NAT to NAT peers - 'EndPoint' IP data sharing among peers of the same key?

NAT to NAT peers - 'EndPoint' IP data sharing among peers of the same key?

[Giovanni Francesco]

Hi, I am looking to understand if "EndPoint" IP data may be shared among peers within the tunnel?

The question may sound confusing, let me explain my setup.

I have a static IPv4 wireguard server (let's call it "A" peer) which has two downstream WG clients peers "B" and "C" on remote networks with dynamic WAN IPs (roaming).
In my current configuration all my clients "B" and "C" have a single peer "A" - therefore all traffic must always go to "A" - "A" is in a datacenter in another country.

"B" and "C" have dynamic every changing IP "EndPoint" information, in my current setup this is not a problem because "A" is a static host.

If "B" and "C" are connected to "A" - is it possible for me to make B and C peers of eachother without "EndPoint" ?
In other words, if B public key is a peer of C and vise versa would its connection to "A" share the IP addresses ("EndPoint" or where to go) downstream to "B" and "C" so they can establish direct connectivity or would traffic always need to continue to traverse via "A"?

Thanks!

Re: NAT to NAT peers - 'EndPoint' IP data sharing among peers of the same key?

[Roman Mamedov]

On Sat, 3 Apr 2021 06:27:40 +0200
Giovanni Francesco <thelinuxguy@mail.com> wrote:

> Hi, I am looking to understand if "EndPoint" IP data may be shared among peers within the tunnel?
> 
> The question may sound confusing, let me explain my setup.
> 
> I have a static IPv4 wireguard server (let's call it "A" peer) which has two downstream WG clients peers "B" and "C" on remote networks with dynamic WAN IPs (roaming).
> In my current configuration all my clients "B" and "C" have a single peer "A" - therefore all traffic must always go to "A" - "A" is in a datacenter in another country.
> 
> "B" and "C" have dynamic every changing IP "EndPoint" information, in my current setup this is not a problem because "A" is a static host.
> 
> If "B" and "C" are connected to "A" - is it possible for me to make B and C peers of eachother without "EndPoint" ?
> In other words, if B public key is a peer of C and vise versa would its connection to "A" share the IP addresses ("EndPoint" or where to go) downstream to "B" and "C" so they can establish direct connectivity or would traffic always need to continue to traverse via "A"?

No, peer A will not tell peer B the current IP/port of peer C.

Check out other tools, for instance Tinc can do this, but not WG.

-- 
With respect,
Roman

Re: NAT to NAT peers - 'EndPoint' IP data sharing among peers of the same key?

[Ole-Morten Duesund]

On 07.04.2021 00:15, Roman Mamedov wrote:

> On Sat, 3 Apr 2021 06:27:40 +0200
> Giovanni Francesco <thelinuxguy@mail.com> wrote:
>
>> Hi, I am looking to understand if "EndPoint" IP data may be shared among peers within the tunnel?
>>
>> The question may sound confusing, let me explain my setup.
>>
>> I have a static IPv4 wireguard server (let's call it "A" peer) which has two downstream WG clients peers "B" and "C" on remote networks with dynamic WAN IPs (roaming).
>> In my current configuration all my clients "B" and "C" have a single peer "A" - therefore all traffic must always go to "A" - "A" is in a datacenter in another country.
>>
>> "B" and "C" have dynamic every changing IP "EndPoint" information, in my current setup this is not a problem because "A" is a static host.
>>
>> If "B" and "C" are connected to "A" - is it possible for me to make B and C peers of eachother without "EndPoint" ?
>> In other words, if B public key is a peer of C and vise versa would its connection to "A" share the IP addresses ("EndPoint" or where to go) downstream to "B" and "C" so they can establish direct connectivity or would traffic always need to continue to traverse via "A"?
> No, peer A will not tell peer B the current IP/port of peer C.
>
> Check out other tools, for instance Tinc can do this, but not WG.

There is also https://tailscale.com/blog/how-tailscale-works/ which does 
a bunch of magic to overcome NAT-problems.

My experience is that it works absolutely stunningly well.


- OM