Geofferey Eakins Geofferey

Certainly! Here’s how the provided iptables rules can be incorporated into the previous explanation, ensuring clarity on their context and usage within the configuration for managing WireGuard connectivity for roaming dynamic peers.

Managing WireGuard Connectivity for Roaming Dynamic Peers

Scenario Overview:

In a WireGuard setup, a static endpoint (e.g., a firewall or server) has a fixed public IP address and an internal IP address (e.g., 203.0.113.10). A dynamic peer (client) connects to this static endpoint and may roam between internal networks (like a LAN) and external networks (such as mobile or public Wi-Fi). When on the same LAN, the dynamic peer learns the static endpoint's internal IP and begins communicating with it using this address. However, once the dynamic peer leaves the LAN, it can no longer reach the static peer’s internal IP, leading to connection issues. This situation necessitates strategies to ensure the dynamic peer can consistently connect to the static endpoi

	$host.ui.RawUI.WindowTitle = "NTAUTHORITY\SYSTEM - Tailscale Debugging"
	$ErrorActionPreference = "Continue"
	$host.ui.RawUI.BackgroundColor = "Black"
	$host.ui.RawUI.ForegroundColor = "Red"

	$RootPath = $PWD.Path

	cd ".\"

	$UserName = (whoami)

	## I am a custom Script for logging TailScale in on boot using tsPreAuthKey attribute stored in AD Schema
	# This requires permanent modification to the schema for storing the PreAuthKey:
	# https://www.rebeladmin.com/step-step-guide-create-custom-active-directory-attributes/
	# https://legacy.support.exclaimer.com/hc/en-gb/articles/360028648572-How-to-create-new-custom-AD-attributes-for-use-in-a-signature-template
	# Do NOT issue re-useable PreAuthTokens and store in AD, that would be foolish, storing them period might be ;))
	# Execute me as a Computer policy based powershell startup script
	# Schduled task is also an option, may not work on first run
	#

	$env:Path = 'C:\Program Files\Tailscale;' + $env:Path

	## I am a custom Script for logging TailScale in on boot using tsPreAuthKey attribute stored in AD Schema
	# Now I double as an executable via ps12exe that gets installed via an inno setup wizard
	# This requires permanent modification to the schema for storing the PreAuthKey:
	# https://www.rebeladmin.com/step-step-guide-create-custom-active-directory-attributes/
	# https://legacy.support.exclaimer.com/hc/en-gb/articles/360028648572-How-to-create-new-custom-AD-attributes-for-use-in-a-signature-template
	# Do NOT issue re-useable PreAuthTokens and store in AD, that would be foolish, storing them period might be ;))
	# Execute me as a Computer policy based powershell startup script
	# Schduled task is also an option, may not work on first run
	#
	$ErrorActionPreference = "SilentlyContinue"

	@echo off

	REM Tailscale setup script by Progent Engineer:
	REM Geofferey Eakins

	SET tsversion = 1.78.1

	echo TailScale Pre-Authentication Deployment Script
	echo.
	echo Developed By:

	## Gets Computer Attributes from Active Directory without RSAT
	# https://www.reddit.com/r/PowerShell/s/Kani1GV3lD
	# Converted to .exe using ps12exe for use outside powershell

	$ErrorActionPreference = "SilentlyContinue"

	function Get-Attributes ($arg1) {

	$searcher = New-Object system.directoryservices.directorysearcher
	$searcher.PropertiesToLoad.AddRange(@($arg1))

	#!/bin/bash

	## Put me in your PATH to quickly change headscale node IPs
	## Written by:
	### Engineer: Geofferey

	TESTED_VER="v0.23.0"
	TS_CIDR="100.64.0.0/10"

	if [ -z ${HEADSCALE_DB} ]; then

	<html dir="ltr" xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" gpmc_reportInitialized="false">
	<head>
	<meta http-equiv="X-UA-Compatible" content="IE=edge" />
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-16" />
	<title>TailScale Login</title>
	<!-- Styles -->
	<style type="text/css">
	body { background-color:#FFFFFF; border:1px solid #666666; color:#000000; font-size:68%; font-family:MS Shell Dlg; margin:0,0,10px,0; word-break:normal; word-wrap:break-word; }

	table { font-size:100%; table-layout:fixed; width:100%; }

	state.Dummy {
	control.1 {
	iface MIXER
	name 'Master Volume'
	value.0 0
	value.1 0
	comment {
	access 'read write'
	type INTEGER
	count 2

	# /etc/acpi/events/lidconf
	# run a script on lid open/close events
	event=button/lid
	action=/etc/acpi/actions/acpi-lid-switch.sh "%e"