From: Roman Mamedov <rm@romanrm.net>
To: nicolas prochazka <prochazka.nicolas@gmail.com>
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: Wireguard, allowed-ips, ipv6 and multicast
Date: Tue, 19 May 2020 14:22:40 +0500 [thread overview]
Message-ID: <20200519142240.5be610be@natsu> (raw)
In-Reply-To: <CADdae-gBznYaqgYwv9JPeGhMm86s4EZLABc-hKkTdMgUVpL-gA@mail.gmail.com>
On Tue, 19 May 2020 11:09:24 +0200
nicolas prochazka <prochazka.nicolas@gmail.com> wrote:
> Hello,
> I'm trying to use vxlan encapsulated into Wireguard tunnel, with a
> multicast group for announcement.
> Ex :
> ip -6 link add vxlan100 type vxlan id 100 dstport 4789 local
> `wg0Ip6_lock` group ff05::100 dev wg0 ttl 5
>
> All works very well when i set wg tunnel with ::/0 as allowed-ips,
> but if i'm trying to be more restrictive, as ff05::/32 for example,
> it does not work.
> Is a specific interaction between allowed-ips and multicast group in ipv6 ?
AFAIK multicast or broadcast do not work over WG at all. There's no special
handling for it, and no mechanism to duplicate the same packet and send it out
to several peers at once.
For VXLAN you have to rely on adding each peer's MAC and its underlying IP
explicitly via "bridge fdb append". To make it simpler you could use MACs and
IP(v6)s generated from peers' public keys, so there will be no need for any
centralized system of tracking and management for those. Or as I do, just
generate them from hashes of peers' human readable names.
--
With respect,
Roman
prev parent reply other threads:[~2020-05-19 9:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-19 9:09 nicolas prochazka
2020-05-19 9:22 ` Roman Mamedov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200519142240.5be610be@natsu \
--to=rm@romanrm.net \
--cc=prochazka.nicolas@gmail.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).