Groups > linux.debian.user > #242727 > unrolled thread

Wireguard on Bullseye

Started by	Charles Curley <charlescurley@charlescurley.com>
First post	2021-12-06 21:00 +0100
Last post	2021-12-07 16:40 +0100
Articles	5 — 3 participants

Back to article view | Back to linux.debian.user

  Wireguard on Bullseye Charles Curley <charlescurley@charlescurley.com> - 2021-12-06 21:00 +0100
    Re: Wireguard on Bullseye Dan Ritter <dsr@randomstring.org> - 2021-12-06 21:20 +0100
      Re: Wireguard on Bullseye Charles Curley <charlescurley@charlescurley.com> - 2021-12-06 22:30 +0100
        Re: Wireguard on Bullseye john doe <johndoe65534@mail.com> - 2021-12-07 08:20 +0100
          Re: Wireguard on Bullseye Charles Curley <charlescurley@charlescurley.com> - 2021-12-07 16:40 +0100

#242727 — Wireguard on Bullseye

From	Charles Curley <charlescurley@charlescurley.com>
Date	2021-12-06 21:00 +0100
Subject	Wireguard on Bullseye
Message-ID	<Drsjw-65O-11@gated-at.bofh.it>

I would like to set up a Wireguard VPN. I have followed the
instructions at
https://wiki.debian.org/SimplePrivateTunnelVPNWithWireGuard down to the
ping just above the heading "Routing configuration". The ping command
as given doesn't work:

root@iorich:/etc/wireguard# ping 10.0.2.1/24
ping: 10.0.2.1/24: Name or service not known
root@iorich:/etc/wireguard# 

However, striping out the /24 at the end helps.

I have both firewalls cleared, i.e.:

root@hawk:/etc/wireguard# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@hawk:/etc/wireguard# 


On the server, ping fails:

root@hawk:/etc/wireguard# ping 10.0.2.2
PING 10.0.2.2 (10.0.2.2) 56(84) bytes of data.
From 10.0.2.1 icmp_seq=1 Destination Host Unreachable
ping: sendmsg: Destination address required
From 10.0.2.1 icmp_seq=2 Destination Host Unreachable
ping: sendmsg: Destination address required
From 10.0.2.1 icmp_seq=3 Destination Host Unreachable
ping: sendmsg: Destination address required
From 10.0.2.1 icmp_seq=4 Destination Host Unreachable
ping: sendmsg: Destination address required
From 10.0.2.1 icmp_seq=5 Destination Host Unreachable
ping: sendmsg: Destination address required

--- 10.0.2.2 ping statistics ---
5 packets transmitted, 0 received, +5 errors, 100% packet loss, time
4076ms

root@hawk:/etc/wireguard# 

And on the client,

root@iorich:/etc/wireguard# ping 10.0.2.1
PING 10.0.2.1 (10.0.2.1) 56(84) bytes of data.
From 10.0.2.2 icmp_seq=1 Destination Host Unreachable
ping: sendmsg: Required key not available
From 10.0.2.2 icmp_seq=2 Destination Host Unreachable
ping: sendmsg: Required key not available
From 10.0.2.2 icmp_seq=3 Destination Host Unreachable
ping: sendmsg: Required key not available
From 10.0.2.2 icmp_seq=4 Destination Host Unreachable
ping: sendmsg: Required key not available
From 10.0.2.2 icmp_seq=5 Destination Host Unreachable
ping: sendmsg: Required key not available

--- 10.0.2.1 ping statistics ---
5 packets transmitted, 0 received, +5 errors, 100% packet loss, time
4083ms

root@iorich:/etc/wireguard# 

I did check the keys; they appear to be correct.

root@hawk:/etc/wireguard# wg show wg0
interface: wg0
  public key: HBkAW05W2zxbTGEE4FstJLxnBpfDpec3KGhSfs6BLCU=
  private key: (hidden)
  listening port: 55820

peer: 28TsK9q71ruQ18acpp89MXGjsLVsEQcsKW3Y38VrfEo=
  allowed ips: 10.0.2.2/32
root@hawk:/etc/wireguard# 

root@iorich:/etc/wireguard# wg show wg0
interface: wg0
  public key: 28TsK9q71ruQ18acpp89MXGjsLVsEQcsKW3Y38VrfEo=
  private key: (hidden)
  listening port: 44458

peer: HBkAW05W2zxbTGEE4FstJLxnBpfDpec3KGhSfs6BLCU=
  endpoint: 72.36.20.38:55820
  allowed ips: (none)
root@iorich:/etc/wireguard# 





-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [next] | [standalone]

#242728

From	Dan Ritter <dsr@randomstring.org>
Date	2021-12-06 21:20 +0100
Message-ID	<DrsCS-6rG-3@gated-at.bofh.it>
In reply to	#242727

Charles Curley wrote: 
> I would like to set up a Wireguard VPN. I have followed the
> instructions at
> https://wiki.debian.org/SimplePrivateTunnelVPNWithWireGuard down to the
> ping just above the heading "Routing configuration". The ping command
> as given doesn't work:
> 
> root@iorich:/etc/wireguard# ping 10.0.2.1/24
> ping: 10.0.2.1/24: Name or service not known
> root@iorich:/etc/wireguard# 
> 
> However, striping out the /24 at the end helps.

That's fine.

> On the server, ping fails:
> 
> root@hawk:/etc/wireguard# ping 10.0.2.2
> PING 10.0.2.2 (10.0.2.2) 56(84) bytes of data.
> From 10.0.2.1 icmp_seq=1 Destination Host Unreachable
> ping: sendmsg: Destination address required
> --- 10.0.2.2 ping statistics ---
> 5 packets transmitted, 0 received, +5 errors, 100% packet loss, time
> 4076ms
> 
> I did check the keys; they appear to be correct.
> 
> root@hawk:/etc/wireguard# wg show wg0
> interface: wg0
>   public key: HBkAW05W2zxbTGEE4FstJLxnBpfDpec3KGhSfs6BLCU=
>   private key: (hidden)
>   listening port: 55820
> 
> peer: 28TsK9q71ruQ18acpp89MXGjsLVsEQcsKW3Y38VrfEo=
>   allowed ips: 10.0.2.2/32

 
> root@iorich:/etc/wireguard# wg show wg0
> interface: wg0
>   public key: 28TsK9q71ruQ18acpp89MXGjsLVsEQcsKW3Y38VrfEo=
>   private key: (hidden)
>   listening port: 44458
> 
> peer: HBkAW05W2zxbTGEE4FstJLxnBpfDpec3KGhSfs6BLCU=
>   endpoint: 72.36.20.38:55820
>   allowed ips: (none)

So iorich here is allowed to construct a tunnel to hawk, but no IPs from hawk
are allowed...

Add 10.0.2.1 to iorich's understanding of hawk's allowed ips.

Watch the status of the interface with 

# wg

You should get per-peer notes about

  latest handshake: 42 seconds ago
  transfer: 369.99 MiB received, 427.05 MiB sent

(less to begin with, of course.)

If you add dzur and issola, they can either all talk to hawk or
you can tell all of them about all the others, mesh-style.

-dsr-

[toc] | [prev] | [next] | [standalone]

#242730

From	Charles Curley <charlescurley@charlescurley.com>
Date	2021-12-06 22:30 +0100
Message-ID	<DrtIC-73O-5@gated-at.bofh.it>
In reply to	#242728

On Mon, 6 Dec 2021 14:59:45 -0500
Dan Ritter <dsr@randomstring.org> wrote:

> So iorich here is allowed to construct a tunnel to hawk, but no IPs
> from hawk are allowed...
> 
> Add 10.0.2.1 to iorich's understanding of hawk's allowed ips.

Thanks. That helped, I think.

I added

AllowedIPs = 0.0.0.0/0

to iorich's (the client) configuration in the peer section. Now:

root@iorich:/etc/wireguard# wg
interface: wg0
  public key: 28TsK9q71ruQ18acpp89MXGjsLVsEQcsKW3Y38VrfEo=
  private key: (hidden)
  listening port: 41490
  fwmark: 0xca6c

peer: HBkAW05W2zxbTGEE4FstJLxnBpfDpec3KGhSfs6BLCU=
  endpoint: 72.36.20.38:55820
  allowed ips: 0.0.0.0/0
  latest handshake: 1 minute, 23 seconds ago
  transfer: 1.87 KiB received, 11.31 KiB sent
root@iorich:/etc/wireguard# ping 10.0.2.1
PING 10.0.2.1 (10.0.2.1) 56(84) bytes of data.

--- 10.0.2.1 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 4089ms

root@iorich:/etc/wireguard# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.100.31  0.0.0.0         UG    600    0        0 wls3
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 wg0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wls3
192.168.100.0   0.0.0.0         255.255.255.0   U     600    0        0 wls3
192.168.122.0   192.168.100.6   255.255.255.0   UG    600    0        0 wls3
192.168.124.0   192.168.100.16  255.255.255.0   UG    600    0        0 wls3
root@iorich:/etc/wireguard# ifconfig wg0
wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1420
        inet 10.0.2.2  netmask 255.255.255.0  destination 10.0.2.2
        inet6 fc00:23:5::2  prefixlen 64  scopeid 0x0<global>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 59  bytes 3628 (3.5 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 229  bytes 24840 (24.2 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

root@iorich:/etc/wireguard# 

And on the server:

root@hawk:/etc/wireguard# wg
interface: wg0
  public key: HBkAW05W2zxbTGEE4FstJLxnBpfDpec3KGhSfs6BLCU=
  private key: (hidden)
  listening port: 55820

peer: 28TsK9q71ruQ18acpp89MXGjsLVsEQcsKW3Y38VrfEo=
  endpoint: 192.168.10.1:41490
  allowed ips: 10.0.2.0/24
  latest handshake: 1 minute, 43 seconds ago
  transfer: 9.81 KiB received, 2.02 KiB sent
root@hawk:/etc/wireguard# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.100.31  0.0.0.0         UG    0      0        0 enp3s0
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 wg0
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 enp3s0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
192.168.124.0   192.168.100.16  255.255.255.0   UG    0      0        0 enp3s0
root@hawk:/etc/wireguard# ifconfig wg0
wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1420
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 253  bytes 26204 (25.5 KiB)
        RX errors 10  dropped 0  overruns 0  frame 10
        TX packets 71  bytes 4132 (4.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

root@hawk:/etc/wireguard# 

Ping isn't getting through, but at least it isn't complaining. Wg shows
data moving through the tunnel. I suspect a firewall/NATting issue, so I
will start tracking that down.

Hawk's endpoint is the inner IF of my firewall, and iorich's endpoint
is the external IF of the firewall, so that makes sense.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#242743

From	john doe <johndoe65534@mail.com>
Date	2021-12-07 08:20 +0100
Message-ID	<DrCVA-4fN-5@gated-at.bofh.it>
In reply to	#242730

On 12/6/2021 10:22 PM, Charles Curley wrote:
> On Mon, 6 Dec 2021 14:59:45 -0500
> Dan Ritter <dsr@randomstring.org> wrote:
>
>> So iorich here is allowed to construct a tunnel to hawk, but no IPs
>> from hawk are allowed...
>>
>> Add 10.0.2.1 to iorich's understanding of hawk's allowed ips.
>
> Thanks. That helped, I think.
>
> I added
>
> AllowedIPs = 0.0.0.0/0
>
> to iorich's (the client) configuration in the peer section. Now:
>
> root@iorich:/etc/wireguard# wg
> interface: wg0
>    public key: 28TsK9q71ruQ18acpp89MXGjsLVsEQcsKW3Y38VrfEo=
>    private key: (hidden)
>    listening port: 41490
>    fwmark: 0xca6c
>
> peer: HBkAW05W2zxbTGEE4FstJLxnBpfDpec3KGhSfs6BLCU=
>    endpoint: 72.36.20.38:55820
>    allowed ips: 0.0.0.0/0
>    latest handshake: 1 minute, 23 seconds ago
>    transfer: 1.87 KiB received, 11.31 KiB sent
> root@iorich:/etc/wireguard# ping 10.0.2.1
> PING 10.0.2.1 (10.0.2.1) 56(84) bytes of data.
>
> --- 10.0.2.1 ping statistics ---
> 5 packets transmitted, 0 received, 100% packet loss, time 4089ms
>
> root@iorich:/etc/wireguard# route -n
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
> 0.0.0.0         192.168.100.31  0.0.0.0         UG    600    0        0 wls3
> 10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 wg0
> 169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wls3
> 192.168.100.0   0.0.0.0         255.255.255.0   U     600    0        0 wls3
> 192.168.122.0   192.168.100.6   255.255.255.0   UG    600    0        0 wls3
> 192.168.124.0   192.168.100.16  255.255.255.0   UG    600    0        0 wls3
> root@iorich:/etc/wireguard# ifconfig wg0
> wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1420
>          inet 10.0.2.2  netmask 255.255.255.0  destination 10.0.2.2
>          inet6 fc00:23:5::2  prefixlen 64  scopeid 0x0<global>
>          unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
>          RX packets 59  bytes 3628 (3.5 KiB)
>          RX errors 0  dropped 0  overruns 0  frame 0
>          TX packets 229  bytes 24840 (24.2 KiB)
>          TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>
> root@iorich:/etc/wireguard#
>
> And on the server:
>
> root@hawk:/etc/wireguard# wg
> interface: wg0
>    public key: HBkAW05W2zxbTGEE4FstJLxnBpfDpec3KGhSfs6BLCU=
>    private key: (hidden)
>    listening port: 55820
>
> peer: 28TsK9q71ruQ18acpp89MXGjsLVsEQcsKW3Y38VrfEo=
>    endpoint: 192.168.10.1:41490
>    allowed ips: 10.0.2.0/24
>    latest handshake: 1 minute, 43 seconds ago
>    transfer: 9.81 KiB received, 2.02 KiB sent
> root@hawk:/etc/wireguard# route -n
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
> 0.0.0.0         192.168.100.31  0.0.0.0         UG    0      0        0 enp3s0
> 10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 wg0
> 192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 enp3s0
> 192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
> 192.168.124.0   192.168.100.16  255.255.255.0   UG    0      0        0 enp3s0
> root@hawk:/etc/wireguard# ifconfig wg0
> wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1420
>          unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
>          RX packets 253  bytes 26204 (25.5 KiB)
>          RX errors 10  dropped 0  overruns 0  frame 10
>          TX packets 71  bytes 4132 (4.0 KiB)
>          TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
>
> root@hawk:/etc/wireguard#
>
> Ping isn't getting through, but at least it isn't complaining. Wg shows
> data moving through the tunnel. I suspect a firewall/NATting issue, so I
> will start tracking that down.
>

Looking at the logs should help you understand if it is a FW issue.

If you can not disable your firewall, allowing ping is a good idea!!! :)

CIDR notation is generaly used when defining a subnet or an IP range.
but rarely when you need to access a specific IP.

--
John Doe

[toc] | [prev] | [next] | [standalone]

#242749

From	Charles Curley <charlescurley@charlescurley.com>
Date	2021-12-07 16:40 +0100
Message-ID	<DrKJr-lc-1@gated-at.bofh.it>
In reply to	#242743

On Tue, 7 Dec 2021 08:11:10 +0100
john doe <johndoe65534@mail.com> wrote:

> Looking at the logs should help you understand if it is a FW issue.

Yup. Already done that.

> 
> If you can not disable your firewall, allowing ping is a good idea!!!
> :)

I prefer not to disable a firewall, even on my own network (except when
trying to debug something).

> 
> CIDR notation is generaly used when defining a subnet or an IP range.
> but rarely when you need to access a specific IP.

I was wondering about that when I copied the command from the Debian
wiki page. It didn't make sense in this instance, and didn't work.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [standalone]

csiph-web

Wireguard on Bullseye

Contents

#242727 — Wireguard on Bullseye

#242728

#242730

#242743

#242749