Development discussion of WireGuard
 help / color / Atom feed
* Wireguard, allowed-ips, ipv6 and multicast
@ 2020-05-19  9:09 nicolas prochazka
  2020-05-19  9:22 ` Roman Mamedov
  0 siblings, 1 reply; 2+ messages in thread
From: nicolas prochazka @ 2020-05-19  9:09 UTC (permalink / raw)
  To: WireGuard mailing list

Hello,
I'm trying to use vxlan encapsulated into Wireguard tunnel, with a
multicast group for announcement.
Ex :
ip -6 link add vxlan100 type vxlan id 100 dstport 4789  local
`wg0Ip6_lock`  group ff05::100 dev wg0 ttl 5

All works very well when i set wg tunnel with ::/0  as allowed-ips,
but if i'm trying to be more restrictive, as ff05::/32  for example,
it does not work.
Is a specific interaction between allowed-ips and multicast group in ipv6 ?

Regards,
Nicolas Prochazka.

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Wireguard, allowed-ips, ipv6 and multicast
  2020-05-19  9:09 Wireguard, allowed-ips, ipv6 and multicast nicolas prochazka
@ 2020-05-19  9:22 ` Roman Mamedov
  0 siblings, 0 replies; 2+ messages in thread
From: Roman Mamedov @ 2020-05-19  9:22 UTC (permalink / raw)
  To: nicolas prochazka; +Cc: WireGuard mailing list

On Tue, 19 May 2020 11:09:24 +0200
nicolas prochazka <prochazka.nicolas@gmail.com> wrote:

> Hello,
> I'm trying to use vxlan encapsulated into Wireguard tunnel, with a
> multicast group for announcement.
> Ex :
> ip -6 link add vxlan100 type vxlan id 100 dstport 4789  local
> `wg0Ip6_lock`  group ff05::100 dev wg0 ttl 5
> 
> All works very well when i set wg tunnel with ::/0  as allowed-ips,
> but if i'm trying to be more restrictive, as ff05::/32  for example,
> it does not work.
> Is a specific interaction between allowed-ips and multicast group in ipv6 ?

AFAIK multicast or broadcast do not work over WG at all. There's no special
handling for it, and no mechanism to duplicate the same packet and send it out
to several peers at once.

For VXLAN you have to rely on adding each peer's MAC and its underlying IP
explicitly via "bridge fdb append". To make it simpler you could use MACs and
IP(v6)s generated from peers' public keys, so there will be no need for any
centralized system of tracking and management for those. Or as I do, just
generate them from hashes of peers' human readable names.

-- 
With respect,
Roman

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-19  9:09 Wireguard, allowed-ips, ipv6 and multicast nicolas prochazka
2020-05-19  9:22 ` Roman Mamedov

Development discussion of WireGuard

Archives are clonable: git clone --mirror http://inbox.vuxu.org/wireguard

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://inbox.vuxu.org/vuxu.archive.wireguard


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git