From: Adam Cooper <adam@acpr.dev>
To: "Hasan Berkay Çağır" <berkay@cagir.me>
Cc: wireguard@lists.zx2c4.com
Subject: Re: MacOS IPv6 not functioning without custom static route
Date: Tue, 21 Jul 2020 14:50:27 +0100 [thread overview]
Message-ID: <CAN00TTrd4qMEVJd0nhQKoGr8E4UQC74sxyUGbAkFQpFeHkga7A@mail.gmail.com> (raw)
In-Reply-To: <CAN00TTpNmGNuZcHc4aSRHaG26BmqbsdVLL4hYuArk+9RX3oVSQ@mail.gmail.com>
As an additional datapoint it looks like if I remove '::/0' at all
(either replaced with the ::/1 8000:/1 rules or just removed outright)
I appear to lose outbound traffic UNLESS I'm allowing 0.0.0.0/0. Which
doesn't make much sense as one is an IPv4 rule and the other isn't.
This is what it currently look like (pseudocode for brevity)
$IPV4_IPS = 0.0.0.0/5, 8.0.0.0/7, 11.0.0.0/8, 12.0.0.0/6, 16.0.0.0/4,
32.0.0.0/3, 64.0.0.0/2, 128.0.0.0/3, 160.0.0.0/5, 168.0.0.0/6,
172.0.0.0/12, 172.32.0.0/11, 172.64.0.0/10, 172.128.0.0/9,
173.0.0.0/8, 174.0.0.0/7, 176.0.0.0/4, 192.0.0.0/9, 192.128.0.0/11,
192.160.0.0/13, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14,
192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6,
200.0.0.0/5, 208.0.0.0/4
AllowedIPs = $IPV4_IPS, ::/0, fd82:88::1/128 -- IPv4 WORKS, IPv6 ONLY
ROUTES fd82:88::1
AllowedIPs = $IPV4_IPS, fd82:88::1/128 -- IPv4 AND IPv6 DO NOT WORK
AllowedIPs = $IPV4_IPS, ::/1, 8000::/1, fd82:88::1/128 -- IPv4 AND
IPv6 DO NOT WORK
AllowedIPs = 0.0.0.0/0, ::/1, 8000::/1 -- IPv4 AND IPv6 WORK
On Tue, 21 Jul 2020 at 14:29, Adam Cooper <adam@acpr.dev> wrote:
>
> Mmm. It looks like unticking "Exclude Private IPs" and entering
> "0.0.0.0/0, ::/1, 8000::/1" gives me a functional setup. Trouble is I
> don't want to route the private IPs and ticking the box (whilst
> retaining '::/1, 8000::/1') allows no traffic at all. There's
> something odd about the way the client is configuring routes but I've
> not got the expertise to figure it out :(
>
> On Tue, 21 Jul 2020 at 14:12, Hasan Berkay Çağır <berkay@cagir.me> wrote:
> >
> > On 15/07/2020 14:14, Adam Cooper wrote:
> > > ...
> > > Probably worth mentioning that I tried to replace ::/0 with ::/1,
> > > 8000::/1 but that just results in completely broken connectivity in
> > > IPv6 and IPv4 - which may be another issue in and of itself.
> >
> > Did you try only having "::/1, 8000::/1" in the AllowedIPs option? I had
> > a default route creation issue myself where I'm only trying to tunnel
> > IPv6 through; and having this actually solved it.
> >
> > $ netstat -nr
> > Routing tables
> > Internet:
> > ...
> > Internet6:
> > Destination Gateway
> > Flags Netif Expire
> > ::/1 link#14
> > UCS utun2
> > default fe80::%utun0
> > UGcI utun0
> > default fe80::%utun1
> > UGcI utun1
> > default fe80::%utun3
> > UGcI utun3
> > default [ public IPv6 ]
> > UGcI utun2
> >
> > If just "::/1, 8000::/1" solves the IPv6 issue, I guess you can give it
> > a try with "0.0.0.0/0, ::/1, 8000::/1" to see if both routes are created
> > properly?
> >
> > Best,
> > Berkay
prev parent reply other threads:[~2020-07-21 13:50 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-15 12:14 Adam Cooper
2020-07-21 13:12 ` Hasan Berkay Çağır
2020-07-21 13:29 ` Adam Cooper
2020-07-21 13:49 ` Hasan Berkay Çağır
2020-07-21 13:58 ` Adam Cooper
2020-07-21 14:03 ` Hasan Berkay Çağır
2020-07-21 13:50 ` Adam Cooper [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAN00TTrd4qMEVJd0nhQKoGr8E4UQC74sxyUGbAkFQpFeHkga7A@mail.gmail.com \
--to=adam@acpr.dev \
--cc=berkay@cagir.me \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).