From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: "Toke Høiland-Jørgensen" <toke@toke.dk>
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: Another roaming problem
Date: Thu, 8 Mar 2018 18:39:15 +0100 [thread overview]
Message-ID: <CAHmME9pgOGghWRv9bMtTvbxrQfNycK9EHEnBu=UQxOz6AQJ2qA@mail.gmail.com> (raw)
In-Reply-To: <87h8pqlbw4.fsf@toke.dk>
Hi Toke,
On Thu, Mar 8, 2018 at 6:23 PM, Toke H=C3=B8iland-J=C3=B8rgensen <toke@toke=
.dk> wrote:
>
> I have a gateway device with two interfaces, one public and one private.
> This device performs NAT, and is also the one running wireguard (as the
> 'server'). The client roams. So I have two cases:
>
>
> C (public IP) --- (public IP) GW (private IP) -- [LAN]
>
> In this case, C talks to GW on GWs public IP; everything works fine.
>
> Second case:
>
> [internet] --- (public IP) GW (private IP) -- [LAN] -- C (private IP)
>
> Here, C talks to GW; it still tries to send packets to the public IP of
> GW (because that is what it's configured to do), but because GW sees
> that the source IP is on its internal subnet, it replies with a source
> address in the private subnet. This works fine as long as the client is
> on the LAN; but once it roams outside, it now thinks that the wireguard
> server lives on the private IP of the GW, which is obviously can't reach
> from its shiny new public IP.
>
> So what I'd want to happen is that GW should keep using its public
> IP as the source of the wireguard packets, even when talking to a client
> on a directly-connected internal subnet. Or, alternatively, that C
> should ignore the source address change of the packets coming from GW
> and keep sending its packets to the public IP it was first configured to
> use...
>
In this case, WireGuard is indeed supposed to make the right decision.
Namely, it should continue replying using the correct source address.
It's not supposed to switch to the internal one. I have the exact same
setup at home, so I just tried things out again to verify, and from my
end it seems to be working fine:
zx2c4@thinkpad ~ $ wg
interface: martino
public key: 4HUj8boJyeZI70WVxmKhHfGAohtoyFQpWk96OpuFcVY=3D
private key: (hidden)
listening port: 53249
fwmark: 0xca6c
peer: GMvmorUa9WzHAkOVOxQKSrw3F1JruA4bTN1NkWN0T3E=3D
preshared key: (hidden)
endpoint: 129.228.12.33:10000
allowed ips: 0.0.0.0/0, ::/0
latest handshake: 48 seconds ago
transfer: 1.06 KiB received, 19.50 KiB sent
zx2c4@thinkpad ~ $ ip link set wwan0 down
zx2c4@thinkpad ~ $ ip link set wlan0 up
zx2c4@thinkpad ~ $ pingg
PING google.com (172.217.19.142) 56(84) bytes of data.
64 bytes from mrs08s04-in-f14.1e100.net (172.217.19.142): icmp_seq=3D1
ttl=3D53 time=3D20.1 ms
64 bytes from mrs08s04-in-f14.1e100.net (172.217.19.142): icmp_seq=3D2
ttl=3D53 time=3D19.1 ms
^C
--- google.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev =3D 19.181/19.666/20.151/0.485 ms
zx2c4@thinkpad ~ $ wg
interface: martino
public key: 4HUj8boJyeZI70WVxmKhHfGAohtoyFQpWk96OpuFcVY=3D
private key: (hidden)
listening port: 53249
fwmark: 0xca6c
peer: GMvmorUa9WzHAkOVOxQKSrw3F1JruA4bTN1NkWN0T3E=3D
preshared key: (hidden)
endpoint: 129.228.12.33:10000
allowed ips: 0.0.0.0/0, ::/0
latest handshake: 5 seconds ago
transfer: 113.70 KiB received, 85.43 KiB sent
I wonder what might be different about your configuration...
Jason
next prev parent reply other threads:[~2018-03-08 17:29 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-08 14:29 Toke Høiland-Jørgensen
2018-03-08 14:49 ` Matthias Urlichs
2018-03-08 16:18 ` Jason A. Donenfeld
2018-03-08 16:59 ` Toke Høiland-Jørgensen
2018-03-08 17:02 ` Jason A. Donenfeld
2018-03-08 17:23 ` Toke Høiland-Jørgensen
2018-03-08 17:39 ` Jason A. Donenfeld [this message]
2018-03-08 17:50 ` Toke Høiland-Jørgensen
2018-03-08 18:03 ` Jason A. Donenfeld
2018-03-09 10:08 ` Toke Høiland-Jørgensen
2018-03-09 14:32 ` Toke Høiland-Jørgensen
2018-03-09 14:35 ` Jason A. Donenfeld
2018-03-09 14:42 ` Toke Høiland-Jørgensen
2018-03-09 14:39 ` Toke Høiland-Jørgensen
2018-03-09 14:41 ` Jason A. Donenfeld
2018-03-09 14:46 ` Toke Høiland-Jørgensen
2018-03-09 14:48 ` Jason A. Donenfeld
2018-03-09 14:53 ` Toke Høiland-Jørgensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHmME9pgOGghWRv9bMtTvbxrQfNycK9EHEnBu=UQxOz6AQJ2qA@mail.gmail.com' \
--to=jason@zx2c4.com \
--cc=toke@toke.dk \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).