Re[3]: Connection works, ping does not

["Hendrik Friedel" <hendrik@friedels.name>]

Hello again,

I just realized:
I did the test using IPv6, whereas IPv4 is used for the tunnel. Having 
said that... I am not sure it is, as I use a Domain-Name... But I think 
it is IPv4.
I can repeat the test if needed using ipv4... But before that: From 
where should I do the traceroute?
a) from here (the machine that is working for many tunnels, e.g. from my 
phone to this machine and to which I have done a port forwarding) to the 
other remote machine
b) from the remote machine to here

The remote machine is headless; is there a commandline alternative to 
mtr that also shows the package loss?

Regards,
Hendrik

------ Originalnachricht ------
Von: "Hendrik Friedel" <hendrik@friedels.name>
An: "Max R. P. Grossmann" <m@max.pm>
Cc: wireguard@lists.zx2c4.com
Gesendet: 23.11.2020 21:37:24
Betreff: Re[2]: Connection works, ping does not

>Hello Max,
>
>thanks for your reply.
>
>>
>>Could it be that some kind of firewall is restricting UDP traffic to your other server?
>>
>Well, locally, I do use this machine as Host for many tunnels.
>
>
>>
>>E.g. could you try to run `mtr --udp [other server's public IP address]` on your computer (while disabling your other WireGuard connection, if applicable) and report back whether there is any kind of packet loss?
>I used traceroute on the commandline for this:
>
>Remote_
>
>wg-quick up wgnet0
>[#] ip link add wgnet0 type wireguard
>[#] wg setconf wgnet0 /dev/fd/63
>[#] ip -4 address add 10.192.122.3/32 dev wgnet0
>[#] ip link set mtu 1420 up dev wgnet0
>[#] wg set wgnet0 fwmark 51820
>[#] ip -4 route add 0.0.0.0/0 dev wgnet0 table 51820
>[#] ip -4 rule add not fwmark 51820 table 51820
>[#] ip -4 rule add table main suppress_prefixlength 0
>
>root@openmediavault:/etc/wireguard# wg show
>interface: wgnet0
>   public key: cebXSaxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxMFw=
>   private key: (hidden)
>   listening port: 42759
>   fwmark: 0xca6c
>
>peer: oNjmmmmmmmmmmmmmmmmmmmmmmmmmmmmU=
>   endpoint: [2003:cb:97ff:33d8:9ec7:a6ff:fefd:3a6d]:51820
>   allowed ips: 0.0.0.0/0
>   transfer: 0 B received, 444 B sent
>   persistent keepalive: every 25 seconds
>
>
>Local:
>traceroute to 2a00:sdfs:sdfsdf:sdfs:erre:ereee:sdf:c33a (2a00:sdfs:sdfsdf:sdfs:erre:ereee:sdf:c33a), 30 hops max, 80 byte packets
>  1  p200300cb9733ca009ec7a6fffefd3a69.dip0.t-ipconnect.de (2003:cb:9733:ca00:9ec7:a6ff:fefd:3a69)  0.946 ms  3.435 ms  3.645 ms
>  2  2003:0:8501::1 (2003:0:8501::1)  13.884 ms  13.839 ms  14.193 ms
>  3  * * *
>  4  2001:2000:3019:6b::1 (2001:2000:3019:6b::1)  86.609 ms  88.002 ms  87.874 ms
>  5  ddf-b2-v6.telia.net (2001:2000:3018:21::1)  88.137 ms  89.508 ms  89.639 ms
>  6  * * *
>  7  2a00:6020:0:b::2 (2a00:6020:0:b::2)  81.576 ms  81.989 ms 2a00:6020:0:a::2 (2a00:6020:0:a::2)  82.201 ms
>  8  lo1007.kr1.dc1-bor.dg-ao.de (2a00:6020:1000:3::1)  86.281 ms  84.259 ms  85.760 ms
>  9  2a00:xxxx:1000:3:yyyy:7f3d:d93e:f23d (2a00:xxxx:1000:3:yyyy:7f3d:d93e:f23d)  88.483 ms !X  87.579 ms !X  88.447 ms !X
>
>And here the mtr results (wg up and down)
>https://1drv.ms/u/s!AvbzKdYzkh6gl0BVLcuR9eeWUaqj?e=9wKxSC
>https://1drv.ms/u/s!AvbzKdYzkh6gl0HVwPz1FabOtemM?e=c7bCcB
>
>>If not, you may wish to check whether the port on the machine is reachable, e.g. by running `nc -v -l -u -p 12345` on your server and then executing `echo test | nc -u [server's IP] 12345`, to check whether the message arrives at the server.
>
>I am using the machine that is here, locally as server for many tunnels. So, the wireguard port is reachable.
>On the remote machine, I have NOT done any port forwarding. Is that neccessary at all? I thought that only the machine that is NOT initiating the connection needs a port forwarding.
>
>Greetings,
>Hendrik
>
>>
>>
>>Best,
>>
>>Max
>>
>>On 20/11/22 07:39pm, Hendrik Friedel wrote:
>>>  Hello,
>>>
>>>  (I posted this a while ago, but it never appeared on the list; if the list is the wrong place for this question, please let me know; I would appreciate a hint for a more appropriate place)
>>>
>>>  I am using wireguard to connect two machines.
>>>  My local server is connected  to the internet via a router. I am using theis Server also for connecting other devices (e.g. mobile phones) to my home network. This works great.
>>>
>>>  But when connecting to another server (both debian 10), I only get a successful connection, but no ping.
>>>  *My server:*
>>>
>>>  wg show
>>>  interface: wgnet0
>>>    public key: xxxxx=
>>>    private key: (hidden)
>>>    listening port: 51820
>>>
>>>  peer: sdfsdfsdfsdfsdfsdf=
>>>    endpoint: 109.41.64.83:15167
>>>    allowed ips: 10.192.122.2/32
>>>    latest handshake: 1 minute, 7 seconds ago
>>>    transfer: 10.95 MiB received, 40.35 MiB sent
>>>
>>>  peer: yyyy=
>>>    endpoint: 185.22.142.254:51380
>>>    allowed ips: 10.192.122.3/32
>>>    transfer: 0 B received, 5.20 KiB sent
>>>
>>>  peer: yyyy=
>>>    endpoint: 93.214.229.137:64119
>>>    allowed ips: 10.192.122.4/32
>>>
>>>  peer: yyyy=
>>>    endpoint: 93.214.225.116:49819
>>>    allowed ips: 10.192.122.5/32
>>>
>>>  peer: yyyy=
>>>    allowed ips: 10.192.122.6/32
>>>
>>>  peer: yyyy=
>>>    allowed ips: 10.192.122.7/32
>>>
>>>
>>>  more /etc/wireguard/wgnet0.conf
>>>  [Interface]
>>>  Address = 10.192.122.1/24
>>>  SaveConfig = true
>>>  PostUp = iptables -A FORWARD -i wgnet0 -j ACCEPT; iptables -A FORWARD -o wgnet0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
>>>  PostDown = iptables -D FORWARD -i wgnet0 -j ACCEPT; iptables -D FORWARD -o wgnet0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
>>>  ListenPort = 51820
>>>  PrivateKey = aaa=
>>>
>>>  [Peer]
>>>  PublicKey = yyyy=
>>>  AllowedIPs = 10.192.122.2/32
>>>  Endpoint = 123.41.67.233:18314
>>>
>>>  [Peer]
>>>  PublicKey = xxx=
>>>  AllowedIPs = 10.192.122.3/32
>>>  Endpoint = 123.22.142.254:51380
>>>
>>>
>>>
>>>
>>>
>>>  ip route
>>>  default via 192.168.177.1 dev eth0 proto static
>>>  10.192.122.0/24 dev wgnet0 proto kernel scope link src 10.192.122.1
>>>
>>>  and the other side/server:
>>>
>>>  interface: wgnet0
>>>    public key: xxxxx=
>>>    private key: (hidden)
>>>    listening port: 54004
>>>    fwmark: 0xca6c
>>>
>>>  peer: yyyyy=
>>>    endpoint: [2003:cb:aaa:bbb:9ec7:a6ff:fefd:3a6d]:51820
>>>    allowed ips: 0.0.0.0/0
>>>    transfer: 0 B received, 2.75 KiB sent
>>>    persistent keepalive: every 25 seconds
>>>
>>>
>>>
>>>    more wgnet0.conf
>>>  [Interface]
>>>  Address = 10.192.122.3/32
>>>  PrivateKey = xxxxx=
>>>
>>>  [Peer]
>>>  PublicKey = yyyyy=
>>>  Endpoint = v.myfritz.net:51820
>>>  AllowedIPs = 0.0.0.0/0
>>>  PersistentKeepalive = 25
>>>
>>>  It seems to me, that the connection is successfully established , but data is only transmitted in one direction.
>>>
>>>  How can I find the reason?
>>>
>>>  Regards,
>>>  Hendrik
>>>