody:master' into master

5fb1789

fix array length of key variable to [45]

71591aa

v3.2.2

aeec268

Minor fixes in backend + first frontend integration for wireguard

e3e3c87

Fix language files; added EN, FR missing!

5c52cad

restart needed for wireguard setup changes; working on a fix

269075d

Merge branch 'tbnobody:master' into master

4ec13fb

Update vuejs frontend

0294f2e

janchri changed the title ~~Added Wireguard~~ Adding Wireguard Tunnel Jan 19, 2023

janchri added 10 commits January 21, 2023 11:37

fix .gitignore

92ad765

quick & dirty wireguard version for openDTU

0cb91b7

Plaformio_override.ini update

9ec6a3a

Fix timezone/configTime() in beginWireGuard()

e8e10f7

Add wireguard to Configuration.h & WebApi

21c6e5b

Fix linking error -> class name was wrong in WebApi_wireguard.cpp

ff21d4d

fix typo

d54c1ed

Minor fixes due to code quality

f7f939a

Create new Class Files for Wireguard; improve encapsulation

ffebfaa

wireguardclass created; better encapsulation

9f62701

janchri added 13 commits January 21, 2023 12:42

Update vuejs frontend

52c55b9

fix .gitignore

5743df3

merge upstream/master and wireguard

7db01c9

merge frontend app.js.gz

7ca107c

Merge remote-tracking branch 'upstream/master'

bd201b9

merge apps.js.gz with upstream/master

bb996fc

Merge remote-tracking branch 'upstream/master'

de21805

Merge branch 'master' of https://github.com/tbnobody/OpenDTU

76b730b

Merge upstream/master

a3a06cc

Merge upstream/master webapp

29ad6b2

added allowedIp/allowedMask + Shelly3em support

d8440f6

set shelly to 3sec polling

c23218e

Shelly 3sec polling

01a7b2e

CommanderRedYT reviewed Oct 24, 2023

View reviewed changes

stefan123t reviewed Sep 26, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding Wireguard Tunnel #524

Adding Wireguard Tunnel #524

janchri commented Jan 19, 2023

T3rm1 commented Mar 16, 2023

janchri commented Mar 16, 2023 •

edited

Loading

3DJupp commented Jul 17, 2023

CommanderRedYT left a comment

CommanderRedYT Oct 24, 2023

stefan123t Sep 26, 2024 •

edited

Loading

Adminius Sep 26, 2024

Adminius commented Sep 26, 2024

stefan123t Sep 26, 2024

stefan123t Sep 26, 2024 •

edited

Loading

stefan123t commented Sep 26, 2024 •

edited

Loading

CommanderRedYT commented Sep 26, 2024

Adminius commented Sep 26, 2024

stefan123t commented Sep 26, 2024 •

edited

Loading

Adminius commented Sep 30, 2024

janchri commented Sep 30, 2024 •

edited

Loading

stefan123t commented Sep 30, 2024

Adminius commented Oct 1, 2024

CommanderRedYT commented Oct 1, 2024

Adminius commented Oct 1, 2024

Adding Wireguard Tunnel #524

Are you sure you want to change the base?

Adding Wireguard Tunnel #524

Conversation

janchri commented Jan 19, 2023

T3rm1 commented Mar 16, 2023

janchri commented Mar 16, 2023 • edited Loading

3DJupp commented Jul 17, 2023

CommanderRedYT left a comment

Choose a reason for hiding this comment

CommanderRedYT Oct 24, 2023

Choose a reason for hiding this comment

stefan123t Sep 26, 2024 • edited Loading

Choose a reason for hiding this comment

Adminius Sep 26, 2024

Choose a reason for hiding this comment

Adminius commented Sep 26, 2024

stefan123t Sep 26, 2024

Choose a reason for hiding this comment

stefan123t Sep 26, 2024 • edited Loading

Choose a reason for hiding this comment

stefan123t commented Sep 26, 2024 • edited Loading

CommanderRedYT commented Sep 26, 2024

Adminius commented Sep 26, 2024

stefan123t commented Sep 26, 2024 • edited Loading

Adminius commented Sep 30, 2024

janchri commented Sep 30, 2024 • edited Loading

stefan123t commented Sep 30, 2024

Adminius commented Oct 1, 2024

CommanderRedYT commented Oct 1, 2024

Adminius commented Oct 1, 2024

janchri commented Mar 16, 2023 •

edited

Loading

stefan123t Sep 26, 2024 •

edited

Loading

stefan123t Sep 26, 2024 •

edited

Loading

stefan123t commented Sep 26, 2024 •

edited

Loading

stefan123t commented Sep 26, 2024 •

edited

Loading

janchri commented Sep 30, 2024 •

edited

Loading