From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: jan.delandtsheer@gmail.com Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 1f099124 for ; Thu, 10 Aug 2017 20:38:51 +0000 (UTC) Received: from mail-oi0-f42.google.com (mail-oi0-f42.google.com [209.85.218.42]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 035c1350 for ; Thu, 10 Aug 2017 20:38:51 +0000 (UTC) Received: by mail-oi0-f42.google.com with SMTP id g131so17956279oic.3 for ; Thu, 10 Aug 2017 14:00:59 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Jan De Landtsheer Date: Thu, 10 Aug 2017 21:00:47 +0000 Message-ID: Subject: Re: FR: interface ListenAddress (Aka:Multihomed server issue) To: "Jason A. Donenfeld" Content-Type: multipart/alternative; boundary="001a113bf9e84518b605566c7e33" Cc: WireGuard mailing list , Jan De Landtsheer List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , --001a113bf9e84518b605566c7e33 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable seeing the latest & greatest, this patch will not apply cleanly, so I don't know ... is this train of thought going to be kept for later releases ? On Thu, Aug 10, 2017 at 10:50 PM Jan De Landtsheer < jan.delandtsheer@gmail.com> wrote: > TCP connections work all right, as they=E2=80=99re established sockets, w= here the > kernel does the routing=E2=80=A6 I assumed you would search for the route= yourself > ;-) > rcu_dereference_bh(rt->dst.dev->ip_ptr) indeed does , as the packet > effectively comes in through the uplink. > > In the firewall config I need to specify both interfaces (Uplink and > Public (eth1 and eth0 in the drawing) to filter > > nft add rule ip filter input iif {Uplink,Public} jump public and define > my rules in the public chain > nft add rule ip filter public ip daddr 134.56.78.5 udp dport 443 accept > so a packet coming in on Uplink for the wg gets accepted only if the dst = ip > matches. > > nftables FTW ;-) > > That in se is not very important if you have only one uplink, but if you > have multiple routes (default gw=E2=80=99s) you really need the ip behind= the > uplinks. > > But anyway, tested and confirmed to work now, > > Many thanks for the quick reply > =E2=80=8B > > On Thu, Aug 10, 2017 at 9:46 PM Jason A. Donenfeld > wrote: > >> Hi Jan, >> >> Thanks for the drawing. So the issue is that you want packets to exit >> through eth1 using the addresses of eth0. I believe applying this >> patch should enable that: http://ix.io/z3d Can you apply that and let >> me know if it works? >> >> I'm curious: do TCP connections generally work correctly with your >> configuration? >> >> Jason >> > --001a113bf9e84518b605566c7e33 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
seeing the latest & greatest, this patch will not appl= y cleanly, so I don't know ... is this train of thought going to be kep= t for later releases ?

On Thu, Aug 10, 2017 at 10:50 PM Jan De Landtsheer <jan.delandtsheer@gmail.com> wrote:

TCP connections work all right, as they=E2=80=99re established sockets, = where the kernel does the routing=E2=80=A6 I assumed you would search for t= he route yourself ;-)
rcu_dereference_bh(rt->dst.dev= ->ip_ptr) indeed does , as the packet effectively comes in throug= h the uplink.

In the firewall config I need t= o specify both interfaces (Uplink and Public (eth1 and eth0 in the drawing)= to filter

nft add rule i= p filter input iif {Uplink,Public} jump public and define my rules i= n the public chain
nft add rule ip filter public ip dad= dr 134.56.78.5 udp dport 443 accept so a packet coming in on Uplink = for the wg gets accepted only if the dst ip matches.

nftables FTW ;-)

That in se is not very importan= t if you have only one uplink, but if you have multiple routes (default gw= =E2=80=99s) you really need the ip behind the uplinks.

But anyway, tested and confirmed to work now,= =C2=A0

Many thanks for the q= uick reply

=E2=80=8B

On Thu, Aug 10, 2017 at 9:46 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote= :
Hi Jan,

Thanks for the drawing. So the issue is that you want packets to exit
through eth1 using the addresses of eth0. I believe applying this
patch should enable that: http://ix.io/z3d Can you apply that and let
me know if it works?

I'm curious: do TCP connections generally work correctly with your
configuration?

Jason
--001a113bf9e84518b605566c7e33--