listen on specific IP only

listen on specific IP only

[Tomas Herceg]

Helo,
is there a way to listen on specific IP/interface? i need it to use same 
port for multiple applications - 53 for DNS and wireguard because of 
firewall rules i can't controll. I have multiple IPs on the server each 
for specific use. DNS recursor is listening only on private interfaces 
and i want wireguard will be on public IP.

if i try

ListenPort=53

it fails with:
Jun 20 19:12:52 athos wg-quick[19091]: RTNETLINK answers: Address 
already in use

but all my public IPs are not used with this port:

netstat -tulpn |grep 53
tcp        0      0 172.16.16.6:53          0.0.0.0:* 
LISTEN      3372/pdns_recursor
tcp        0      0 192.168.11.1:53         0.0.0.0:* 
LISTEN      3372/pdns_recursor
tcp        0      0 127.0.0.1:53            0.0.0.0:* 
LISTEN      3372/pdns_recursor
udp        0      0 172.16.16.6:53          0.0.0.0:* 
        3372/pdns_recursor
udp    30720      0 192.168.11.1:53         0.0.0.0:* 
        3372/pdns_recursor
udp        0      0 127.0.0.1:53            0.0.0.0:* 
        3372/pdns_recursor

is there any workaround for that for now? will some type of DNAT works?

Thanks Tomas

Re: listen on specific IP only

[Jason A. Donenfeld]

We don't allow this in WireGuard by design.

However, you can easily work around this with iptables:

$ wg set wg0 listen-port 11153
$ iptables -t nat -A PREROUTING .... -p udp --dport 53 -j REDIRECT
--to-port 11153

Fill in the ... with --destination or --in-interface or whatever you want.

Jason

Re: listen on specific IP only

[Tomas Herceg]

Thanks
works like a charm =)

interface: wg0-default
   public key: (no no no)
   private key: (hidden)
   listening port: 51820
   fwmark: 0xca6c

peer: GUUrqy95QclZQZ9zxMkX+5G6HklnSaqhIAJpf7naSFI=
   endpoint: PUBIP1:53
   allowed ips: 192.168.11.0/24, 172.16.16.6/32
   latest handshake: 12 seconds ago
   transfer: 532 B received, 1.12 KiB sent
   persistent keepalive: every 25 seconds

peer: 4H52v5z94+LtLaiSw47V4/1zc8TiaQ05+kI63ESY12Q=
   endpoint: PUBIP2:53
   allowed ips: 0.0.0.0/0, ::/0
   latest handshake: 36 seconds ago
   transfer: 440.24 KiB received, 109.24 KiB sent
   persistent keepalive: every 25 seconds


On 06/20/2018 07:50 PM, Jason A. Donenfeld wrote:
> We don't allow this in WireGuard by design.
> 
> However, you can easily work around this with iptables:
> 
> $ wg set wg0 listen-port 11153
> $ iptables -t nat -A PREROUTING .... -p udp --dport 53 -j REDIRECT
> --to-port 11153
> 
> Fill in the ... with --destination or --in-interface or whatever you want.
> 
> Jason
>