Development discussion of WireGuard
 help / color / mirror / Atom feed
From: Chris Francy <zoredache@gmail.com>
To: wireguard@lists.zx2c4.com
Subject: Windows tunnel configured as only IPv6 gets an IPv4 APIPA address
Date: Mon, 20 Dec 2021 23:51:55 -0800	[thread overview]
Message-ID: <CAM8ZctXygkOUvzEpROjcfZeFC69epbc8ef=k5OF949XB6S1-BQ@mail.gmail.com> (raw)

I really wish that the IPv4 binding would be completely disabled when an
interface has no IPv4 addresses.

Consider a simple configuration like this

    # wg_zoredache.conf
    [Interface]
    PrivateKey = ...
    Address = 2001:db8:0:0:24ae:ebff:fef0:97e6/128

When that tunnel is started on Windows you will get an 169.254.0.0/16
address. But I didn't really expect or want that.

I am sure some will tell me this doesn't really hurt much since a person
configuring an IPv6 only tunnel, would not have AllowedIPs set that would
allow this address to actually communicate with anything, so the tunnel
will not accept or transmit these packets. But it is still kinda annoying,
since having that IPv4 address will result in IPv4 broadcast traffic
happening on the interface. I noticed this when I was trying to do a
wireshark capture for something else, and was surprised how much IPv4
broadcasts I was seeing on an interface that I intended to be IPv6 only.

So next I am sure people will suggest adding a `PreUp' or 'PostUp` command
that runs a powershell command to disable the interface. I know with
powershell you can disable the IPv4 binding with a command like
`Disable-NetAdapterBinding -ifAlias wg_zoredache -ComponentID ms_tcpip`.
But PreUp/Postup is blocked by default on Windows. Also some security
software on block Powershell executing as a form of anti-malware
protection. Also, simply running the command once isn't useful, since the
Interface seems to get recreated each time the tunnel or computer restarts.

I have more output of what I currently get, and what I am hoping for
in this gist.

- https://gist.github.com/zoredache/995bb5bea01f6fd8dced0fda708c97c8

Anyway, I am just posting this as a bit of a wishlist request. Please
consider adjusting the client to disable the IPv4 binding on the interface
it creates if no IPv4 addresses are in the tunnel configuration. Or perhaps
provide some other method to have a true IPv6 only wireguard interface on
Windows.

Thanks,

Zoredache

                 reply	other threads:[~2022-01-04 18:24 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAM8ZctXygkOUvzEpROjcfZeFC69epbc8ef=k5OF949XB6S1-BQ@mail.gmail.com' \
    --to=zoredache@gmail.com \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).