Re: Problems with Windows client over PulseSecure VPN

[Peter Whisker <peter.whisker@gmail.com>]

Hi Jason and team

Thank you all for this amazing effort! I upgraded to v0.4 this morning 
and thought I should give it a go.

I set DWORD "ExperimentalKernelDriver = 1" in the registry. My simple 
"normal" tunnel which goes directly and not via PulseSecure works fine. :)

I removed the "PostUp = wg set %WIREGUARD_TUNNEL_NAME% listen-port 0" 
from my configs which go via the PulseSecure tunnel however traffic does 
not flow, the received byte counter remains at zero although the tunnel 
allegedly becomes "Activated" - see the log below.

Regards

Peter

2021-08-03 09:52:13.130462: [TUN] [mini-deb2] Starting WireGuard/0.4 
(Windows 10.0.19042; amd64)
2021-08-03 09:52:13.130462: [TUN] [mini-deb2] Watching network interfaces
2021-08-03 09:52:13.134477: [TUN] [mini-deb2] Resolving DNS names
2021-08-03 09:52:13.144960: [TUN] [mini-deb2] Creating network adapter
2021-08-03 09:52:13.150857: [TUN] [mini-deb2] WireGuardCreateAdapter: 
Creating adapter
2021-08-03 09:52:13.357365: [TUN] [mini-deb2] SelectDriver: Using 
existing driver 0.1
2021-08-03 09:52:13.986764: [TUN] [mini-deb2] Using WireGuardNT/0.1
2021-08-03 09:52:13.990466: [TUN] [mini-deb2] Enabling firewall rules
2021-08-03 09:52:13.990984: [TUN] [mini-deb2] Interface created
2021-08-03 09:52:13.994159: [TUN] [mini-deb2] Dropping privileges
2021-08-03 09:52:13.995190: [TUN] [mini-deb2] Peer 1 created
2021-08-03 09:52:13.997778: [TUN] [mini-deb2] Monitoring MTU of default 
v4 routes
2021-08-03 09:52:13.998285: [TUN] [mini-deb2] Sending keepalive packet 
to peer 1 (158.234.90.60:51820)
2021-08-03 09:52:13.998285: [TUN] [mini-deb2] Sending handshake 
initiation to peer 1 (158.234.90.60:51820)
2021-08-03 09:52:13.998285: [TUN] [mini-deb2] Interface up
2021-08-03 09:52:14.009369: [TUN] [mini-deb2] Setting device v4 addresses
2021-08-03 09:52:14.012575: [TUN] [mini-deb2] Monitoring MTU of default 
v6 routes
2021-08-03 09:52:14.012575: [TUN] [mini-deb2] Setting device v6 addresses
2021-08-03 09:52:14.017056: [TUN] [mini-deb2] Startup complete
2021-08-03 09:52:19.001078: [TUN] [mini-deb2] Sending handshake 
initiation to peer 1 (158.234.90.60:51820)
2021-08-03 09:52:24.162600: [TUN] [mini-deb2] Handshake for peer 1 
(158.234.90.60:51820) did not complete after 5 seconds, retrying (try 2)
2021-08-03 09:52:24.162600: [TUN] [mini-deb2] Sending handshake 
initiation to peer 1 (158.234.90.60:51820)
2021-08-03 09:52:29.276205: [TUN] [mini-deb2] Handshake for peer 1 
(158.234.90.60:51820) did not complete after 5 seconds, retrying (try 2)
2021-08-03 09:52:29.276205: [TUN] [mini-deb2] Sending handshake 
initiation to peer 1 (158.234.90.60:51820)
2021-08-03 09:52:34.380120: [TUN] [mini-deb2] Handshake for peer 1 
(158.234.90.60:51820) did not complete after 5 seconds, retrying (try 3)
2021-08-03 09:52:34.380120: [TUN] [mini-deb2] Sending handshake 
initiation to peer 1 (158.234.90.60:51820)
2021-08-03 09:52:39.412842: [TUN] [mini-deb2] Handshake for peer 1 
(158.234.90.60:51820) did not complete after 5 seconds, retrying (try 4)
2021-08-03 09:52:39.412842: [TUN] [mini-deb2] Sending handshake 
initiation to peer 1 (158.234.90.60:51820)
2021-08-03 09:52:44.441204: [TUN] [mini-deb2] Handshake for peer 1 
(158.234.90.60:51820) did not complete after 5 seconds, retrying (try 5)
2021-08-03 09:52:44.443407: [TUN] [mini-deb2] Sending handshake 
initiation to peer 1 (158.234.90.60:51820)
2021-08-03 09:52:49.471250: [TUN] [mini-deb2] Handshake for peer 1 
(158.234.90.60:51820) did not complete after 5 seconds, retrying (try 6)
2021-08-03 09:52:49.471250: [TUN] [mini-deb2] Sending handshake 
initiation to peer 1 (158.234.90.60:51820)



On 29/07/2021 12:00, Jason A. Donenfeld wrote:
> Hi Peter, Heiko, Christopher, and others,
>
> An update on:
>
>> I had a strange idea for how to fix this without requiring
>> recompilation or removal of that code.
>>
>> 1) Enable DangerousScriptExecution:
>> https://git.zx2c4.com/wireguard-windows/about/docs/adminregistry.md#hklmsoftwarewireguarddangerousscriptexecution
>>
>> 2) Add a PostUp line to your [Interface] section:
>>
>> PostUp = wg set %WIREGUARD_TUNNEL_NAME% listen-port 0
> I just wanted to let you know that this problem has been entirely
> fixed (I think?) in the "WireGuardNT" kernel driver project I've been
> working on (and haven't yet announced aside from development
> screenshots on Twitter), and therefore the above steps will no longer
> be necessary. When that ships as part of the v0.4 series of the normal
> wireguard-windows client, you won't need the "listen-port 0" hack
> anymore, as the kernel driver uses a more clever trick than the one
> used by wireguard-go. So please do watch this mailing list in the next
> few weeks for an announcement of that project, as I'll be very
> interested in some real world tests and confirmation of the fix.
>
> Thanks,
> Jason