Development discussion of WireGuard
 help / color / mirror / Atom feed
From: Peter Libassi <peter@libassi.se>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: FreeBSD wireguard wg-quick remote IP address assignment is incorrect
Date: Tue, 25 Feb 2020 07:07:38 +0100	[thread overview]
Message-ID: <94EEC84F-00C1-446A-9AE7-61CACB38CD64@libassi.se> (raw)
In-Reply-To: <CAHmME9oh74nx_eZz19vn=n+U6gF0M6Dtu--EnGw8dVwSnvX9cg@mail.gmail.com>



> 23 feb. 2020 kl. 16:32 skrev Jason A. Donenfeld <Jason@zx2c4.com>:
> 
> On Sun, Feb 23, 2020 at 2:25 PM Peter Libassi <peter@libassi.se> wrote:
>> 
>> Ok, Well even if using another local IP in range 127.0.0.0/8 we can’t be certain we will clash with something else.
>> 
>> How about adding a directive for the remote interface address in wg.conf? Like this:
>> 
>> # cat /usr/local/etc/wireguard/wg0.conf
>> [Interface]
>> PrivateKey = <->
>> ListenPort = 7777
>> Address = 192.168.2.1/32
>> RemoteAddress = 192.168.2.2
>> 
>> [Peer]
>> PublicKey = <->
>> AllowedIPs = 192.168.2.0/24
>> Endpoint = 172.16.0.23:7777
>> 
>> # diff /usr/local/bin/wg-quick.org ./wg-quick
>> 17a18
>>> REMOTE_ADDRESS=""
>> 86a88
>>> RemoteAddress) REMOTEADDRESS="$value"; continue ;;
>> 175c177,181
>> < cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias
>> ---
>>>    if [[ -n $REMOTEADDRESS ]]; then
>>> cmd ifconfig "$INTERFACE" inet "$1" "$REMOTEADDRESS" alias
>>>    else
>>>                cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias
>>>    fi
> 
> This is not a correct fix; we're not going to add a configuration nob
> to work around FreeBSD network stack gotchas.
> 
> Rather, I'd prefer to see all the FreeBSD wg-quick semantics redone
> around multiple routing tables and marks, much like on Linux, though I
> don't know if that's possible. Barring that, a proper solution
> probably involves re-reading the ifconfig man page a few dozen times
> to find out how to have interface addresses as we need them.

It works perfectly for my single site-2-site use case. You have two options as I see it. Either convince the FreeBSD team to drop the dest_address requirement or implement local/remote address awareness per [Peer] in the wg-quick script.

/Peter

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

  reply	other threads:[~2020-02-25  6:07 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-02-23  8:00 Peter Libassi
2020-02-23 11:37 ` Jason A. Donenfeld
2020-02-23 13:25   ` Peter Libassi
2020-02-23 15:32     ` Jason A. Donenfeld
2020-02-25  6:07       ` Peter Libassi [this message]
     [not found] <4c6af2b0-62bc-84bd-f1ec-ce11a152d348@gmail.com>
2020-02-25 13:08 ` Peter Libassi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=94EEC84F-00C1-446A-9AE7-61CACB38CD64@libassi.se \
    --to=peter@libassi.se \
    --cc=Jason@zx2c4.com \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).