only last configured peer has allowed-ips

only last configured peer has allowed-ips

[Grant Haywood]

[-- Attachment #1: Type: text/plain, Size: 1644 bytes --]

When I run the following on a wireguard instance
wireguard@lists.zx2c4.com
    wg set wg0 peer *SOMEPUB1* allowed-ips 0.0.0.0/0 persistent-keepalive 25
    wg set wg0 peer *SOMEPUB2* allowed-ips 0.0.0.0/0 persistent-keepalive 25

only the last key gets set with an allowed-ips directive

interface: wg0
  public key: *HOSTKEY*
  private key: (hidden)
  listening port: 51820

peer: *SOMEPUB2*
  endpoint: *SOMEIP*:38568
  allowed ips: 0.0.0.0/0
  latest handshake: 1 minute, 11 seconds ago
  transfer: 4.81 KiB received, 3.47 KiB sent
  persistent keepalive: every 25 seconds

peer: *SOMEPUB1*
  endpoint: *SOMEIP*:36411
  allowed ips: (none)         #<< This appears wrong
  latest handshake: 1 minute, 24 seconds ago
  transfer: 44.05 KiB received, 47.68 KiB sent
  persistent keepalive: every 25 seconds

I cannot pass traffic from SOMEPUB1, and no handshake occurs

if SOMEPUB1 occurs last in the sequence of running wg set commands, it
retains the allowed-ips configuration and it CAN pass traffic, so it seems
only the last command run for me is valid for allowed-ips

the host is running the following
ii  wireguard-dkms                      0.0.20171111-wg1~zesty
all          fast, modern, secure kernel VPN tunnel (DKMS version)
ii  wireguard-tools                     0.0.20171111-wg1~zesty
amd64        fast, modern, secure kernel VPN tunnel (userland utilities)

one of the peers is running the same, the other is a rasberry pi built from
source snapshot as described on wireguard.com (WireGuard-0.0.20171111)

Am I missing something or is there an issue with configuring 2 peers with
0.0.0.0/0 in this release?

Thanks in advance

[-- Attachment #2: Type: text/html, Size: 2696 bytes --]

Re: only last configured peer has allowed-ips

[Aaron Jones]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

You cannot have more than one peer with the same AllowedIPs
entries. This is clearly documented on the "CryptoKey Routing"
section of the homepage. The reason is simple: when sending,
WireGuard would not know to which peer to send the traffic.

- -- 
Aaron Jones

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCAAGBQJaCWIOAAoJEIrwc3SIqzASMd4P/3JgXvsJ6iOK1LX+KMSt1htk
NF2FOek0084925vtJgPdJFhzxiyM23Xitwq0xFZcgMogRFkKB4anrJmeNoxu4hLr
z9JG3zJOIaQCPesIy2ta8y0JCPnphuL1ZbYQw434CzB/kcTPgEaSIklWSpvoD8AA
wQ2edvxzsgrY/1CRZIOf7yDVbrhaRnAVsnkHnbD0hBrTC6gWShP5T5vj5lH6ekL9
t86iQIOxq/0Ih2Umsa5ZWFpD+IJ4PtnAUfwvuz3hNtZ53HcC53T7QkLx5/oX0tvF
tOdkDb4TtbvAinE6Z3io2VIB3agDmKeJy0IcrQ0U4Y86LwhrrqGXak5JVw4T8yp4
BkD6Q0EtN+Lv5HNgLiv2S0siPyuXDt20pseBVAX3UxvU24+96ydYlm0m0LK74wgo
aWkoLptEroUqyFbirKKoC7BB8NUTt4U2J70D3qyDfmPSBy8WtQXwWH6mOZl1nwtq
WFEfpkkvwThucpdzXdFdGIAm1xXFYZqgIH6mO+FCQsAy6DQyluNa2UJj6gFHd5rR
MyrkjsI+IGETOXvvSn2+6rdvTK+B31CcvA0cH8+9jpmZt+6wwwgQmvOF/M1sYYHS
/OzOXBl1Z5uLsJ8O+8qnBJw1YFu4wZv1mZzEPE6rCvS2uU2mEhC0BXDmJGG+Bk1A
IY+7dg5HBe9AAOyw8k0p
=2QVh
-----END PGP SIGNATURE-----