Development discussion of WireGuard
 help / color / mirror / Atom feed
* Re: Re: Troubleshooting WireGuard connections
@ 2018-04-13  9:23 Riccardo Berto
  2018-04-13 21:54 ` Jason A. Donenfeld
  0 siblings, 1 reply; 18+ messages in thread
From: Riccardo Berto @ 2018-04-13  9:23 UTC (permalink / raw)
  To: wireguard

I wasn't clear in the previous email, I'm only seeing ICMP requests and 
not answers so no traffic through the tunnel.
Also, I have not setup forwarding to another interface, maybe that's the 
next step for a road-warrior OpenVPN-like setup, but at the moment I'm 
keeping things simple and I'm just trying to figure out how to have an 
internal private network only.
As for the ports, the different ports per host is silly but I needed 
that because 3 of my hosts are under the same Wi-Fi and I needed to open 
different ports in the router to forward traffic to the right devices 
easily.

This is the output of the command requested:

rpi3-two pi # tcpdump -ni any icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol 
decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 
262144 bytes
10:35:02.177750 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
1, length 64
10:35:03.232761 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
2, length 64
10:35:04.272760 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
3, length 64
10:35:05.312754 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
4, length 64
10:35:06.352767 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
5, length 64
10:35:07.392772 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
6, length 64
10:35:08.432740 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
7, length 64
10:35:09.472758 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
8, length 64
10:35:10.512756 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
9, length 64
10:35:11.552763 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
10, length 64
10:35:12.592774 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
11, length 64
10:35:13.632778 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
12, length 64
10:35:14.672774 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
13, length 64
10:35:15.712755 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
14, length 64
10:35:16.752756 IP 10.0.0.3 > 10.0.0.1: ICMP echo request, id 25708, seq 
15, length 64
^C
15 packets captured
15 packets received by filter
0 packets dropped by kernel

This was run from a Raspberry Pi. I only have requests to 10.0.0.1 but 
no answer, while on 10.0.0.4 (my laptop) I get:

clevo-W230SD riccardo # tcpdump -ni any icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol 
decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 
262144 bytes
11:17:04.666013 IP 10.0.0.4 > 10.0.0.1: ICMP echo request, id 3840, seq 
1, length 64
11:17:04.785000 IP 10.0.0.1 > 10.0.0.4: ICMP echo reply, id 3840, seq 1, 
length 64
11:17:05.667080 IP 10.0.0.4 > 10.0.0.1: ICMP echo request, id 3840, seq 
2, length 64
11:17:05.808343 IP 10.0.0.1 > 10.0.0.4: ICMP echo reply, id 3840, seq 2, 
length 64
11:17:06.668457 IP 10.0.0.4 > 10.0.0.1: ICMP echo request, id 3840, seq 
3, length 64
11:17:06.832267 IP 10.0.0.1 > 10.0.0.4: ICMP echo reply, id 3840, seq 3, 
length 64
11:17:07.670317 IP 10.0.0.4 > 10.0.0.1: ICMP echo request, id 3840, seq 
4, length 64
11:17:07.820143 IP 10.0.0.1 > 10.0.0.4: ICMP echo reply, id 3840, seq 4, 
length 64

As it should be, I get replies on this host.

I must repeat that "sometimes" also 10.0.0.3 works, so I'd exclude a 
firewall/pubkeys configuration error. Without touching it it breaks, 
though.
Last time it worked I let it ping for hours at a fast pace just to keep 
it working. I then stopped to ping and a certain amount of time later I 
tried again and the wg0 interface wasn't working anymore.

Great WireGuard guide on your blog by the way.

^ permalink raw reply	[flat|nested] 18+ messages in thread
* Troubleshooting WireGuard connections
@ 2018-04-12  9:09 Riccardo Berto
  2018-04-12 20:57 ` Eric Light
  0 siblings, 1 reply; 18+ messages in thread
From: Riccardo Berto @ 2018-04-12  9:09 UTC (permalink / raw)
  To: wireguard

WireGuard doesn't always work with my devices.
I ran out of options for troubleshooting it so I'm writing here, hoping 
for a stable solution. I see it's not a strict devel-only mailing list 
but if I'm off-topic I apologize in advance and I'll fade-out in the 
background, waiting for better times.

Here's my problem: WireGuard "sometimes" works. I have a client that 
always talks with the server without problems (the laptop, 10.0.0.4), it 
always pings and trasfers data correctly. It just works as expected. I 
have 2 others (Raspberry Pis: 10.0.0.2, 10.0.0.3) that don't work most 
of the time. I tried enabling the PersistentKeepalive feature on those 
and the WireGuard interface has some low traffic due to it but no chance 
of pinging or having traffic with them 99 times out of 100. "tcpdump -i 
wg0" shows ping requests, from both sides, but no answers.
In the rare occasions they work, I can ping everyone from every client, 
as expected with my configuration files.

Also, with all the devices I tried both the new systemd-networkd's 
WireGuard implementation and systemd's wg-quick@wg0.service method, as 
well as testing manually with wg-quick. The systemd version is 238.
Archlinux is running on every node and I'm using the latest publicly 
available WireGuard snapshot as of writing this, 20180304.


#####################################
# Server config (VPS on vultr.com): #
#####################################
[Interface]
Address = 10.0.0.1/24
SaveConfig = true
ListenPort = 21
PrivateKey = ------------

[Peer]
PublicKey = ------------
AllowedIPs = 10.0.0.3/32
Endpoint = Client1:51820
PersistentKeepalive = 30

[Peer]
PublicKey = ------------
AllowedIPs = 10.0.0.4/32
Endpoint = Client3:51821

[Peer]
PublicKey = ------------
AllowedIPs = 10.0.0.2/32
Endpoint = Client2:21
PersistentKeepalive = 30


#####################################
# Client 1 config (Raspberry Pi 3): #
#####################################
[Interface]
Address = 10.0.0.3/24
ListenPort = 51820
PrivateKey = ------------

[Peer]
PublicKey = ------------
AllowedIPs = 10.0.0.1/24
Endpoint = VPS:21


#####################################
# Client 2 config (Raspberry Pi 3): #
#####################################
[Interface]
Address = 10.0.0.2/24
PrivateKey = ------------
ListenPort = 21

[Peer]
PublicKey = ------------
AllowedIPs = 10.0.0.1/24
Endpoint = VPS:21


##############################################
# Client 3 config (personal laptop, x86_64): #
##############################################
[Interface]
Address = 10.0.0.4/24
ListenPort = 51821
PrivateKey = ------------

[Peer]
PublicKey = ------------
AllowedIPs = 10.0.0.0/24
Endpoint = VPS:21



Any help is appreciated.

^ permalink raw reply	[flat|nested] 18+ messages in thread
end of thread, other threads:[~2018-04-26  9:51 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-04-13  9:23 Re: Troubleshooting WireGuard connections Riccardo Berto
2018-04-13 21:54 ` Jason A. Donenfeld
     [not found]   ` <33d0fd1f4c60919b98b50e2b9d04fe78@rcrdbrt.com>
2018-04-13 22:36     ` Riccardo Berto
2018-04-14  1:26       ` Jason A. Donenfeld
2018-04-14  7:56         ` Riccardo Berto
2018-04-14 23:19           ` Jason A. Donenfeld
2018-04-20 13:57           ` Riccardo Berto
2018-04-20 19:37             ` Jason A. Donenfeld
2018-04-20 19:39               ` Jason A. Donenfeld
2018-04-20 19:51                 ` Jason A. Donenfeld
2018-04-20 20:31                   ` Riccardo Berto
2018-04-25 11:46                     ` Riccardo Berto
2018-04-25 11:51                       ` Jason A. Donenfeld
2018-04-25 12:40                         ` logcabin
2018-04-25 22:56                         ` Riccardo Berto
2018-04-26  9:52                         ` Riccardo Berto
  -- strict thread matches above, loose matches on Subject: below --
2018-04-12  9:09 Riccardo Berto
2018-04-12 20:57 ` Eric Light

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).