diff --git a/Guides/generate-wireguard.md b/Guides/generate-wireguard.md new file mode 100644 index 0000000..81e6715 --- /dev/null +++ b/Guides/generate-wireguard.md @@ -0,0 +1,61 @@ +--- +title: Manually Generate Wireguard Peer in OPNsense +description: +published: true +date: 2025-05-04T11:42:39.943Z +tags: public, networking +editor: markdown +dateCreated: 2025-05-04T11:38:34.846Z +--- + +# Manually Generate Wireguard Peer in OPNsense +This guide details how to manually (not using the Peer Generator) generate a new Wireguard peer in OPNsense. + + +## Requirements +The `wireguard-tools` package must be installed to generate the public and private keys. + + + +### 1. Create a Peer + +1. Generate a new public and private key with +`wg genkey | tee privatekey | wg pubkey > publickey` +This will create two files in the current directory with the public and private key. Save these for later. + +2. In the OPNsense UI go to VPN > Wireguard > Peers, and click the + to add a new peer + +3. Fill in the details: + - **Name**: Enter a name for the peer + - **Public key**: Paste the public key you generated earlier + - **Pre-shared key**: Generate a key if desired and save it for later + - **Allowed IPs**: Specify the IP address or subnet that this peer is allowed to use (e.g., 10.0.60.2/32). Check your existing peers to ensure it is not already used + - **Endpoint address**: Leave blank if the client will be roaming + - **Endpoint port**: Leave blank + - **Instances** Choose appropriate instance + - **Keepalive**: Can be left blank + +4. Save the Configuration + +### 2. Create the Wireguard Config File + +1. Create a new file called `.conf`. You can choose the name. +2. Copy and paste the contents from below into the file and update the values: +``` +[Interface] +PrivateKey = +Address = 10.0.60.2/32 # Use the same IP address or subnet specified in OPNsense +DNS = 8.8.8.8 # Optional: Specify a DNS server, not required if only routing resources (not an Internet connection) or using DNS names. + +[Peer] +PublicKey = +PresharedKey = # Only needed if generated in previous step +Endpoint = :51820 # Replace with the OPNsense public IP and port +AllowedIPs = 0.0.0.0/0 # Route all traffic through the VPN +``` + +Replace `private-key`, `opnsense-public-key`, `preshared-key`, and `opnsense-public-ip` with the appropriate values. + +For `AllowedIPs`, setting `0.0.0.0/0` will route all IPv4 addresses via the VPN connection. If only access to resources and no internet connection is required, the subnets can be added here i.e. `10.0.60.0/24, 10.0.70.0/24` + +4. Import the `.conf` file into the VPN connection settings on the client device and test the connection. \ No newline at end of file diff --git a/Guides/rdp-with-microsoft-account.md b/Guides/rdp-with-microsoft-account.md new file mode 100644 index 0000000..731b7a6 --- /dev/null +++ b/Guides/rdp-with-microsoft-account.md @@ -0,0 +1,19 @@ +--- +title: RDP to a Windows PC with a Microsoft Account +description: +published: true +date: 2025-01-16T20:32:15.978Z +tags: +editor: markdown +dateCreated: 2025-01-16T20:32:03.050Z +--- + +# RDP with a Microsoft Account + +Windows allows you to log in with only your Microsoft account email and your Microsoft Authenticator app. If you then want to RDP to this computer with the same Microsoft account your password will not be cached locally. + +To add it to the cache, follow the below steps: + +1. Open a new terminal window +2. Enter the command `runas /u:MicrosoftAccount\[my account] cmd.exe` +3. You can now use your email and Microsoft password to RDP to the computer. \ No newline at end of file diff --git a/Guides/reverse_proxy.html b/Guides/reverse_proxy.html new file mode 100644 index 0000000..47de411 --- /dev/null +++ b/Guides/reverse_proxy.html @@ -0,0 +1,129 @@ + + +

This is a guide to create a reverse proxy using a Virtual Private Server, or VPS so that you can access internally hosted services. 

+

My Situation

+

I host some services from my home lab that I access remotely, such as Home Assistant. 

+

In my previous house, I was the account owner for the internet. I was able to get a static IP, and have the ISP open incoming ports 80 and 443 for web traffic.

+

Now I lived in shared accommodation which has an included internet connection, in the form of an Ethernet cable coming out the wall. Everyone just uses the same LAN.
I do have access to the router, but to maintain an environment that I can ‘home lab freely' in, I wanted to set up my own LAN. 

+

I can do this while still utilising the shared connection. We have fiber and my services are not bandwidth heavy. 

+

I have configured a router of my own with, with all traffic sent via Mullvad VPN.

+

Now I need to be able to access my internal services externally, using this same internet connection.

+

The Plan

+

There are some ways I can do this:

+
    +
  • A VPN to my network, such as OpenVPN, SSL VPN, WireGuard, or even an overlay network such as TailScale.
    This however this would mean I have to install a VPN app first and configure it. What if someone else wants to watch videos too? They now have to install some VPN app on their TV. Too much work! I just want to be able to browse to a domain to access the site.
    • +
  • Get a VPN provider with a static IP. This is not ideal as most VPN providers do not provide static IPs, and if they do, they are quite costly.
    • +
  • Use a Cloudflare Tunnel. I have used this in past, it is free, however it is not overly well suited for streaming video. 
    I am working towards a goal of being able to stream 4k video remotely.
    • +
+

Instead, I am going to build my own cloud reverse proxy host.

+

This makes use of a Virtual Private Server (VPS) to run Nginx Reverse Proxy Manager. The VPS will have access to the services running on my internal network via a WireGuard VPN.

+

This will connect to my home network with a WireGuard VPN, and will run Reverse Proxy Manager to manage incoming web connections. 

+

To make this, I need a few things:

+
    +
  1. A VPS. There are many to choose from. In the end I went with a server from OVHcloud.
      +
    • WireGuard is efficient compared to other VPN protocols, so the server does not have to be too powerful.
      • +
    • Be sure to check how much network traffic the VPS allows. Lots have limits, which may or may not be enough for your use case. I am streaming 4k video so I am looking for unlimited bandwidth.
      • +
    +
    2. +
  2. A router that allows for new VPN interfaces to be created. I use opnSense for my router which does allow this.
    3. +
+

VPS Setup

+

First I need to find a VPS provider. As I said before, I went with a server from OVHcloud.

+

The server I chose (VLE-4) costs $11 US per month.

+
    +
  • 4 vCores
    • +
  • 4GB RAM
    • +
  • 80 GB NVMe SSD
    • +
  • 1 Gbps unmetered connection
    • +
  • 1x Static IPv4 address
    • +
  • Anti-DDoS Protection Included
    • +
  • Ubuntu 23.04
    • +
+

 

+

Once I purchased the server and it had provisioned, I connected and set up a few things. 

+
    +
  1. Updated to Ubuntu 23.10
    2. +
  2. Enabled Key-Based only login: See this guide: How To Configure SSH Key-Based Authentication on a Linux Server
    3. +
  3. Enable UFW Firewall
      +
    • Allow port 22(SSH), 51820/UDP(WireGuard), 443(HTTPS)
      sudo ufw allow <PORTS>
      • +
    • Enable UFW
      sudo ufw enable
      • +
    +
    4. +
  4. Enabled the edge firewall on my hosting provider. 
    5. +
+

VPN Setup

+

After this it is time to install WireGuard VPN on the VPS.

+

For this, I mostly followed this guide: How To Set Up WireGuard on Ubuntu 20.04

+

I recommend reading that guide as there are some decisions I made that I do not explain, but at a high level, I followed through the steps up to the end of step 6:

+
    +
  • Install WireGurad
    • +
  • Create a new WireGuard private and public key pair: 
    wg genkey | sudo tee /etc/wireguard/private.key
    sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key
    • +
  • Chose a new IP range, I chose 10.0.20.0/24
    • +
  • Created a new WireGuard Configuration file: 
    /etc/wireguard/wg0.conf
    • +
+

I was then able to start the WireGuard server, however I have still not yet added any peers. The guide explains how to do this on another Linux server, but in this case, I do not want to do that. Instead of step 7:

+

This is done in the WireGuard Instance settings in my Router:

+
+

 

+
+

Be sure to check the ‘Disable routes’ option in the Instance, as I will do this manually
For the gateway, it does not matter, just as long as it is unique.

+

 

+

Then in the Peers tab:

+

The Pubic Key is the Public key from the WireGuard Server on the VPS

+

The Endpoint Address is the public IP of the VPS.

+
+

After this we can continue with the Digital Ocean guide from step 8.

+

The below command is then run to add the new opnSense peer to the Wireguard server.

+

sudo wg set wg0 peer <PUBLIC KEY> allowed-ips 10.0.20.2

+

After doing this, I can see the VPN connection is up:

+
+

 

+

In the end, my /etc/wireguard/wg0.conf file looked like:

+
[Interface]  
+Address = 10.0.20.1/24  
+SaveConfig = true  
+PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE  
+PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE  
+ListenPort = 51822  
+PrivateKey = <SERVER PRIVATE KEY>
+
+[Peer]  
+PublicKey = <PEER PUBLIC KEY>
+AllowedIPs = 10.0.20.0/24, 10.0.10.0/24  
+PersistentKeepalive = 25
+

 

+

Network Setup

+

Now an interface needs to be created on my router for the new VPN connection so that I can configure firewall rules to allow and deny access. 

+

For opnSense, this is as simple as going to Interfaces > Assignments, and adding the new interface 

+
+

Then configure the settings as below:

+
+

You do not need to configure a IPv4 address, as this will automatically get the IP address specified of the Instance Tunnel Address.

+

 

+

After this, I created the below firewall rule so that the new WireGuard interface could access the LAN.

+
+

 

+

If you have any strange issues, check the routing table (System > Routes > Status) to see if there are any old entries that need to be deleted. 

+

 

+

Reverse Proxy

+

For the reverse Proxy I am using Nginx Reverse Proxy Manager running in a Docker container.

+

First, install Docker: Install Docker Engine on Ubuntu

+

Then I installed Portainer to give a nice webUI to manage Docker: Install Portainer CE with Docker on Linux

+

Then in Portainer I made a new stack (docker compose). 

+
+

 

+

I was then able to log into Reverse Proxy Manager and create the my domains in Reverse Proxy Manager

+
+

 

+

I also needed to point these domains to the public IP of my VPS. 

+

 

+

Once this was done, I was able to access the internal services via my domain name. 
For example, this website!

+

 

diff --git a/Guides/windows_upgrade.html b/Guides/windows_upgrade.html new file mode 100644 index 0000000..e207e7d --- /dev/null +++ b/Guides/windows_upgrade.html @@ -0,0 +1,26 @@ + + +

 

+

When trying to update a Windows 10 or 11 install to Pro, by going to Start > Settings > System > Activation > Change product key, and entering a valid Windows Pro edition product key, you may get the below error:

+

The product key you entered didn't work. Check the product key and try again, or enter a different one. (0x80070057)

+
image
+

 

+

To get around this, you will need to use a Windows Generic Key first to upgrade it to Pro

+

 

+
    +
  1. The key for Windows 11 Pro is: VK7JG-NPHTM-C97JM-9MPGT-3V66T
    - Other versions can be found here: Windows 11 Generic Keys for All Editions (winaero.com)
    2. +
  2. Before entering this key, disconnect the device from the network
    3. +
  3. Then go to the Activation settings and Select Change Product Key
    4. +
  4. Enter the generic key from above and press OK. This will then prompt for an upgrade to Pro. Press OK
    5. +
  5. This will then reboot and once it has powered on again, it will be Windows 11 Pro
    6. +
  6. Now you need to reconnect it to the network and navigate to the activation settings, and select Change Product key.
    7. +
  7. Now enter the product key purchased by the customer. The device will now be activated correctly.
    8. +
diff --git a/Private/Test.html b/Private/Test.html new file mode 100644 index 0000000..3136b89 --- /dev/null +++ b/Private/Test.html @@ -0,0 +1,11 @@ + + +

This is a test Private Page

diff --git a/home.html b/home.html new file mode 100644 index 0000000..e862168 --- /dev/null +++ b/home.html @@ -0,0 +1,19 @@ + + +

Welcome to my Wiki

+
+

This site contains various articles and guides written by myself. 

+

This is partly for my reference, as well as provide insight into my home lab and the projects I do around this. 
Others may come across these guides when trying to search how to do something - a place where I find myself often, and i always appreciate it when others make guides that assist me with my projects. There may also be some content here that I created in my university studies or work.

+

Please note that all work here is not intended to be definitive, and may not be best practice. Please combine my work with your own investigations. 
All content posted here is welcome to scrutinization. 

+

For an overview of exactly what I work on, here is a network diagram:

+
+

Site Content

+

There is not much available here at the moment, check back later!

diff --git a/lucas's_home_network.png b/lucas's_home_network.png new file mode 100644 index 0000000..d3f8820 Binary files /dev/null and b/lucas's_home_network.png differ diff --git a/screenshot_2024-03-23_132057.png b/screenshot_2024-03-23_132057.png new file mode 100644 index 0000000..d431249 Binary files /dev/null and b/screenshot_2024-03-23_132057.png differ diff --git a/screenshot_2024-03-23_132217.png b/screenshot_2024-03-23_132217.png new file mode 100644 index 0000000..7198218 Binary files /dev/null and b/screenshot_2024-03-23_132217.png differ diff --git a/screenshot_2024-03-23_132626.png b/screenshot_2024-03-23_132626.png new file mode 100644 index 0000000..0fa24ca Binary files /dev/null and b/screenshot_2024-03-23_132626.png differ diff --git a/screenshot_2024-03-23_132919.png b/screenshot_2024-03-23_132919.png new file mode 100644 index 0000000..69c291e Binary files /dev/null and b/screenshot_2024-03-23_132919.png differ diff --git a/screenshot_2024-03-23_133915.png b/screenshot_2024-03-23_133915.png new file mode 100644 index 0000000..8139f78 Binary files /dev/null and b/screenshot_2024-03-23_133915.png differ diff --git a/screenshot_2024-03-23_133945.png b/screenshot_2024-03-23_133945.png new file mode 100644 index 0000000..39a9a29 Binary files /dev/null and b/screenshot_2024-03-23_133945.png differ diff --git a/screenshot_2024-03-23_134416.png b/screenshot_2024-03-23_134416.png new file mode 100644 index 0000000..e633a5a Binary files /dev/null and b/screenshot_2024-03-23_134416.png differ diff --git a/screenshot_2024-03-23_221508.png b/screenshot_2024-03-23_221508.png new file mode 100644 index 0000000..2c382dc Binary files /dev/null and b/screenshot_2024-03-23_221508.png differ diff --git a/screenshot_2024-03-23_221831.png b/screenshot_2024-03-23_221831.png new file mode 100644 index 0000000..02a8a8b Binary files /dev/null and b/screenshot_2024-03-23_221831.png differ diff --git a/screenshot_2024-03-23_222702.png b/screenshot_2024-03-23_222702.png new file mode 100644 index 0000000..8458828 Binary files /dev/null and b/screenshot_2024-03-23_222702.png differ diff --git a/screenshot_2024-03-23_222930.png b/screenshot_2024-03-23_222930.png new file mode 100644 index 0000000..f9891c1 Binary files /dev/null and b/screenshot_2024-03-23_222930.png differ diff --git a/screenshot_2024-03-31_175906.png b/screenshot_2024-03-31_175906.png new file mode 100644 index 0000000..32a1ab0 Binary files /dev/null and b/screenshot_2024-03-31_175906.png differ diff --git a/screenshot_from_2025-04-08_12-04-31.png b/screenshot_from_2025-04-08_12-04-31.png new file mode 100644 index 0000000..119bfad Binary files /dev/null and b/screenshot_from_2025-04-08_12-04-31.png differ