Building an Awesome VPN Server with WireGuard - 2

WireGuard uses public-key-based authentication, which is convenient, but it can be vulnerable to security issues if a key is leaked. To address this, a Web UI integrated with Keycloak SSO was built, designed so that users 'activate' a device themselves and the connection is maintained only for a set period of time.

To efficiently block packets from devices that have not been activated, eBPF technology was introduced. eBPF is sandboxed bytecode that runs safely within the Linux kernel, ensuring system stability through the eBPF Verifier and providing fast performance through JIT compilation.

For packet filtering, tc (traffic control) is used instead of XDP. This is because XDP operates at the stage where packets are still encrypted, making it difficult to identify users, whereas tc can accurately distinguish users based on the Source IP of decrypted packets at the WireGuard interface.

Specifically, the clsact qdisc and the direct-action flag are used so that the eBPF program goes beyond merely classifying packets and directly performs actions such as drop, with the code compiled via LLVM's BPF backend.