From: Peter Whisker <peter.whisker@gmail.com>
To: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: Problems with Windows client over PulseSecure VPN
Date: Wed, 13 Jan 2021 15:13:19 +0000 [thread overview]
Message-ID: <397bedc7-3913-08bb-a6f3-691d9fab663c@gmail.com> (raw)
In-Reply-To: <2dc629e2-93c9-4ed9-ea57-4318c8b62a73@gmail.com>
Hi
I have managed to work around the issue caused by Wireguard sending
packets via default route interface even though the route to the peer is
over a different interface (the issue caused by IP_UNICAST_IF). My
Wireguard peer is down a corporate Pulse Secure tunnel.
I use a PreUp and PostDown script as follows:
PreUp
=====
for /f "tokens=3" %%a in ('route print -4 0.0.0.0^| find "0.0.0.0"') do
if not defined ip set ip=%%a
route add 0.0.0.0 mask 128.0.0.0 %ip% METRIC 1
route add 128.0.0.0 mask 128.0.0.0 %ip% METRIC 1
route delete 0.0.0.0 mask 0.0.0.0
PostDown
========
for /f "tokens=3" %%a in ('route print -4 0.0.0.0^| find "0.0.0.0"') do
if not defined ip set ip=%%a
route add 0.0.0.0 mask 0.0.0.0 %ip% METRIC 1
route delete 0.0.0.0 mask 128.0.0.0
route delete 128.0.0.0 mask 128.0.0.0
This replaces the /0 default route by two /1 routes before bringing up
the WireGuard interface. Traffic to the peer then gets sent down the
correct route (why is this different from having a default route?). When
the WireGuard instance is closed, it recreates the default route and
removes the two /1 routes.
Is there a way this could be done better in the Wireguard executable (I
am currently using 0.3.4).
Thanks
Peter
On 26/11/2020 13:11, Jason A. Donenfeld wrote:
>> Is PulseSecure not setting up a /0 route? If so, then this is a known
>> issue with the lack of policy routing on Windows.
next prev parent reply other threads:[~2021-01-13 17:04 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-27 13:35 Problems with Windows client Peter Whisker
2020-08-27 19:20 ` Jason A. Donenfeld
2020-09-01 8:30 ` Peter Whisker
2020-09-03 13:35 ` Simon Rozman
2020-09-21 10:39 ` Peter Whisker
2020-11-24 10:17 ` Peter Whisker
2020-11-26 13:04 ` Problems with Windows client over PulseSecure VPN Peter Whisker
2020-11-26 13:11 ` Jason A. Donenfeld
[not found] ` <2dc629e2-93c9-4ed9-ea57-4318c8b62a73@gmail.com>
2021-01-13 15:13 ` Peter Whisker [this message]
[not found] ` <CAN5wt5r9rQpYcCkshBimOARoAxx7T529oUw6RSNnr4q3_y_31g@mail.gmail.com>
2021-01-15 10:32 ` Fwd: " Christopher Ng
2021-01-19 8:53 ` Peter Whisker
2021-01-30 10:51 ` Christopher Ng
2021-01-19 10:39 ` Peter Whisker
2021-03-02 21:32 ` Steffen Sledz
2021-03-03 10:54 ` Jason A. Donenfeld
2021-03-03 12:01 ` Heiko Kendziorra
2021-03-04 9:11 ` Peter Whisker
2021-03-04 13:07 ` Jason A. Donenfeld
2021-03-23 11:01 ` Christopher Ng
2021-04-14 9:40 ` Christopher Ng
2021-04-14 20:19 ` Jason A. Donenfeld
2021-04-14 21:17 ` Christopher Ng
2021-07-29 11:00 ` Jason A. Donenfeld
2021-07-30 7:28 ` Peter Whisker
2021-07-30 15:57 ` Jason A. Donenfeld
2021-08-03 8:57 ` Peter Whisker
2021-08-03 10:57 ` Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=397bedc7-3913-08bb-a6f3-691d9fab663c@gmail.com \
--to=peter.whisker@gmail.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.