[dminor]

I've seen WireGuard recommended here pretty strongly, so I started looking into it, but I couldn't see exactly how it could replace OpenVPN for us.

We have an OpenVPN bastion for access into our VPC, and each engineer has their own key. When someone leaves, we can revoke their key.

But WireGuard seems to use a single key per network interface. Would we just create an interface for every engineer (I have no idea what the limits are on these - maybe they're cheap)? Or is this just not a good use case for WireGuard?

[dsacco]

> But WireGuard seems to use a single key per network interface.

Every interface is associated with a public/private key pair, but each interface need not peer with a single client. That would be inefficient. Instead, each peer (including clients and the server) generates a personal key pair when they configure their local WireGuard (e.g. wg0) interface. Afterwards they set up a local configuration file consisting of peers and respective public keys.

Then in the context of a company VPN, one peer is a designated server, and every other (client) peer lists the server’s remote IP as the only peer interface in their local configuration. The server has the public key of every client as respective entries in its local config file, which is used to restrict access to whitelisted clients. Any client with the corresponding private key locally can connect to the server’s interface using their local interface.

To remove a client from the white list, you simply remove their peer entry from the local config file on the server, much like how you remove an SSH public key from authorized_keys. In fact, a decent mental model for WireGuard is tuennling over SSH, but faster, leaner and with no option for a shell or password login.

[baobrien]

With WireGuard you have one public/private key pair for that interface, and a list of public keys for trusted peers. Access management would still be about the same -- each engineer would have a key pair, and you'd have the public key on the trusted list of the host side.

[lvh]

Each network interface has a key pair associated with it, but it can pair with any number of other interfaces (having a pubkey for each). This is similar to how OpenVPN presumably works for you: each OpenVPN network device on your developers' laptops comes with a certificate they use to authenticate to you.

So yes: there's one interface per engineer laptop, but that's already the case. There's only one remote interface though. (Or several, if you want to have several VPNs -- Wireguard makes that pretty easy too!)

[agnuacc]

IIRC, the wireguard server's config file has defined peers (clients) so you could just remove the peer pubkey from the config file and they would no longer be able to connect.