MacOS client v1.0.13 multiple tunnel issue

[Dan West <dwest@galois.com>]

I upgraded my wireguard client from v1.0.12 to v1.0.13 on my MacBook and when I connect using multiple tunnels to different sites, it no longer works correctly.  I am not entirely sure if this is a problem with routing on the client side or if there is a bug preventing additional tunnels from connecting to other sites.  It seems that the first tunnel I connect to will work, but any subsequent tunnels will not.  So for example, if I connect to SiteA and then SiteB, SiteA will work and SiteB will not.  If I connect to SiteB and then SiteA, SiteB will work but SiteA will not.  This is tested by pinging the VPN's gateway address after establishing each connection.  Here is a redacted copy of my tunnel configs:

### Site A Config ###

[Interface]
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
Address = 10.1.1.100/24
DNS = 10.1.1.1, example.com

[Peer]
PublicKey = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy=
AllowedIPs = 10.1.1.0/16, aa.aaa.aaa.aa/25 #Public IP space for Site-A DMZ
Endpoint = site-a.example.com:32123

### Site B Config ###

[Interface]
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
Address = 10.2.1.100/24
DNS = 10.2.1.1, example.com

[Peer]
PublicKey = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy=
AllowedIPs = 10.2.1.0/16, bb.bbb.bbb.bb/25 #Public IP space for Site-B DMZ
Endpoint = site-b.example.com:32123

It is worth noting that this has been tested using both the “On-Demand” function as well as the MacOS built-in Network management tool.  The version history says “Jun 17, 2021 - 1.0.13 - This version includes internal fixes and API changes for newer iOS versions”, so the actual changes are a little opaque. 

I ran a TCPdump on Site-B (or the second site) to see if traffic is even getting to the VPN endpoint and it is not seeing anything.  I also ran a packet capture on the border firewalls and did not see any traffic attempting to hit that location.  The client does not show any handshake activity, so I believe the issue is specifically in the client or maybe how it is trying route the second connection?

A temporary fix is to downgrade back to v1.0.12, but due to limitations of the Apple Appstore, it is only feasible if you happen to have a backup copy of the client.  I just happened to have a backup copy, so I was able to test with both clients.  

Has anyone else ran into this issue or has any suggestions?  I can provide more information on the topology if you think it would be helpful.

Thanks,

Dan

Dan West
Systems Administrator
Galois Inc.
http://corp.galois.com