Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #242785 > unrolled thread

Forwarding over wireguard

Back to article view | Back to linux.debian.user

Contents

  Forwarding over wireguard Charles Curley <charlescurley@charlescurley.com> - 2021-12-08 23:00 +0100
    Re: Forwarding over wireguard Dan Ritter <dsr@randomstring.org> - 2021-12-09 01:20 +0100
      Re: Forwarding over wireguard Charles Curley <charlescurley@charlescurley.com> - 2021-12-09 19:50 +0100
    SOLVED Re: Forwarding over wireguard Charles Curley <charlescurley@charlescurley.com> - 2021-12-09 20:10 +0100

#242785 — Forwarding over wireguard

I have a wireguard setup that lets me ping from either endpoint to the
other. Using the client, I would like to address hosts on the home
(server's) network by their local IP addresses.

On the client, I can ping the other end of the tunnel, but not any
local addresses. On the client:

root@iorich:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         172.20.10.1     0.0.0.0         UG    600    0        0 wls3
link-local      0.0.0.0         255.255.0.0     U     1000   0        0 wls3
172.20.10.0     0.0.0.0         255.255.255.240 U     600    0        0 wls3
root@iorich:~# wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.0.2.3/24 dev wg0
[#] ip -6 address add fc00:23:5::3/64 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a tun.wg0 -m 0 -x
[#] route add -net 192.168.100.0 netmask 255.255.255.0 dev wg0
root@iorich:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         172.20.10.1     0.0.0.0         UG    600    0        0 wls3
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 wg0
link-local      0.0.0.0         255.255.0.0     U     1000   0        0 wls3
172.20.10.0     0.0.0.0         255.255.255.240 U     600    0        0 wls3
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 wg0
root@iorich:~# ping 10.0.2.1
PING 10.0.2.1 (10.0.2.1) 56(84) bytes of data.
64 bytes from 10.0.2.1: icmp_seq=1 ttl=64 time=182 ms
64 bytes from 10.0.2.1: icmp_seq=2 ttl=64 time=163 ms
64 bytes from 10.0.2.1: icmp_seq=3 ttl=64 time=170 ms
64 bytes from 10.0.2.1: icmp_seq=4 ttl=64 time=187 ms
64 bytes from 10.0.2.1: icmp_seq=5 ttl=64 time=170 ms

--- 10.0.2.1 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4007ms
rtt min/avg/max/mdev = 162.936/174.474/186.802/8.809 ms
root@iorich:~# ping 192.168.100.30
PING 192.168.100.30 (192.168.100.30) 56(84) bytes of data.
From 10.0.2.3 icmp_seq=1 Destination Host Unreachable
ping: sendmsg: Required key not available
From 10.0.2.3 icmp_seq=2 Destination Host Unreachable
ping: sendmsg: Required key not available
From 10.0.2.3 icmp_seq=3 Destination Host Unreachable
ping: sendmsg: Required key not available
From 10.0.2.3 icmp_seq=4 Destination Host Unreachable
ping: sendmsg: Required key not available
From 10.0.2.3 icmp_seq=5 Destination Host Unreachable
ping: sendmsg: Required key not available

--- 192.168.100.30 ping statistics ---
5 packets transmitted, 0 received, +5 errors, 100% packet loss, time 4087ms

root@iorich:~# 

Searching on "ping: sendmsg: Required key not available" turned up no
examples or solutions. On the hypothesis that the key referred to was a
wireguard key, I checked those. Those appear to be OK.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [next] | [standalone]

#242788

Charles Curley wrote: 
> I have a wireguard setup that lets me ping from either endpoint to the
> other. Using the client, I would like to address hosts on the home
> (server's) network by their local IP addresses.
> 

The client's routing table looks fine after you start wg0. What
does the home server's routing table look like? 

Is it forwarding IPv4 packets for anything else, or is this the
first time it's been a router?

Does it have any firewall policies or rules?

-dsr-

[toc] | [prev] | [next] | [standalone]

#242832

On Wed, 8 Dec 2021 18:56:51 -0500
Dan Ritter <dsr@randomstring.org> wrote:

> Charles Curley wrote: 
> > I have a wireguard setup that lets me ping from either endpoint to
> > the other. Using the client, I would like to address hosts on the
> > home (server's) network by their local IP addresses.
> >   
> 
> The client's routing table looks fine after you start wg0. What
> does the home server's routing table look like? 

root@hawk:/etc/wireguard# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         freeman.localdo 0.0.0.0         UG    0      0        0 enp3s0
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 wg0
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 enp3s0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0
192.168.124.0   jhegaala.locald 255.255.255.0   UG    0      0        0 enp3s0
root@hawk:/etc/wireguard# 

> 
> Is it forwarding IPv4 packets for anything else, or is this the
> first time it's been a router?

Not the first time. It forwards packets for 192.168.122.0/24, a virtual
network of virtual machines.

> 
> Does it have any firewall policies or rules?

Yes. However, dropping all firewall rules makes no discernible
difference.

I also instrumented both interfaces with "tcpdump -i wg0". I saw plenty
of DNS and ICMP traffic originating on the client, aimed at the
server's wg0 IF. But nothing for 192.168.100.0/24 showed up.


> 
> -dsr-
> 



-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#242837 — SOLVED Re: Forwarding over wireguard

On Wed, 8 Dec 2021 13:30:45 -0700
Charles Curley <charlescurley@charlescurley.com> wrote:

> I have a wireguard setup that lets me ping from either endpoint to the
> other. Using the client, I would like to address hosts on the home
> (server's) network by their local IP addresses.
> 
> On the client, I can ping the other end of the tunnel, but not any
> local addresses. On the client:
> 

> root@iorich:~# ping 192.168.100.30
> PING 192.168.100.30 (192.168.100.30) 56(84) bytes of data.
> From 10.0.2.3 icmp_seq=1 Destination Host Unreachable
> ping: sendmsg: Required key not available
> From 10.0.2.3 icmp_seq=2 Destination Host Unreachable
> ping: sendmsg: Required key not available
> From 10.0.2.3 icmp_seq=3 Destination Host Unreachable
> ping: sendmsg: Required key not available
> From 10.0.2.3 icmp_seq=4 Destination Host Unreachable
> ping: sendmsg: Required key not available
> From 10.0.2.3 icmp_seq=5 Destination Host Unreachable
> ping: sendmsg: Required key not available
> 
> --- 192.168.100.30 ping statistics ---
> 5 packets transmitted, 0 received, +5 errors, 100% packet loss, time
> 4087ms
> 
> root@iorich:~# 

Solution: put the network(s) you want to address over wireguard into the
client's list of AllowedIPs.

AllowedIPs = 10.0.2.0/24, 192.168.100.0/24

This means removing the PostUp route add and PostDown route del
statements from the client's configuration, otherwise route will
complain.


-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web