Development discussion of WireGuard
 help / color / mirror / Atom feed
From: David Anderson <dave@natulte.net>
To: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: FYI: systemd's networkd (v242) incorrectly setting listen-port on wg interface
Date: Mon, 2 Sep 2019 12:26:10 -0700	[thread overview]
Message-ID: <CAMx+r7VomZWjyJHRzESRWvXhS54+AkQ4G9yHd+hzWDAPxbJPCA@mail.gmail.com> (raw)

Posting here for posterity, in case someone else encounters this problem.

In systemd v242, networkd has a bug
(https://github.com/systemd/systemd/issues/12377), in which it ignores
the `ListenPort` directive in its config files for wireguard
interfaces. The results is that even if you specify ListenPort=51820,
when you restart networkd it'll assign a random listening port to the
wg interface.

This can lead to some frustrating debugging where your VPN
mysteriously doesn't come up, and it turns out to be because your
wireguard server is listening on entirely the wrong port. You fix it
with `wg set wg0 listen-port 51820` after networkd has started.

Because of systemd's "no patch releases" release cycle, this seems to
have been broken since 11 Apr for any distro using an unmodified v242
systemd. I discovered this on Debian Buster (the newest "stable").
Looks like the fix was pulled into at least NixOS and Gentoo, not sure
about other distros. v243 has the fix, and should be releasing Any
Time Now.

I'm going to file a Debian bug to request a backport of this patch,
since I'm guessing they're not going to be upgrading systemd routinely
on the stable track. Hopefully it won't bite too many people though,
since networkd isn't the default for network configuration on Buster
(I'm just an enthusiastic early adopter).

- Dave
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

             reply	other threads:[~2019-09-02 19:26 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-02 19:26 David Anderson [this message]
2019-09-02 19:42 ` David Anderson
2019-09-02 22:41   ` Georg Faerber
2019-09-02 22:46     ` David Anderson
2019-09-02 22:51       ` Georg Faerber
2019-09-02 23:25   ` David Anderson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAMx+r7VomZWjyJHRzESRWvXhS54+AkQ4G9yHd+hzWDAPxbJPCA@mail.gmail.com \
    --to=dave@natulte.net \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).