From: Peter Libassi <peter@libassi.se>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: FreeBSD wireguard wg-quick remote IP address assignment is incorrect
Date: Sun, 23 Feb 2020 14:25:48 +0100 [thread overview]
Message-ID: <645AC0E3-6440-4ABF-9589-179F5AEDE00E@libassi.se> (raw)
In-Reply-To: <CAHmME9ozSn+f1s9+q4-L_PA+Q76YY81X8_P2i4jMhYM8Or-17Q@mail.gmail.com>
[-- Attachment #1.1: Type: text/plain, Size: 2207 bytes --]
Ok, Well even if using another local IP in range 127.0.0.0/8 we can’t be certain we will clash with something else.
How about adding a directive for the remote interface address in wg.conf? Like this:
# cat /usr/local/etc/wireguard/wg0.conf
[Interface]
PrivateKey = <->
ListenPort = 7777
Address = 192.168.2.1/32
RemoteAddress = 192.168.2.2
[Peer]
PublicKey = <->
AllowedIPs = 192.168.2.0/24
Endpoint = 172.16.0.23:7777
# diff /usr/local/bin/wg-quick.org ./wg-quick
17a18
> REMOTE_ADDRESS=""
86a88
> RemoteAddress) REMOTEADDRESS="$value"; continue ;;
175c177,181
< cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias
---
> if [[ -n $REMOTEADDRESS ]]; then
> cmd ifconfig "$INTERFACE" inet "$1" "$REMOTEADDRESS" alias
> else
> cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias
> fi
/Peter
> 23 feb. 2020 kl. 12:37 skrev Jason A. Donenfeld <Jason@zx2c4.com>:
>
> We tried this already and it didn't work. See the below commit.
> Perhaps you can update that bug report you filed?
>
> commit 2c6cabd73dfb23990c245250ef2e502bdb33d189
> Author: Jason A. Donenfeld <Jason@zx2c4.com>
> Date: Thu Feb 28 19:03:11 2019 +0100
>
> wg-quick: freebsd: rebreak interface loopback, while fixing localhost
>
> The commit 7c833642 ("wg-quick: freebsd: allow loopback to work") was
> supposed to make things better, but actually it just started sending
> legitimate localhost traffic over the WireGuard interface, which is
> really quite bad.
>
> This reverts commit 7c833642dfa342218602ab18e7091e86408d2982.
>
> Reported-by: Matt Smith <matt.xtaz@gmail.com>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
>
> diff --git a/src/wg-quick/freebsd.bash b/src/wg-quick/freebsd.bash
> index 93f1a3b7..e83dbef0 100755
> --- a/src/wg-quick/freebsd.bash
> +++ b/src/wg-quick/freebsd.bash
> @@ -158,7 +158,7 @@ add_addr() {
> if [[ $1 == *:* ]]; then
> cmd ifconfig "$INTERFACE" inet6 "$1" alias
> else
> - cmd ifconfig "$INTERFACE" inet "$1" 127.0.0.1 alias
> + cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias
> fi
> }
[-- Attachment #1.2: Type: text/html, Size: 8792 bytes --]
[-- Attachment #2: Type: text/plain, Size: 148 bytes --]
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard
next prev parent reply other threads:[~2020-02-23 13:26 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-23 8:00 Peter Libassi
2020-02-23 11:37 ` Jason A. Donenfeld
2020-02-23 13:25 ` Peter Libassi [this message]
2020-02-23 15:32 ` Jason A. Donenfeld
2020-02-25 6:07 ` Peter Libassi
[not found] <4c6af2b0-62bc-84bd-f1ec-ce11a152d348@gmail.com>
2020-02-25 13:08 ` Peter Libassi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=645AC0E3-6440-4ABF-9589-179F5AEDE00E@libassi.se \
--to=peter@libassi.se \
--cc=Jason@zx2c4.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).