* Routing only to latest peer in the config list seems to work @ 2018-08-29 7:43 danny.korpan 2018-09-06 17:13 ` Ryan Whelan 0 siblings, 1 reply; 5+ messages in thread From: danny.korpan @ 2018-08-29 7:43 UTC (permalink / raw) To: wireguard Hi, I have the problem with my wireguard server, that only the latest user "peer" from the server config can route/ping to the internal wireguard server IP or the clients in the network behind the wireguard server upon successful connection. All peers can connect to the server, but only the latest in the list last can ping other servers. I can't locate the error in the configs... does anybody have an idea? My wireguard server and client version is using 0.0.20180809-wg1~xenial with Ubuntu 18.04.1 wg0.conf [Interface] Address = 192.168.50.1/24 PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE ListenPort = 51820 PrivateKey = XXX [Peer] #User 1 PublicKey = XXX PresharedKey = XXX AllowedIPs = 192.168.50.0/24 [Peer] #User 2 PublicKey = XXX PresharedKey = XXX #AllowedIPs = 192.168.50.0/24 [Peer] #User 3 PublicKey = XXX PresharedKey = XXX AllowedIPs = 192.168.50.0/24 [Peer] #User 4 PublicKey = XXX PresharedKey = XXX AllowedIPs = 192.168.50.0/24 client.config [Interface] PrivateKey = XXX DNS = 192.168.178.1 Address = 192.168.50.2/24 [Peer] PublicKey = XXX PresharedKey = XXX AllowedIPs = 192.168.50.0/24, 190.168.178.0/24 Endpoint = my.remote.server:51820 PersistentKeepalive = 25 My sysctl.conf includes net.ipv4.conf.all.proxy_arp = 1 net.ipv4.ip_forward = 1 Does anybody have an idea? Kind Regards, Danny ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Routing only to latest peer in the config list seems to work 2018-08-29 7:43 Routing only to latest peer in the config list seems to work danny.korpan @ 2018-09-06 17:13 ` Ryan Whelan 2018-09-08 8:36 ` AW: " danny.korpan 0 siblings, 1 reply; 5+ messages in thread From: Ryan Whelan @ 2018-09-06 17:13 UTC (permalink / raw) To: danny.korpan; +Cc: WireGuard mailing list [-- Attachment #1: Type: text/plain, Size: 1891 bytes --] You're using the same AllowedIPs for multiple peers. On Thu, Sep 6, 2018 at 12:15 PM <danny.korpan@mailbox.org> wrote: > Hi, > > I have the problem with my wireguard server, that only the latest user > "peer" from the server config can route/ping to the internal wireguard > server IP or the clients in the network behind the wireguard server upon > successful connection. All peers can connect to the server, but only the > latest in the list last can ping other servers. > I can't locate the error in the configs... does anybody have an idea? > > My wireguard server and client version is using 0.0.20180809-wg1~xenial > with > Ubuntu 18.04.1 > > wg0.conf > [Interface] > Address = 192.168.50.1/24 > PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A > POSTROUTING -o eth0 -j MASQUERADE > PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D > POSTROUTING -o eth0 -j MASQUERADE > ListenPort = 51820 > PrivateKey = XXX > > [Peer] > #User 1 > PublicKey = XXX > PresharedKey = XXX > AllowedIPs = 192.168.50.0/24 > > [Peer] > #User 2 > PublicKey = XXX > PresharedKey = XXX > #AllowedIPs = 192.168.50.0/24 > > [Peer] > #User 3 > PublicKey = XXX > PresharedKey = XXX > AllowedIPs = 192.168.50.0/24 > > [Peer] > #User 4 > PublicKey = XXX > PresharedKey = XXX > AllowedIPs = 192.168.50.0/24 > > > > client.config > [Interface] > PrivateKey = XXX > DNS = 192.168.178.1 > Address = 192.168.50.2/24 > > [Peer] > PublicKey = XXX > PresharedKey = XXX > AllowedIPs = 192.168.50.0/24, 190.168.178.0/24 > Endpoint = my.remote.server:51820 > PersistentKeepalive = 25 > > My sysctl.conf includes > net.ipv4.conf.all.proxy_arp = 1 > net.ipv4.ip_forward = 1 > > Does anybody have an idea? > > > Kind Regards, > Danny > > _______________________________________________ > WireGuard mailing list > WireGuard@lists.zx2c4.com > https://lists.zx2c4.com/mailman/listinfo/wireguard > [-- Attachment #2: Type: text/html, Size: 3114 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* AW: Routing only to latest peer in the config list seems to work 2018-09-06 17:13 ` Ryan Whelan @ 2018-09-08 8:36 ` danny.korpan 2018-09-08 10:21 ` Steven Honson 0 siblings, 1 reply; 5+ messages in thread From: danny.korpan @ 2018-09-08 8:36 UTC (permalink / raw) To: 'Ryan Whelan'; +Cc: wireguard [-- Attachment #1: Type: text/plain, Size: 2537 bytes --] Hi, I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing. Kind Regards, Danny Von: Ryan Whelan <rcwhelan@gmail.com> Gesendet: Donnerstag, 6. September 2018 19:14 An: danny.korpan@mailbox.org Cc: WireGuard mailing list <wireguard@lists.zx2c4.com> Betreff: Re: Routing only to latest peer in the config list seems to work You're using the same AllowedIPs for multiple peers. On Thu, Sep 6, 2018 at 12:15 PM <danny.korpan@mailbox.org <mailto:danny.korpan@mailbox.org> > wrote: Hi, I have the problem with my wireguard server, that only the latest user "peer" from the server config can route/ping to the internal wireguard server IP or the clients in the network behind the wireguard server upon successful connection. All peers can connect to the server, but only the latest in the list last can ping other servers. I can't locate the error in the configs... does anybody have an idea? My wireguard server and client version is using 0.0.20180809-wg1~xenial with Ubuntu 18.04.1 wg0.conf [Interface] Address = 192.168.50.1/24 <http://192.168.50.1/24> PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE ListenPort = 51820 PrivateKey = XXX [Peer] #User 1 PublicKey = XXX PresharedKey = XXX AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> [Peer] #User 2 PublicKey = XXX PresharedKey = XXX #AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> [Peer] #User 3 PublicKey = XXX PresharedKey = XXX AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> [Peer] #User 4 PublicKey = XXX PresharedKey = XXX AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> client.config [Interface] PrivateKey = XXX DNS = 192.168.178.1 Address = 192.168.50.2/24 <http://192.168.50.2/24> [Peer] PublicKey = XXX PresharedKey = XXX AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> , 190.168.178.0/24 <http://190.168.178.0/24> Endpoint = my.remote.server:51820 PersistentKeepalive = 25 My sysctl.conf includes net.ipv4.conf.all.proxy_arp = 1 net.ipv4.ip_forward = 1 Does anybody have an idea? Kind Regards, Danny _______________________________________________ WireGuard mailing list WireGuard@lists.zx2c4.com <mailto:WireGuard@lists.zx2c4.com> https://lists.zx2c4.com/mailman/listinfo/wireguard [-- Attachment #2: Type: text/html, Size: 6414 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Routing only to latest peer in the config list seems to work 2018-09-08 8:36 ` AW: " danny.korpan @ 2018-09-08 10:21 ` Steven Honson 2018-09-08 17:28 ` AW: " danny.korpan 0 siblings, 1 reply; 5+ messages in thread From: Steven Honson @ 2018-09-08 10:21 UTC (permalink / raw) To: danny.korpan; +Cc: wireguard [-- Attachment #1: Type: text/plain, Size: 3459 bytes --] Hi Danny, Have you also changed the mask for each of the peers on your central node to /32? If not you’ll need to do this, as leaving them as /24 still effectively makes them all the same route. Ie 192.168.50.1/24 and 192.168.50.2/24 are both the same still. The “AllowedIPs" on the central node to be 192.168.50.1/32, 192.168.50.2/32 etc in your example. You can leave the “Address” IPs with a /24 mask. Are you able to share an updated copy of your configs? Cheers, Steven > On 8 Sep 2018, at 6:36 pm, danny.korpan@mailbox.org wrote: > > Hi, > > I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing. > > Kind Regards, > Danny > > Von: Ryan Whelan <rcwhelan@gmail.com> > Gesendet: Donnerstag, 6. September 2018 19:14 > An: danny.korpan@mailbox.org > Cc: WireGuard mailing list <wireguard@lists.zx2c4.com> > Betreff: Re: Routing only to latest peer in the config list seems to work > > You're using the same AllowedIPs for multiple peers. > > On Thu, Sep 6, 2018 at 12:15 PM <danny.korpan@mailbox.org <mailto:danny.korpan@mailbox.org>> wrote: > Hi, > > I have the problem with my wireguard server, that only the latest user > "peer" from the server config can route/ping to the internal wireguard > server IP or the clients in the network behind the wireguard server upon > successful connection. All peers can connect to the server, but only the > latest in the list last can ping other servers. > I can't locate the error in the configs... does anybody have an idea? > > My wireguard server and client version is using 0.0.20180809-wg1~xenial with > Ubuntu 18.04.1 > > wg0.conf > [Interface] > Address = 192.168.50.1/24 <http://192.168.50.1/24> > PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A > POSTROUTING -o eth0 -j MASQUERADE > PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D > POSTROUTING -o eth0 -j MASQUERADE > ListenPort = 51820 > PrivateKey = XXX > > [Peer] > #User 1 > PublicKey = XXX > PresharedKey = XXX > AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> > > [Peer] > #User 2 > PublicKey = XXX > PresharedKey = XXX > #AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> > > [Peer] > #User 3 > PublicKey = XXX > PresharedKey = XXX > AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> > > [Peer] > #User 4 > PublicKey = XXX > PresharedKey = XXX > AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> > > > > client.config > [Interface] > PrivateKey = XXX > DNS = 192.168.178.1 > Address = 192.168.50.2/24 <http://192.168.50.2/24> > > [Peer] > PublicKey = XXX > PresharedKey = XXX > AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24>, 190.168.178.0/24 <http://190.168.178.0/24> > Endpoint = my.remote.server:51820 > PersistentKeepalive = 25 > > My sysctl.conf includes > net.ipv4.conf.all.proxy_arp = 1 > net.ipv4.ip_forward = 1 > > Does anybody have an idea? > > > Kind Regards, > Danny > > _______________________________________________ > WireGuard mailing list > WireGuard@lists.zx2c4.com <mailto:WireGuard@lists.zx2c4.com> > https://lists.zx2c4.com/mailman/listinfo/wireguard <https://lists.zx2c4.com/mailman/listinfo/wireguard>_______________________________________________ > WireGuard mailing list > WireGuard@lists.zx2c4.com > https://lists.zx2c4.com/mailman/listinfo/wireguard [-- Attachment #2: Type: text/html, Size: 12313 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* AW: Routing only to latest peer in the config list seems to work 2018-09-08 10:21 ` Steven Honson @ 2018-09-08 17:28 ` danny.korpan 0 siblings, 0 replies; 5+ messages in thread From: danny.korpan @ 2018-09-08 17:28 UTC (permalink / raw) To: 'Steven Honson'; +Cc: wireguard [-- Attachment #1: Type: text/plain, Size: 3881 bytes --] Hi, your solution solved my problem: Chaning subnet to 32 instead of 24. Thank you and kind regards, Danny Von: Steven Honson <steven@honson.id.au> Gesendet: Samstag, 8. September 2018 12:22 An: danny.korpan@mailbox.org Cc: wireguard@lists.zx2c4.com Betreff: Re: Routing only to latest peer in the config list seems to work Hi Danny, Have you also changed the mask for each of the peers on your central node to /32? If not you’ll need to do this, as leaving them as /24 still effectively makes them all the same route. Ie 192.168.50.1/24 and 192.168.50.2/24 are both the same still. The “AllowedIPs" on the central node to be 192.168.50.1/32, 192.168.50.2/32 etc in your example. You can leave the “Address” IPs with a /24 mask. Are you able to share an updated copy of your configs? Cheers, Steven On 8 Sep 2018, at 6:36 pm, danny.korpan@mailbox.org <mailto:danny.korpan@mailbox.org> wrote: Hi, I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing. Kind Regards, Danny Von: Ryan Whelan <rcwhelan@gmail.com <mailto:rcwhelan@gmail.com> > Gesendet: Donnerstag, 6. September 2018 19:14 An: danny.korpan@mailbox.org <mailto:danny.korpan@mailbox.org> Cc: WireGuard mailing list <wireguard@lists.zx2c4.com <mailto:wireguard@lists.zx2c4.com> > Betreff: Re: Routing only to latest peer in the config list seems to work You're using the same AllowedIPs for multiple peers. On Thu, Sep 6, 2018 at 12:15 PM < <mailto:danny.korpan@mailbox.org> danny.korpan@mailbox.org> wrote: Hi, I have the problem with my wireguard server, that only the latest user "peer" from the server config can route/ping to the internal wireguard server IP or the clients in the network behind the wireguard server upon successful connection. All peers can connect to the server, but only the latest in the list last can ping other servers. I can't locate the error in the configs... does anybody have an idea? My wireguard server and client version is using 0.0.20180809-wg1~xenial with Ubuntu 18.04.1 wg0.conf [Interface] Address = <http://192.168.50.1/24> 192.168.50.1/24 PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE ListenPort = 51820 PrivateKey = XXX [Peer] #User 1 PublicKey = XXX PresharedKey = XXX AllowedIPs = <http://192.168.50.0/24> 192.168.50.0/24 [Peer] #User 2 PublicKey = XXX PresharedKey = XXX #AllowedIPs = <http://192.168.50.0/24> 192.168.50.0/24 [Peer] #User 3 PublicKey = XXX PresharedKey = XXX AllowedIPs = <http://192.168.50.0/24> 192.168.50.0/24 [Peer] #User 4 PublicKey = XXX PresharedKey = XXX AllowedIPs = <http://192.168.50.0/24> 192.168.50.0/24 client.config [Interface] PrivateKey = XXX DNS = 192.168.178.1 Address = <http://192.168.50.2/24> 192.168.50.2/24 [Peer] PublicKey = XXX PresharedKey = XXX AllowedIPs = <http://192.168.50.0/24> 192.168.50.0/24, <http://190.168.178.0/24> 190.168.178.0/24 Endpoint = my.remote.server:51820 PersistentKeepalive = 25 My sysctl.conf includes net.ipv4.conf.all.proxy_arp = 1 net.ipv4.ip_forward = 1 Does anybody have an idea? Kind Regards, Danny _______________________________________________ WireGuard mailing list <mailto:WireGuard@lists.zx2c4.com> WireGuard@lists.zx2c4.com <https://lists.zx2c4.com/mailman/listinfo/wireguard> https://lists.zx2c4.com/mailman/listinfo/wireguard _______________________________________________ WireGuard mailing list WireGuard@lists.zx2c4.com <mailto:WireGuard@lists.zx2c4.com> https://lists.zx2c4.com/mailman/listinfo/wireguard [-- Attachment #2: Type: text/html, Size: 10894 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-09-08 17:28 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2018-08-29 7:43 Routing only to latest peer in the config list seems to work danny.korpan 2018-09-06 17:13 ` Ryan Whelan 2018-09-08 8:36 ` AW: " danny.korpan 2018-09-08 10:21 ` Steven Honson 2018-09-08 17:28 ` AW: " danny.korpan
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).