Development discussion of WireGuard
 help / color / mirror / Atom feed
From: Christopher Ng <facboy@gmail.com>
To: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Fwd: Problems with Windows client over PulseSecure VPN
Date: Fri, 15 Jan 2021 10:32:24 +0000	[thread overview]
Message-ID: <CAN5wt5ojzay9uEjubrrivd6vZqOGNJ40M25ELzOYTK42zozijQ@mail.gmail.com> (raw)
In-Reply-To: <CAN5wt5r9rQpYcCkshBimOARoAxx7T529oUw6RSNnr4q3_y_31g@mail.gmail.com>

---------- Forwarded message ---------
From: Christopher Ng <facboy@gmail.com>
Date: Fri, 15 Jan 2021 at 09:46
Subject: Re: Problems with Windows client over PulseSecure VPN
To: Peter Whisker <peter.whisker@gmail.com>


i fixed this in my local build by disabling the binding in
defaultroutemonitor.go.  tbh i'm not sure what it's for, i found an
old discussion (about linux) about not binding to only one interface,
so i'm not sure why Windows binds to one interface.

diff --git a/tunnel/defaultroutemonitor.go b/tunnel/defaultroutemonitor.go
index 6ee95129..12456332 100644
--- a/tunnel/defaultroutemonitor.go
+++ b/tunnel/defaultroutemonitor.go
@@ -6,12 +6,10 @@
 package tunnel

 import (
-       "log"
        "sync"
        "time"

        "golang.org/x/sys/windows"
-       "golang.zx2c4.com/wireguard/conn"
        "golang.zx2c4.com/wireguard/device"
        "golang.zx2c4.com/wireguard/tun"
        "golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
@@ -50,18 +48,22 @@ func bindSocketRoute(family
winipcfg.AddressFamily, device *device.Device, ourLU
        }
        *lastLUID = luid
        *lastIndex = index
-       blackhole := blackholeWhenLoop && index == 0
-       bind, _ := device.Bind().(conn.BindSocketToInterface)
-       if bind == nil {
-               return nil
-       }
-       if family == windows.AF_INET {
-               log.Printf("Binding v4 socket to interface %d
(blackhole=%v)", index, blackhole)
-               return bind.BindSocketToInterface4(index, blackhole)
-       } else if family == windows.AF_INET6 {
-               log.Printf("Binding v6 socket to interface %d
(blackhole=%v)", index, blackhole)
-               return bind.BindSocketToInterface6(index, blackhole)
-       }
+       // disable this because if my peers are on different
interfaces...well i don't know how it can work.  i can't
+       // bind the socket to only one of them
+       /*
+               blackhole := blackholeWhenLoop && index == 0
+               bind, _ := device.Bind().(conn.BindSocketToInterface)
+               if bind == nil {
+                       return nil
+               }
+               if family == windows.AF_INET {
+                       log.Printf("Binding v4 socket to interface %d
(blackhole=%v)", index, blackhole)
+                       return bind.BindSocketToInterface4(index, blackhole)
+               } else if family == windows.AF_INET6 {
+                       log.Printf("Binding v6 socket to interface %d
(blackhole=%v)", index, blackhole)
+                       return bind.BindSocketToInterface6(index, blackhole)
+               }
+       */
        return nil
 }

On Wed, 13 Jan 2021 at 17:06, Peter Whisker <peter.whisker@gmail.com> wrote:
>
> Hi
>
> I have managed to work around the issue caused by Wireguard sending
> packets via default route interface even though the route to the peer is
> over a different interface (the issue caused by IP_UNICAST_IF). My
> Wireguard peer is down a corporate Pulse Secure tunnel.
>
> I use a PreUp and PostDown script as follows:
>
> PreUp
> =====
>
> for /f "tokens=3" %%a in ('route print -4 0.0.0.0^| find "0.0.0.0"') do
> if not defined ip set ip=%%a
> route add 0.0.0.0 mask 128.0.0.0 %ip% METRIC 1
> route add 128.0.0.0 mask 128.0.0.0 %ip% METRIC 1
> route delete 0.0.0.0 mask 0.0.0.0
>
> PostDown
> ========
>
> for /f "tokens=3" %%a in ('route print -4 0.0.0.0^| find "0.0.0.0"') do
> if not defined ip set ip=%%a
> route add 0.0.0.0 mask 0.0.0.0 %ip% METRIC 1
> route delete 0.0.0.0 mask 128.0.0.0
> route delete 128.0.0.0 mask 128.0.0.0
>
> This replaces the /0 default route by two /1 routes before bringing up
> the WireGuard interface. Traffic to the peer then gets sent down the
> correct route (why is this different from having a default route?). When
> the WireGuard instance is closed, it recreates the default route and
> removes the two /1 routes.
>
> Is there a way this could be done better in the Wireguard executable (I
> am currently using 0.3.4).
>
> Thanks
>
> Peter
>
> On 26/11/2020 13:11, Jason A. Donenfeld wrote:
> >> Is PulseSecure not setting up a /0 route? If so, then this is a known
> >> issue with the lack of policy routing on Windows.

  parent reply	other threads:[~2021-01-15 10:32 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-27 13:35 Problems with Windows client Peter Whisker
2020-08-27 19:20 ` Jason A. Donenfeld
2020-09-01  8:30   ` Peter Whisker
2020-09-03 13:35     ` Simon Rozman
2020-09-21 10:39       ` Peter Whisker
2020-11-24 10:17         ` Peter Whisker
2020-11-26 13:04           ` Problems with Windows client over PulseSecure VPN Peter Whisker
2020-11-26 13:11             ` Jason A. Donenfeld
     [not found]               ` <2dc629e2-93c9-4ed9-ea57-4318c8b62a73@gmail.com>
2021-01-13 15:13                 ` Peter Whisker
     [not found]                   ` <CAN5wt5r9rQpYcCkshBimOARoAxx7T529oUw6RSNnr4q3_y_31g@mail.gmail.com>
2021-01-15 10:32                     ` Christopher Ng [this message]
2021-01-19  8:53                       ` Fwd: " Peter Whisker
2021-01-30 10:51                         ` Christopher Ng
2021-01-19 10:39                       ` Peter Whisker
2021-03-02 21:32                         ` Steffen Sledz
2021-03-03 10:54             ` Jason A. Donenfeld
2021-03-03 12:01               ` Heiko Kendziorra
2021-03-04  9:11               ` Peter Whisker
2021-03-04 13:07                 ` Jason A. Donenfeld
2021-03-23 11:01               ` Christopher Ng
2021-04-14  9:40                 ` Christopher Ng
2021-04-14 20:19                   ` Jason A. Donenfeld
2021-04-14 21:17                     ` Christopher Ng
2021-07-29 11:00               ` Jason A. Donenfeld
2021-07-30  7:28                 ` Peter Whisker
2021-07-30 15:57                   ` Jason A. Donenfeld
2021-08-03  8:57                 ` Peter Whisker
2021-08-03 10:57                   ` Jason A. Donenfeld

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAN5wt5ojzay9uEjubrrivd6vZqOGNJ40M25ELzOYTK42zozijQ@mail.gmail.com \
    --to=facboy@gmail.com \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).