Development discussion of WireGuard
 help / color / mirror / Atom feed
* MacOS client v1.0.13 multiple tunnel issue
@ 2021-07-06 16:57 Dan West
  0 siblings, 0 replies; only message in thread
From: Dan West @ 2021-07-06 16:57 UTC (permalink / raw)
  To: wireguard

I upgraded my wireguard client from v1.0.12 to v1.0.13 on my MacBook and when I connect using multiple tunnels to different sites, it no longer works correctly.  I am not entirely sure if this is a problem with routing on the client side or if there is a bug preventing additional tunnels from connecting to other sites.  It seems that the first tunnel I connect to will work, but any subsequent tunnels will not.  So for example, if I connect to SiteA and then SiteB, SiteA will work and SiteB will not.  If I connect to SiteB and then SiteA, SiteB will work but SiteA will not.  This is tested by pinging the VPN's gateway address after establishing each connection.  Here is a redacted copy of my tunnel configs:

### Site A Config ###

[Interface]
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
Address = 10.1.1.100/24
DNS = 10.1.1.1, example.com

[Peer]
PublicKey = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy=
AllowedIPs = 10.1.1.0/16, aa.aaa.aaa.aa/25 #Public IP space for Site-A DMZ
Endpoint = site-a.example.com:32123

### Site B Config ###

[Interface]
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
Address = 10.2.1.100/24
DNS = 10.2.1.1, example.com

[Peer]
PublicKey = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy=
AllowedIPs = 10.2.1.0/16, bb.bbb.bbb.bb/25 #Public IP space for Site-B DMZ
Endpoint = site-b.example.com:32123

It is worth noting that this has been tested using both the “On-Demand” function as well as the MacOS built-in Network management tool.  The version history says “Jun 17, 2021 - 1.0.13 - This version includes internal fixes and API changes for newer iOS versions”, so the actual changes are a little opaque. 

I ran a TCPdump on Site-B (or the second site) to see if traffic is even getting to the VPN endpoint and it is not seeing anything.  I also ran a packet capture on the border firewalls and did not see any traffic attempting to hit that location.  The client does not show any handshake activity, so I believe the issue is specifically in the client or maybe how it is trying route the second connection?

A temporary fix is to downgrade back to v1.0.12, but due to limitations of the Apple Appstore, it is only feasible if you happen to have a backup copy of the client.  I just happened to have a backup copy, so I was able to test with both clients.  

Has anyone else ran into this issue or has any suggestions?  I can provide more information on the topology if you think it would be helpful.

Thanks,

Dan

Dan West
Systems Administrator
Galois Inc.
http://corp.galois.com





^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2021-08-08 22:59 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-06 16:57 MacOS client v1.0.13 multiple tunnel issue Dan West

Development discussion of WireGuard

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://inbox.vuxu.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://inbox.vuxu.org/wireguard \
		wireguard@lists.zx2c4.com
	public-inbox-index wireguard

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.vuxu.org/vuxu.archive.wireguard


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git