Development discussion of WireGuard
 help / color / mirror / Atom feed
* Feature request: tag incoming packets
       [not found] <mailman.0.1612101211.63283.wireguard@lists.zx2c4.com>
@ 2021-01-31 14:07 ` Matthias Urlichs
  2021-02-20 14:33   ` Jason A. Donenfeld
  0 siblings, 1 reply; 2+ messages in thread
From: Matthias Urlichs @ 2021-01-31 14:07 UTC (permalink / raw)
  To: wireguard

[-- Attachment #1: Type: text/plain, Size: 1152 bytes --]

Hello,

the problem: given a wireguard interface with many peers, all with
different network addresses and whatnot. I want to do ingress traffic
accounting and some special filtering.

Adding an incoming filter that re-classifies all incoming packets to its
customer account seems like a lot of superfluous work, and the whole
thing seems somewhat fragile.

It'd be way nicer if wireguard had a per-peer netfilter tag which it
would simply set on all incoming packets from that peer. Examining that
in my netfilter tables would then cause no superfluous CPU load, and
updates to peer status would be atomic and not risk colliding with other
processes' update of nftables.

--
-- Matthias Urlichs


--
Matthias Urlichs
Executive Principal Solution Architect (Linux)

noris network AG
Thomas-Mann-Straße 16-20
90471 Nürnberg
Deutschland

Tel +49 911 9352 1717
Fax +49 911 9352 100
Email matthias.urlichs@noris.de

noris network AG - Mehr Leistung als Standard
Vorstand: Ingo Kraupa (Vorsitzender), Joachim Astel, Stefan Keller, Florian Sippel
Vorsitzender des Aufsichtsrats: Stefan Schnabel - AG Nürnberg HRB 17689

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 2816 bytes --]

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: Feature request: tag incoming packets
  2021-01-31 14:07 ` Feature request: tag incoming packets Matthias Urlichs
@ 2021-02-20 14:33   ` Jason A. Donenfeld
  0 siblings, 0 replies; 2+ messages in thread
From: Jason A. Donenfeld @ 2021-02-20 14:33 UTC (permalink / raw)
  To: Matthias Urlichs; +Cc: wireguard

There is no need for this and WireGuard was designed to avoid needing
something like this. The AllowedIPs binding gives you a mapping
between source IP and peer public key.

So, if you have on wg0:

PublicKey = ABCD
AllowedIPs = 192.168.33.99/32

Then you can safely have a netfilter rule that says:

iptables -A INPUT -i wg0 -s 192.168.33.99/32 -j ACCEPT

You only need to match two things: the wireguard interface and the
source IP. The strong binding to the public key is the primary
security property that WireGuard gives you via cryptokey routing.

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-02-20 14:37 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <mailman.0.1612101211.63283.wireguard@lists.zx2c4.com>
2021-01-31 14:07 ` Feature request: tag incoming packets Matthias Urlichs
2021-02-20 14:33   ` Jason A. Donenfeld

Development discussion of WireGuard

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://inbox.vuxu.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ http://inbox.vuxu.org/wireguard \
		wireguard@lists.zx2c4.com
	public-inbox-index wireguard

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.vuxu.org/vuxu.archive.wireguard


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git