Development discussion of WireGuard
 help / color / mirror / Atom feed
* Why is the src_valid_mark needed and not allowed (in kubernetes)?
@ 2022-05-05 20:01 Nico Schottelius
  0 siblings, 0 replies; only message in thread
From: Nico Schottelius @ 2022-05-05 20:01 UTC (permalink / raw)
  To: wireguard

Hello again,

while debugging wireguard in Kubernetes, we noticed that adding a
default route for IPv4 is not possible/allowed, wg-quick fails with:

        sysctl: error setting key 'net.ipv4.conf.all.src_valid_mark': Read-only file system

Which can be traced back to:

        [[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1

inside the

       add_default() {

function of wg-quick. If one tries to escape this using a pod
specification to set the sysctl using

           - name: net.ipv4.conf.all.src_valid_mark
             value: "1"

Kubernetes by default disallows it and returns a "SysctlForbidden"

Now, one can easily "fool" wg-quick using

    AllowedIPs =,

instead of

    AllowedIPs =

which makes the container work w/o the sysctl, as the add_default()
function is not called. Running it like this in kubernetes results in:

+ wg show
interface: ipv4
  public key: HV9IgFLPSHJgG4jbDzaJg97Uch3eebrV5we4wUkAcUg=
  private key: (hidden)
  listening port: 51828

peer: 6BRnQ+dmeFzVCH9RbM1pbJ7u3y3qrl+zUzzYCmC88kE=
  endpoint: [2a0a:e5c0:2:2:0:84ff:fe41:f265]:51820
  allowed ips:,

And allows outside IPv4 communication within an IPv6 only kubernetes
cluster, which was the objective in the first place.

My questions:

   - Why is net.ipv4.conf.all.src_valid_mark needed?
   - And why does working around using, works /
     what is the drawback of this?

Best regards and a good evening from container land,


Sustainable and modern Infrastructures by

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2022-05-05 20:20 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-05 20:01 Why is the src_valid_mark needed and not allowed (in kubernetes)? Nico Schottelius

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).