Re: Wireguard address binding - how to fix?

[Stephan von Krawczynski <skraw.ml@ithnet.com>]

Hello Janne,

I know that most people dealing with wg do not really understand how a box
works that has more than one IP and one interface.
A simple question: an interface has 100 IP addresses, how do you choose in wg
on which IP your tunnel end is?
Can you please (all wg infected) understand that about every box that has a
redundancy setup has several IPs per interface and you want wg connect to the
_right_ one, because this is the one taken over in case of failover.
The question is not about interface for routing, the question is about
LISTEN_ADDR.

I always thought it cannot get worse, but then came wg...
--
Regards,
Stephan




On Tue, 21 May 2024 13:11:00 +0200
Janne Johansson <icepic.dz@gmail.com> wrote:

> Den tis 21 maj 2024 kl 09:50 skrev Nico Schottelius
> <nico.schottelius@ungleich.ch>:
> > Hello Jason,
> > do you mind applying the patch from Daniel? Or is there anything wrong
> > with it?
> >
> > Daniel: amazing work, I was not aware that you have already put in the
> > hard work, thank you so very much!
> >
> > The world (*) is suffering because of the lack of IP address binding in
> > wireguard.
> >
> > (*) With world I refer to every engineer that needs to run wireguard in
> > non-trivial situations with multiple IP addresses on one host, which is
> > extremely common for anything that routes.  
> 
> Well, the main reason for wg to NOT do anything special is because
> routing generally is done by looking at the destination ip and then
> using the routing rules which the kernel uses to tell the packet which
> interface is considered "best" in order to reach that ip, which is why
> icmp and udp acts like this. I am certain that many engineers
> hope/think it would be more logical (or fit their designs better) if
> it responded on the same interface as the packet came in or whatever
> but the reason for wg to act like it does is because this is how
> connection-less packets have been acting since ages. The point that
> many engineers design wg endpoints "the wrong way" is probably a fault
> of education when it comes to how TCP/IP stacks did and do manage IP
> output.
> 
> I have zero power to decide anything regarding how wg chooses to
> implement a workaround for IP being designed the way it is designed,
> but I can at least see why it hasn't immediately been accepted even if
> it would make some engineers suffer(*) less, at least in the short
> term.
> 
> There are a lot of workarounds for the times when you did design the
> udp service as if it would act like tcp does in multihomed situations,
> which includes firewall tricks, or VRF/namespace/routing-domains to
> make sure the inner and outer address-pairs for the wg tunnel see
> different views of the network to handle this without changing how wg
> sends packets.
> 
> -- 
> May the most significant bit of your life be positive.