From: Vicente Bergas <vicencb@gmail.com>
To: Roman Mamedov <rm@romanrm.net>
Cc: wireguard@lists.zx2c4.com
Subject: Re: lost connection on dynamic IP
Date: Thu, 20 May 2021 00:28:08 +0200 [thread overview]
Message-ID: <CAAMcf8A9isAqhsXLHw1=8A6pyeDeXBPUan6s7_11_tDXJmg-jw@mail.gmail.com> (raw)
In-Reply-To: <20210519234310.66ea294e@natsu>
Hello Roman,
On Wed, May 19, 2021 at 8:43 PM Roman Mamedov <rm@romanrm.net> wrote:
>
> On Tue, 18 May 2021 13:22:31 +0200
> Vicente Bergas <vicencb@gmail.com> wrote:
>
> > A server connected to the Internet through an ISP that provides a
> > dynamic IP with NAT.
>
> If it's NAT, then your server has no dedicated public IP? What do you update
> to DNS, IP of the ISP's NAT pool (shared IP with many other customers)?
There is a public IP assigned to the router. The IP is dynamic, so, it
can change from time to time, but, once assigned, it is exclusive to
the router.
There is no carrier-grade NAT.
I've configured the router to forward the wireguard port to the
server, so, it is like the server is directly connected to the
Internet.
I think the PersistentKeepalive on the server side is not required. Is it?
On the client side, instead, the router has no port forwarded and
also, i think, there is CGNAT. That is the reason PersistentKeepalive
is present.
> > I think the issue happens when the ISP on the server side shuts down
> > the Internet connection for more than 1 hour! Then, it is restored
> > with a new IP.
> > inadyn detects the new IP and updates the DNS.
> > At this point the Internet connection is operational again, but the
> > client remains disconnected until rebooted.
> >
> > Is this scenario expected to work due to the "Built-in Roaming" ?
>
> It might work, helped by PersistentKeepalive, and as long as the server and the
> client don't change their IPs/ports *at the same time*. To protect against
> that, or to improve resiliency in general (and assuming there's actually no NAT
> at the server side after all), your client should resolve the DNS record for
> the server periodically, and in case the IP changed, call "wg set [interface]
> peer [key] endpoint [IP:port]".
So, what do you mean is that wireguard does a single DNS resolution at
the beginning and further DNS resolutions need to be done elsewere. Is
that correct?
> With respect,
> Roman
Regards,
Vicenç.
next prev parent reply other threads:[~2021-05-20 13:49 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-18 11:22 Vicente Bergas
2021-05-19 18:43 ` Roman Mamedov
2021-05-19 22:28 ` Vicente Bergas [this message]
2021-05-20 6:15 ` Roman Mamedov
2021-05-20 16:20 ` Roman Mamedov
2021-05-20 19:23 ` Max Schulze
2021-05-23 11:44 ` Vicente Bergas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAAMcf8A9isAqhsXLHw1=8A6pyeDeXBPUan6s7_11_tDXJmg-jw@mail.gmail.com' \
--to=vicencb@gmail.com \
--cc=rm@romanrm.net \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).