From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Jason@zx2c4.com Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 3fea0cc2 for ; Tue, 2 May 2017 19:35:33 +0000 (UTC) Received: from frisell.zx2c4.com (frisell.zx2c4.com [192.95.5.64]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 20566375 for ; Tue, 2 May 2017 19:35:33 +0000 (UTC) Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 249eca21 for ; Tue, 2 May 2017 19:35:33 +0000 (UTC) Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 3779afd7 (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128:NO) for ; Tue, 2 May 2017 19:35:33 +0000 (UTC) Received: by mail-it0-f48.google.com with SMTP id e65so24906888ita.1 for ; Tue, 02 May 2017 12:45:07 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: References: From: "Jason A. Donenfeld" Date: Tue, 2 May 2017 21:45:05 +0200 Message-ID: Subject: Re: Ability to use one udp port for multiple wg interfaces To: Damian Kaczkowski Content-Type: multipart/alternative; boundary=001a113d3c6ad58122054e8fc6a3 Cc: WireGuard mailing list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , --001a113d3c6ad58122054e8fc6a3 Content-Type: text/plain; charset=UTF-8 On May 2, 2017 19:59, "Damian Kaczkowski" wrote: On 2 May 2017 at 18:32, Jason A. Donenfeld wrote: > > Hello Janson. > > My name is Jason. > Sorry. > > 3. Well if one uses firewall to control flows between zones in > environment > > with mix protocols (eg. gre, ipsec, openvpn and so on) then using second > > tool just to control only wireguard ACLs is not very convenient way from > > administrative point of view. Also in case where peer is roaming and > > changing its source IP (eg. road warrior) then maintaining wireguard ACLs > > will be a huge PITA, if not impossible at large scale. > > No, you are wrong. Allowed-ips controls the IP addresses _within_ the > tunnel. Thus your iptables rules can use "-i wg0 -s 10.0.0.3/32" or > similar to match a _precise_ peer. > Ok. Thanks for a tip. However I still think wireguard looses some flexibility in that way eg. when peer roams from one network to another then its ip address may be unknown. No, wrong. Roaming regards external IP. Allowed IPs regards internal tunnel IPs, which are static. Anyway, it is not only about roaming case so if it is not much of a work and if it is not a security problem then please consider to allow multiple wg interfaces to work on one port. I hope it won't hurt to allow this functionality and I am sure it might come handy for some admins in the wild. Maybe it could be implemented in pair with the idea of refactoring per interface vs per peer private keys? Hope you will consider it at some point. No, you are very mistaken. Please reread the docs on allowed ips keeping in mind that these concern internal tunneled ips and are static. Typing to you on my phone so can't write more now. Best Regards. Damian. --001a113d3c6ad58122054e8fc6a3 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On May 2, 2017 19:5= 9, "Damian Kaczkowski" <damian.kaczkowski@gmail.com> wrote:
On 2 May 2017 at 18:32, Ja= son A. Donenfeld <Jason@zx2c4.com> wrote:
> Hello Janson.

My name is Jason.

Sorry.
=C2= =A0
> 3. Well if one uses firewall to control flows between zones= in environment
> with mix protocols (eg. gre, ipsec, openvpn and so on) then using seco= nd
> tool just to control only wireguard ACLs is not very convenient way fr= om
> administrative point of view. Also in case where peer is roaming and > changing its source IP (eg. road warrior) then maintaining wireguard A= CLs
> will be a huge PITA, if not impossible at large scale.

No, you are wrong. Allowed-ips controls the IP addresses _within_ th= e
tunnel. Thus your iptables rules can use "-i wg0 -s 10.0.0.3/32" or<= br> similar to match a _precise_ peer.

Ok. Thanks for a tip. However I still think wireguard looses some flexibi= lity in that way eg. when peer roams from one network to another then its i= p address may be unknown.


No, wrong. Roaming regards external IP. Allowed IPs regards inter= nal tunnel IPs, which are static.

Anyway, i= t is not only about roaming case so if it is not much of a work and if it i= s not a security problem then please consider to allow multiple wg interfac= es to work on one port. I hope it won't hurt to allow this functionalit= y and I am sure it might come handy for some admins in the wild. Maybe it c= ould be implemented in pair with the idea of refactoring per interface vs p= er peer private keys? Hope you will consider it at some point.

<= div dir=3D"auto">No, you are very mistaken. Please reread the docs on allow= ed ips keeping in mind that these concern internal tunneled ips and are sta= tic. Typing to you on my phone so can't write more now.

Best Regards.
Damian.


--001a113d3c6ad58122054e8fc6a3--