* Wireguard address binding - how to fix? @ 2024-05-14 10:50 Nico Schottelius 2024-05-14 11:36 ` Daniel Gröber 0 siblings, 1 reply; 10+ messages in thread From: Nico Schottelius @ 2024-05-14 10:50 UTC (permalink / raw) To: WireGuard mailing list [-- Attachment #1: Type: text/plain, Size: 695 bytes --] Hello, the problem of wireguard being unable to bind to an IP address are hunting us over and over again. Isolation via namespace is not always a solution and I would consider it a hack in the first place. To the wireguard authors: what needs to be done to add IP address binding so that packets are always sent from a specific IP address? Virtually every other network software out there has that option for a good reason, only wireguard does not support it and thus does not work properly on devices with multiple IP addresses. What does it take to add IP address binding in wireguard? Best regards, Nico -- Sustainable and modern Infrastructures by ungleich.ch [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 873 bytes --] ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Wireguard address binding - how to fix? 2024-05-14 10:50 Wireguard address binding - how to fix? Nico Schottelius @ 2024-05-14 11:36 ` Daniel Gröber 2024-05-21 7:21 ` Nico Schottelius 0 siblings, 1 reply; 10+ messages in thread From: Daniel Gröber @ 2024-05-14 11:36 UTC (permalink / raw) To: Nico Schottelius; +Cc: WireGuard mailing list On Tue, May 14, 2024 at 12:50:25PM +0200, Nico Schottelius wrote: > To the wireguard authors: what needs to be done to add IP address > binding so that packets are always sent from a specific IP address? Implemented, but wating for Jason to respond: https://lore.kernel.org/netdev/20240219114334.3057169-1-dxld@darkboxed.org/T/ --Daniel ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Wireguard address binding - how to fix? 2024-05-14 11:36 ` Daniel Gröber @ 2024-05-21 7:21 ` Nico Schottelius 2024-05-21 11:11 ` Janne Johansson 0 siblings, 1 reply; 10+ messages in thread From: Nico Schottelius @ 2024-05-21 7:21 UTC (permalink / raw) To: Daniel Gröber; +Cc: WireGuard mailing list, Jason A. Donenfeld [-- Attachment #1: Type: text/plain, Size: 922 bytes --] Hello Jason, do you mind applying the patch from Daniel? Or is there anything wrong with it? Daniel: amazing work, I was not aware that you have already put in the hard work, thank you so very much! The world (*) is suffering because of the lack of IP address binding in wireguard. Best regards, Nico (*) With world I refer to every engineer that needs to run wireguard in non-trivial situations with multiple IP addresses on one host, which is extremely common for anything that routes. Daniel Gröber <dxld@darkboxed.org> writes: > On Tue, May 14, 2024 at 12:50:25PM +0200, Nico Schottelius wrote: >> To the wireguard authors: what needs to be done to add IP address >> binding so that packets are always sent from a specific IP address? > > Implemented, but wating for Jason to respond: > https://lore.kernel.org/netdev/20240219114334.3057169-1-dxld@darkboxed.org/T/ > > --Daniel [-- Attachment #2.1: Type: text/plain, Size: 62 bytes --] -- Sustainable and modern Infrastructures by ungleich.ch [-- Attachment #2.2: signature.asc --] [-- Type: application/pgp-signature, Size: 873 bytes --] ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Wireguard address binding - how to fix? 2024-05-21 7:21 ` Nico Schottelius @ 2024-05-21 11:11 ` Janne Johansson 2024-05-21 12:58 ` Nico Schottelius 0 siblings, 1 reply; 10+ messages in thread From: Janne Johansson @ 2024-05-21 11:11 UTC (permalink / raw) To: Nico Schottelius Cc: Daniel Gröber, WireGuard mailing list, Jason A. Donenfeld Den tis 21 maj 2024 kl 09:50 skrev Nico Schottelius <nico.schottelius@ungleich.ch>: > Hello Jason, > do you mind applying the patch from Daniel? Or is there anything wrong with it? > > Daniel: amazing work, I was not aware that you have already put in the > hard work, thank you so very much! > > The world (*) is suffering because of the lack of IP address binding in wireguard. > > (*) With world I refer to every engineer that needs to run wireguard in > non-trivial situations with multiple IP addresses on one host, which is > extremely common for anything that routes. Well, the main reason for wg to NOT do anything special is because routing generally is done by looking at the destination ip and then using the routing rules which the kernel uses to tell the packet which interface is considered "best" in order to reach that ip, which is why icmp and udp acts like this. I am certain that many engineers hope/think it would be more logical (or fit their designs better) if it responded on the same interface as the packet came in or whatever but the reason for wg to act like it does is because this is how connection-less packets have been acting since ages. The point that many engineers design wg endpoints "the wrong way" is probably a fault of education when it comes to how TCP/IP stacks did and do manage IP output. I have zero power to decide anything regarding how wg chooses to implement a workaround for IP being designed the way it is designed, but I can at least see why it hasn't immediately been accepted even if it would make some engineers suffer(*) less, at least in the short term. There are a lot of workarounds for the times when you did design the udp service as if it would act like tcp does in multihomed situations, which includes firewall tricks, or VRF/namespace/routing-domains to make sure the inner and outer address-pairs for the wg tunnel see different views of the network to handle this without changing how wg sends packets. -- May the most significant bit of your life be positive. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Wireguard address binding - how to fix? 2024-05-21 11:11 ` Janne Johansson @ 2024-05-21 12:58 ` Nico Schottelius 2024-05-21 14:11 ` Sebastian Hyrvall 0 siblings, 1 reply; 10+ messages in thread From: Nico Schottelius @ 2024-05-21 12:58 UTC (permalink / raw) To: Janne Johansson Cc: Daniel Gröber, WireGuard mailing list, Jason A. Donenfeld [-- Attachment #1: Type: text/plain, Size: 2083 bytes --] Hello Janne, Janne Johansson <icepic.dz@gmail.com> writes: > Den tis 21 maj 2024 kl 09:50 skrev Nico Schottelius > <nico.schottelius@ungleich.ch>: >> Hello Jason, >> do you mind applying the patch from Daniel? Or is there anything wrong with it? >> >> Daniel: amazing work, I was not aware that you have already put in the >> hard work, thank you so very much! >> >> The world (*) is suffering because of the lack of IP address binding in wireguard. >> >> (*) With world I refer to every engineer that needs to run wireguard in >> non-trivial situations with multiple IP addresses on one host, which is >> extremely common for anything that routes. > > Well, the main reason for wg to NOT do anything special is because > routing generally is done by looking at the destination ip and then No. Generally speaking that is incorrect. It is not special to reply with the same IP address. Generally speaking, when you have systems with multiple IP addresses you want to be able to steer the binding to an IP address. And even if you don't do that, you reply with the same IP address you have been contacted with. Wireguard does neither of it at the moment. I have written this already many times on this list, but the reason is very easy: - A connection is initiated from device A, connecting to router B on IP adddress a.b.c.d - The packet is correctly received by router B - The router replies incorrectly with address f.d.g.h - The reply packet is correctly blocked at the firewall of device A, because it comes from a random, unknown IP address This is the basic 101 of networking is to reply with the same address you have been contacted with, there is no discussion necessary. The whole world does it, even A-patch-y httpd (*) supports it. Since 1980 or so. Routing choices are independent of that, replying with the same IP address is a standard behaviour. Nico (*) As does ssh, nginx, ipsec protocols, openvpn, any rails application, any python application - I am not sure which software that binds to a socket does not support it, with the exception of wireguard. [-- Attachment #2.1: Type: text/plain, Size: 62 bytes --] -- Sustainable and modern Infrastructures by ungleich.ch [-- Attachment #2.2: signature.asc --] [-- Type: application/pgp-signature, Size: 873 bytes --] ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Wireguard address binding - how to fix? 2024-05-21 12:58 ` Nico Schottelius @ 2024-05-21 14:11 ` Sebastian Hyrvall 2024-05-21 14:34 ` Nico Schottelius 0 siblings, 1 reply; 10+ messages in thread From: Sebastian Hyrvall @ 2024-05-21 14:11 UTC (permalink / raw) To: Nico Schottelius, Janne Johansson Cc: Daniel Gröber, WireGuard mailing list The reason wireguard does it like this I think is because when designing it there was no thought given to any client,server scenario. Both sides are behaving like clients that can jump between IPs at any time. This is a flawed concept given that in 90% of scenarios there is at least one side acting as a server on a static ip. Unless the server side is a home user on dynamic ip and rebinding could be difficult. I've also given a bit of thought to the security aspect of this for VPN providers. Since a remote party can override the configured "Endpoint" if there was a scenario where vpn provider privkeys are compromised. The attacker can then, by knowing the connecting clients ip, get him to shift over the tunnel to their server and perform a long term, most likely undetected, mitm attack. Anyway. I've waited for this binding option for years. It's insane to me it gets ignored. One product is for example Mikrotik hardware. They don't want to implement third party patches so they are waiting for this bind-patch to be included in the kernel. Until then we're forced to use OpenVPN in our setups. On 2024-05-21 19:58, Nico Schottelius wrote: > Hello Janne, > > Janne Johansson <icepic.dz@gmail.com> writes: > >> Den tis 21 maj 2024 kl 09:50 skrev Nico Schottelius >> <nico.schottelius@ungleich.ch>: >>> Hello Jason, >>> do you mind applying the patch from Daniel? Or is there anything wrong with it? >>> >>> Daniel: amazing work, I was not aware that you have already put in the >>> hard work, thank you so very much! >>> >>> The world (*) is suffering because of the lack of IP address binding in wireguard. >>> >>> (*) With world I refer to every engineer that needs to run wireguard in >>> non-trivial situations with multiple IP addresses on one host, which is >>> extremely common for anything that routes. >> Well, the main reason for wg to NOT do anything special is because >> routing generally is done by looking at the destination ip and then > No. Generally speaking that is incorrect. > It is not special to reply with the same IP address. > > Generally speaking, when you have systems with multiple IP addresses you > want to be able to steer the binding to an IP address. And even if you > don't do that, you reply with the same IP address you have been > contacted with. Wireguard does neither of it at the moment. I have > written this already many times on this list, but the reason is very > easy: > > - A connection is initiated from device A, connecting to router B on IP adddress a.b.c.d > - The packet is correctly received by router B > - The router replies incorrectly with address f.d.g.h > - The reply packet is correctly blocked at the firewall of device A, because it comes > from a random, unknown IP address > > This is the basic 101 of networking is to reply with the same address > you have been contacted with, there is no discussion necessary. The > whole world does it, even A-patch-y httpd (*) supports it. Since 1980 or > so. > > Routing choices are independent of that, replying with the same IP > address is a standard behaviour. > > Nico > > (*) As does ssh, nginx, ipsec protocols, openvpn, any rails application, > any python application - I am not sure which software that binds to a > socket does not support it, with the exception of wireguard. > > ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Wireguard address binding - how to fix? 2024-05-21 14:11 ` Sebastian Hyrvall @ 2024-05-21 14:34 ` Nico Schottelius 2024-05-26 3:59 ` d tbsky 0 siblings, 1 reply; 10+ messages in thread From: Nico Schottelius @ 2024-05-21 14:34 UTC (permalink / raw) To: Sebastian Hyrvall Cc: Janne Johansson, Daniel Gröber, WireGuard mailing list Hey Sebastian, Sebastian Hyrvall <sh@keff.org> writes: > [...] > Anyway. I've waited for this binding option for years. It's insane to > me it gets ignored. I have to second this very strongly. > One product is for example Mikrotik hardware. They don't want to > implement third party patches so they are waiting for this bind-patch > to be included in the kernel. Until then we're forced to use OpenVPN > in our setups. As well as this one. As written in the previous mail, virtually every established networking software out there supports IP address binding, with the exception of wireguard. Dear wireguard authors, can be go into the direction of accepting an already written patch (thanks again Daniel) or if that patch is not suitable for some reason at least discuss what needs to be changed so that IP address binding can make its way into wireguard? BR, Nico -- Sustainable and modern Infrastructures by ungleich.ch ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Wireguard address binding - how to fix? 2024-05-21 14:34 ` Nico Schottelius @ 2024-05-26 3:59 ` d tbsky 2024-05-26 8:57 ` Nico Schottelius 0 siblings, 1 reply; 10+ messages in thread From: d tbsky @ 2024-05-26 3:59 UTC (permalink / raw) To: WireGuard mailing list > Sebastian Hyrvall <sh@keff.org> writes: > > [...] > > Anyway. I've waited for this binding option for years. It's insane to > > me it gets ignored. I remembered how exciting when I tested wireguard at 2017. until I asked muti-home question in the list. wiregurad is beautiful,elegant,fast but not easy to get along with. openvpn is not so amazing but it can get the job done. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Wireguard address binding - how to fix? 2024-05-26 3:59 ` d tbsky @ 2024-05-26 8:57 ` Nico Schottelius 2024-06-09 15:39 ` Nico Schottelius 0 siblings, 1 reply; 10+ messages in thread From: Nico Schottelius @ 2024-05-26 8:57 UTC (permalink / raw) To: d tbsky, Jason A. Donenfeld; +Cc: WireGuard mailing list [-- Attachment #1: Type: text/plain, Size: 578 bytes --] d tbsky <tbskyd@gmail.com> writes: > I remembered how exciting when I tested wireguard at 2017. until I > asked muti-home question in the list. > wiregurad is beautiful,elegant,fast but not easy to get along with. > openvpn is not so amazing but it can get the job done. Nice summary, hits the nail quite well. Jason, do you mind having a look at the submitted patches for IP address binding and comment on them? Or alternatively can you give green light for generally moving forward so that a direct inclusion in the Linux kernel would be accepted? Best regards, Nico [-- Attachment #2.1: Type: text/plain, Size: 62 bytes --] -- Sustainable and modern Infrastructures by ungleich.ch [-- Attachment #2.2: signature.asc --] [-- Type: application/pgp-signature, Size: 873 bytes --] ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Wireguard address binding - how to fix? 2024-05-26 8:57 ` Nico Schottelius @ 2024-06-09 15:39 ` Nico Schottelius 0 siblings, 0 replies; 10+ messages in thread From: Nico Schottelius @ 2024-06-09 15:39 UTC (permalink / raw) To: d tbsky; +Cc: Jason A. Donenfeld, WireGuard mailing list [-- Attachment #1: Type: text/plain, Size: 837 bytes --] Jason, may I shortly ask what your opinion is on the patch and whether there is a way forward to make wireguard usable on systems with multiple IP addresses? Best regards, Nico Nico Schottelius <nico.schottelius@ungleich.ch> writes: > d tbsky <tbskyd@gmail.com> writes: >> I remembered how exciting when I tested wireguard at 2017. until I >> asked muti-home question in the list. >> wiregurad is beautiful,elegant,fast but not easy to get along with. >> openvpn is not so amazing but it can get the job done. > > Nice summary, hits the nail quite well. > > Jason, do you mind having a look at the submitted patches for IP address > binding and comment on them? Or alternatively can you give green light > for generally moving forward so that a direct inclusion in the Linux > kernel would be accepted? > > Best regards, > > Nico [-- Attachment #2.1: Type: text/plain, Size: 62 bytes --] -- Sustainable and modern Infrastructures by ungleich.ch [-- Attachment #2.2: signature.asc --] [-- Type: application/pgp-signature, Size: 873 bytes --] ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2024-06-09 15:40 UTC | newest] Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2024-05-14 10:50 Wireguard address binding - how to fix? Nico Schottelius 2024-05-14 11:36 ` Daniel Gröber 2024-05-21 7:21 ` Nico Schottelius 2024-05-21 11:11 ` Janne Johansson 2024-05-21 12:58 ` Nico Schottelius 2024-05-21 14:11 ` Sebastian Hyrvall 2024-05-21 14:34 ` Nico Schottelius 2024-05-26 3:59 ` d tbsky 2024-05-26 8:57 ` Nico Schottelius 2024-06-09 15:39 ` Nico Schottelius
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).