WireGuard Archive on lore.kernel.org
 help / color / Atom feed
From: "Ivan Labáth" <labawi-wg@matrix-dream.net>
To: Rich Brown <richb.hanover@gmail.com>
Cc: "Tomcsanyi, Domonkos" <domi@tomcsanyi.net>,
	Gunnar Niels <gunnar.s.niels@gmail.com>,
Subject: Re: Confused about AllowedIPs meaning?
Date: Wed, 29 Jul 2020 22:18:14 +0000
Message-ID: <20200729221814.GA32170@matrix-dream.net> (raw)
In-Reply-To: <ECF44AE9-A461-4252-8A33-B2A813280493@gmail.com>

On Tue, Jul 28, 2020 at 05:33:43PM -0400, Rich Brown wrote:
> AllowedIPs is the set of addresses that your WireGuard peer will send across the tunnel to its peer. 

The definition is close, but not precise. Assuming things haven't
changed much:

  AllowedIPs specifies the set of addresses that your WireGuard
host will send across the tunnel to its peer, and accept from
the peer.

AllowedIPs is not a set of addresses, but of networks, wherein
the peer with most specific match wins - as in a routing table.
Also, beware negations might not do what you expect.

Routing should work like so:

When a linux system is sending a packet, it first consults
the system routing table to choose the appropriate device.
Then, if the outgoing device is a wireguard tunnel, it
consults the routing table of the WG device to choose a peer.
WG device's routing table is constructed from peers' AllowedIPs.
When a peer is selected, the packet is encapsulated and sent
to the peer's latest enpoint. Then the system routing table
is again consulted, and hopefully a different outgoing device
is selected.

Note that the routing table is in fact a tree where the most
specific match wins - both the system one and wireguard's.
Also note that overlapping networks are allowed (e.g.,
and, but identical networks in a single WG device
are not allowed as neither would be more specific. The system
routing table would throw an error on such attempts, but wireguard
silently discards the old route keeping only the last one,
so you need to be careful here.

Such is basic routing. In more complicated scenarios:
 - routing rules select the routing table
 - iptables/nftables can change addresses, select devices, even clone packets
 - namespaces can nearly create an isolated network host/partition
and you can also have xfrm encapsulation, maybe vdevs do something..
All of this is either before the packet enters wireguard device
(where wireguard routing is done), and/or after the packet is
encapsulated/decapsulated (encrypted/decrypted) and processed again.

When a packet is received, the system may also check the routing
table for the source/peer address, and if the source device
doesn't match the routing table entry, the packet would be discarded
- so called reverse path filtering.
Initial lookup of the encapsulated packet source in the system
routing table is governed by the rp_filter setting.
When a packet is processed by wireguard, the inner, decapsulated
source is unconditionally checked for in the device routing table
and packet discarded if peer doesn't match - i.e. the peer's allowed
IPs must match, and also be the single most specific match.
After wireguard decapsulation, the inner packet is again processes
by the system, possibly checking the ips.


  parent reply index

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-26 10:57 Gunnar Niels
2020-07-28 16:30 ` Lonnie Abelbeck
2020-07-28 21:12 ` Tomcsanyi, Domonkos
2020-07-28 21:33   ` Rich Brown
2020-07-29 16:11     ` M Rubon
2020-07-29 16:27       ` Gunnar Niels
2020-07-29 22:18     ` Ivan Labáth [this message]
2020-07-30  0:57       ` Rich Brown
2020-07-30 14:02         ` M Rubon
2020-07-30 18:08           ` Ivan Labáth
2020-07-30 21:03             ` Rich Brown
2020-07-29 10:40 ` John Sager

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200729221814.GA32170@matrix-dream.net \
    --to=labawi-wg@matrix-dream.net \
    --cc=domi@tomcsanyi.net \
    --cc=gunnar.s.niels@gmail.com \
    --cc=richb.hanover@gmail.com \
    --cc=wireguard@lists.zx2c4.com \


* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
	public-inbox-index wireguard

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone https://public-inbox.org/public-inbox.git