# DeTEE WireGuard Example This examples shows how WireGuard can be used to create network overlays on top of DeTEE. Please keep in mind that real world scenarios will require deployments of a higher complexity. This architecture contains 4 nodes, in a redundant setup: - two bastion nodes, that serve as VPN servers - two protected nodes, that connect as clients The Laptop (the device used by the admin to deploy) also creates VPN tunnels to the two bastion nodes. A nginx server is started on both protected nodes, in order to demonstrate how protected services can run behind VPN. ## Network Diagram ```mermaid graph TD Laptop(Laptop
local-cali: 10.100.10.10/24
local-vanc: 10.200.20.10/24) CaliBastion(Cali Bastion
Server: 10.100.10.1/24
Client: 10.200.20.21/24) VancBastion(Vanc Bastion
Server: 10.200.20.1/24
Client: 10.100.10.21/24) CaliProtected(Cali Protected
cali: 10.100.10.101/24
vanc: 10.200.20.101/24) VancProtected(Vanc Protected
cali: 10.100.10.201/24
vanc: 10.200.20.201/24) Laptop -- "WireGuard" --> CaliBastion Laptop -- "WireGuard" --> VancBastion CaliBastion -- "WireGuard" --> CaliProtected CaliBastion -- "WireGuard" --> VancProtected VancBastion -- "WireGuard" --> CaliProtected VancBastion -- "WireGuard" --> VancProtected ``` ## Commands To create the VMs, run `./create_vms.sh`. To deploy WireGuard, run `./deploy.sh`. To test the connections, try to access services running on the protected nodes: ``` curl http://10.200.20.101 curl http://10.100.10.101 curl http://10.100.10.201 curl http://10.200.20.201 ``` ## Possible improvements The following improvements would be cool for this setup: - create failover routing that triggers if one of the bastions goes down - hide SSH from the public IP and allow SSH only via private network