From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: Peter Dolding <oiaohm@gmail.com>
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: Built-in Roaming is limited due to a design fault adding STUN and TURN support would be good and make wire-guard connections more durable.
Date: Mon, 2 Jan 2017 15:18:24 +0100 [thread overview]
Message-ID: <CAHmME9qS7ptMcCuvxcobi12hgfYdd4yYcOW5+D_uL6uOGq2f2A@mail.gmail.com> (raw)
In-Reply-To: <CANA3KFU0THGCkVhCsEC4CMfoj394XetYZ_TebyFGTwYiDZ9cBg@mail.gmail.com>
Hi Peter,
That's a pretty bombastic and rambling way to put a simple point. I
believe you're conflating two different things. Let's break it down:
1. Dynamic IPs.
2. Both peers behind NAT.
With regard to dynamic IPs, the solution is to use a dynamic DNS
service, and simply use the DNS name as the endpoint. When you set up
the device after being disconnected, userspace will do the DNS lookup
to determine a current IP. When you're already connected to that IP,
WireGuard's roaming capabilities will automatically keep track of IP
updates.
With regard to NAT, this is where you want your STUN-like solution.
However, this does _not_ belong inside of WireGuard. This is where you
simply need some basic userspace utility to handle punching holes in
NAT/firewall, and then bringing up the WireGuard interface with the
discovered address/port. It's not that complicated. In fact, there was
already a substantial discussion about this on the list (did you check
the archives?), and I wound up writing a simple PoC utility for it:
https://git.zx2c4.com/WireGuard/tree/contrib/examples/nat-hole-punching/README
It works well, though it of course needs work before it's
production-ready. Perhaps you could rewrite it to use your glib-based
libnice? Send an email here when you've got a github repo for
something like this, as I'm sure a few others on the list might
benefit from it too.
Jason
next prev parent reply other threads:[~2017-01-02 14:09 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-02 6:10 Peter Dolding
2017-01-02 14:18 ` Jason A. Donenfeld [this message]
2017-01-05 11:08 ` Peter Dolding
2017-01-05 20:33 ` Jason A. Donenfeld
2017-01-09 13:43 ` Peter Dolding
2017-01-15 8:39 ` Dan Lüdtke
2017-01-15 10:55 ` Jason A. Donenfeld
2017-01-18 5:55 ` Peter Dolding
2017-01-18 6:11 ` Dan Lüdtke
2017-01-18 11:21 ` Peter Dolding
2017-01-18 12:07 ` Dan Lüdtke
2017-01-21 21:51 ` Peter Dolding
2017-01-22 23:29 ` Jason A. Donenfeld
2017-01-15 10:40 ` Jason A. Donenfeld
2017-01-18 7:38 ` Peter Dolding
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHmME9qS7ptMcCuvxcobi12hgfYdd4yYcOW5+D_uL6uOGq2f2A@mail.gmail.com \
--to=jason@zx2c4.com \
--cc=oiaohm@gmail.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).