From: Peter Whisker <peter.whisker@gmail.com>
To: wireguard@lists.zx2c4.com
Subject: Re: Fwd: Problems with Windows client over PulseSecure VPN
Date: Tue, 19 Jan 2021 10:39:55 +0000 [thread overview]
Message-ID: <1a18b8f5-3c98-24c5-a0ce-90515a8528ae@gmail.com> (raw)
In-Reply-To: <CAN5wt5ojzay9uEjubrrivd6vZqOGNJ40M25ELzOYTK42zozijQ@mail.gmail.com>
Hi
I built Wireguard with the change you made below and confirm it fixes
the longstanding problem I had - I can now connect to a peer over the
PulseSecure tunnel and even simultaneously connect to another peer over
the default route (with the MultipleSimultaneousTunnels=1 registry entry).
Is there a reason this fix can not be adopted?
Peter
On 15/01/2021 10:32, Christopher Ng wrote:
> ---------- Forwarded message ---------
> From: Christopher Ng <facboy@gmail.com>
> Date: Fri, 15 Jan 2021 at 09:46
> Subject: Re: Problems with Windows client over PulseSecure VPN
> To: Peter Whisker <peter.whisker@gmail.com>
>
>
> i fixed this in my local build by disabling the binding in
> defaultroutemonitor.go. tbh i'm not sure what it's for, i found an
> old discussion (about linux) about not binding to only one interface,
> so i'm not sure why Windows binds to one interface.
>
> diff --git a/tunnel/defaultroutemonitor.go b/tunnel/defaultroutemonitor.go
> index 6ee95129..12456332 100644
> --- a/tunnel/defaultroutemonitor.go
> +++ b/tunnel/defaultroutemonitor.go
> @@ -6,12 +6,10 @@
> package tunnel
>
> import (
> - "log"
> "sync"
> "time"
>
> "golang.org/x/sys/windows"
> - "golang.zx2c4.com/wireguard/conn"
> "golang.zx2c4.com/wireguard/device"
> "golang.zx2c4.com/wireguard/tun"
> "golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
> @@ -50,18 +48,22 @@ func bindSocketRoute(family
> winipcfg.AddressFamily, device *device.Device, ourLU
> }
> *lastLUID = luid
> *lastIndex = index
> - blackhole := blackholeWhenLoop && index == 0
> - bind, _ := device.Bind().(conn.BindSocketToInterface)
> - if bind == nil {
> - return nil
> - }
> - if family == windows.AF_INET {
> - log.Printf("Binding v4 socket to interface %d
> (blackhole=%v)", index, blackhole)
> - return bind.BindSocketToInterface4(index, blackhole)
> - } else if family == windows.AF_INET6 {
> - log.Printf("Binding v6 socket to interface %d
> (blackhole=%v)", index, blackhole)
> - return bind.BindSocketToInterface6(index, blackhole)
> - }
> + // disable this because if my peers are on different
> interfaces...well i don't know how it can work. i can't
> + // bind the socket to only one of them
> + /*
> + blackhole := blackholeWhenLoop && index == 0
> + bind, _ := device.Bind().(conn.BindSocketToInterface)
> + if bind == nil {
> + return nil
> + }
> + if family == windows.AF_INET {
> + log.Printf("Binding v4 socket to interface %d
> (blackhole=%v)", index, blackhole)
> + return bind.BindSocketToInterface4(index, blackhole)
> + } else if family == windows.AF_INET6 {
> + log.Printf("Binding v6 socket to interface %d
> (blackhole=%v)", index, blackhole)
> + return bind.BindSocketToInterface6(index, blackhole)
> + }
> + */
> return nil
> }
>
> On Wed, 13 Jan 2021 at 17:06, Peter Whisker <peter.whisker@gmail.com> wrote:
>> Hi
>>
>> I have managed to work around the issue caused by Wireguard sending
>> packets via default route interface even though the route to the peer is
>> over a different interface (the issue caused by IP_UNICAST_IF). My
>> Wireguard peer is down a corporate Pulse Secure tunnel.
>>
>> I use a PreUp and PostDown script as follows:
>>
>> PreUp
>> =====
>>
>> for /f "tokens=3" %%a in ('route print -4 0.0.0.0^| find "0.0.0.0"') do
>> if not defined ip set ip=%%a
>> route add 0.0.0.0 mask 128.0.0.0 %ip% METRIC 1
>> route add 128.0.0.0 mask 128.0.0.0 %ip% METRIC 1
>> route delete 0.0.0.0 mask 0.0.0.0
>>
>> PostDown
>> ========
>>
>> for /f "tokens=3" %%a in ('route print -4 0.0.0.0^| find "0.0.0.0"') do
>> if not defined ip set ip=%%a
>> route add 0.0.0.0 mask 0.0.0.0 %ip% METRIC 1
>> route delete 0.0.0.0 mask 128.0.0.0
>> route delete 128.0.0.0 mask 128.0.0.0
>>
>> This replaces the /0 default route by two /1 routes before bringing up
>> the WireGuard interface. Traffic to the peer then gets sent down the
>> correct route (why is this different from having a default route?). When
>> the WireGuard instance is closed, it recreates the default route and
>> removes the two /1 routes.
>>
>> Is there a way this could be done better in the Wireguard executable (I
>> am currently using 0.3.4).
>>
>> Thanks
>>
>> Peter
>>
>> On 26/11/2020 13:11, Jason A. Donenfeld wrote:
>>>> Is PulseSecure not setting up a /0 route? If so, then this is a known
>>>> issue with the lack of policy routing on Windows.
next prev parent reply other threads:[~2021-01-24 16:30 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-27 13:35 Problems with Windows client Peter Whisker
2020-08-27 19:20 ` Jason A. Donenfeld
2020-09-01 8:30 ` Peter Whisker
2020-09-03 13:35 ` Simon Rozman
2020-09-21 10:39 ` Peter Whisker
2020-11-24 10:17 ` Peter Whisker
2020-11-26 13:04 ` Problems with Windows client over PulseSecure VPN Peter Whisker
2020-11-26 13:11 ` Jason A. Donenfeld
[not found] ` <2dc629e2-93c9-4ed9-ea57-4318c8b62a73@gmail.com>
2021-01-13 15:13 ` Peter Whisker
[not found] ` <CAN5wt5r9rQpYcCkshBimOARoAxx7T529oUw6RSNnr4q3_y_31g@mail.gmail.com>
2021-01-15 10:32 ` Fwd: " Christopher Ng
2021-01-19 8:53 ` Peter Whisker
2021-01-30 10:51 ` Christopher Ng
2021-01-19 10:39 ` Peter Whisker [this message]
2021-03-02 21:32 ` Steffen Sledz
2021-03-03 10:54 ` Jason A. Donenfeld
2021-03-03 12:01 ` Heiko Kendziorra
2021-03-04 9:11 ` Peter Whisker
2021-03-04 13:07 ` Jason A. Donenfeld
2021-03-23 11:01 ` Christopher Ng
2021-04-14 9:40 ` Christopher Ng
2021-04-14 20:19 ` Jason A. Donenfeld
2021-04-14 21:17 ` Christopher Ng
2021-07-29 11:00 ` Jason A. Donenfeld
2021-07-30 7:28 ` Peter Whisker
2021-07-30 15:57 ` Jason A. Donenfeld
2021-08-03 8:57 ` Peter Whisker
2021-08-03 10:57 ` Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1a18b8f5-3c98-24c5-a0ce-90515a8528ae@gmail.com \
--to=peter.whisker@gmail.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).