From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.7 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, HTML_MESSAGE,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,MIME_QP_LONG_LINE, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AEEEC3A5A1 for ; Sun, 25 Aug 2019 19:18:56 +0000 (UTC) Received: from krantz.zx2c4.com (krantz.zx2c4.com [192.95.5.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id C0ED62082F for ; Sun, 25 Aug 2019 19:18:55 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C0ED62082F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=pallas.us Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=wireguard-bounces@lists.zx2c4.com Received: from krantz.zx2c4.com (localhost [IPv6:::1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id a731aa8d; Sun, 25 Aug 2019 19:18:28 +0000 (UTC) Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 71d82049 for ; Sun, 25 Aug 2019 19:18:25 +0000 (UTC) Received: from telperion.info (2600:3c01::f03c:91ff:fe96:a052 [IPv6:2600:3c01::f03c:91ff:fe96:a052]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id b5347d39 for ; Sun, 25 Aug 2019 19:18:25 +0000 (UTC) Received: from [192.168.127.216] (184-23-8-77.dsl.static.fusionbroadband.com [::ffff:184.23.8.77]) (AUTH: LOGIN pallas, TLS: TLS1.2,256bits,ECDHE_RSA_AES_256_GCM_SHA384) by telperion.info with ESMTPSA id 0000000000046AB6.000000005D62DFA0.00003B8C; Sun, 25 Aug 2019 12:21:04 -0700 Mime-Version: 1.0 (1.0) Subject: Re: [Feature Request] Add ability to exclude subnets from AllowedIPs From: Derrick Lyndon Pallas X-Mailer: iPhone Mail (16G77) In-Reply-To: <5301677D-D6E6-4DBB-ADA0-89AFC2D277AE@icloud.com> Date: Sun, 25 Aug 2019 12:17:41 -0700 Message-Id: <47ECFF71-29D8-472B-98D3-C7BF72ADA7F7@pallas.us> References: <5301677D-D6E6-4DBB-ADA0-89AFC2D277AE@icloud.com> To: Aryn Starr Cc: wireguard@lists.zx2c4.com X-BeenThere: wireguard@lists.zx2c4.com X-Mailman-Version: 2.1.15 Precedence: list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============7882725213005794181==" Errors-To: wireguard-bounces@lists.zx2c4.com Sender: "WireGuard" --===============7882725213005794181== Content-Type: multipart/alternative; boundary=Apple-Mail-760005A2-4FAD-424F-BABD-445DBFF65E15 Content-Transfer-Encoding: 7bit --Apple-Mail-760005A2-4FAD-424F-BABD-445DBFF65E15 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Why wouldn't this happen as an iptables rule? If some AllowedIPs trick is working for you and you're using Python and the k= ernel version of Wireguard, check out [1], which will allow you to programma= tically set up the interface. FWIW, I'm not sure adding complication to AllowedIPs is the right approach, b= ut adding it to a tool seems reasonable. Maybe it also makes sense to allow a= n IPset, but I'm haven't thought it through. My gut says routing prior to Wi= reguard is probably what you're looking for. [1] https://github.com/ArgosyLabs/wgnlpy ~Derrick =E2=80=A2 iPhone > On Aug 22, 2019, at 12:10 PM, Aryn Starr wrote= : >=20 > I live in Iran, and here the internet censorship is fierce. I need to rout= e almost all of my traffic through the VPN, but some domestic sites are not a= ccessible from the US. Also, since ISPs apply different censoring rules, som= etimes my own servers are not reachable via the VPN (because the server=E2=80= =99s ISP blocks the VPN, while my local ISP does not.) > The best current solution I=E2=80=99ve seen is > ``` > $ python3 >=20 >>>> import ipaddress >>>> n1 =3D ipaddress.ip_network('106.203.202.0/23') >>>> n2 =3D ipaddress.ip_network('106.203.203.13/32') >>>> l =3D list(n1.address_exclude(n2)) >>>> print(l) >=20 > ``` > Which is terrible. > _______________________________________________ > WireGuard mailing list > WireGuard@lists.zx2c4.com > https://lists.zx2c4.com/mailman/listinfo/wireguard --Apple-Mail-760005A2-4FAD-424F-BABD-445DBFF65E15 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Why wouldn't this happen as an iptable= s rule?

If some AllowedIPs trick is working for you and y= ou're using Python and the kernel version of Wireguard, check out [1], which= will allow you to programmatically set up the interface.

FWIW, I'm not sure adding complication to AllowedIPs is the right approach,= but adding it to a tool seems reasonable. Maybe it also makes sense to allo= w an IPset, but I'm haven't thought it through. My gut says routing prior to= Wireguard is probably what you're looking for.

[1] = https://github.com/ArgosyLa= bs/wgnlpy

~Derrick&nbs= p;=E2=80=A2 iPhone

On Aug 22, 2019, at 12:10 PM, A= ryn Starr <whereislelouch@ic= loud.com> wrote:

I live in Iran, and here the internet censorship is fierce. I need= to route almost all of my traffic through the VPN, but some domestic sites a= re not accessible from the US. Also, since ISPs apply different censoring ru= les, sometimes my own servers are not reachable via the VPN (because the ser= ver=E2=80=99s ISP blocks the VPN, while my local ISP does not.)
The best current solution I=E2=80=99ve seen is
```
$ python3

import ipaddress
n1 =3D ipaddress.ip_ne= twork('106.203.202.0/23')
<= blockquote type=3D"cite">
n2 =3D ipaddress.ip_network('106.203.203.13/32')
l =3D list(n1.address_exclude(n2))
print(l)

```
Which is terrible.
_______________________________________= ________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://li= sts.zx2c4.com/mailman/listinfo/wireguard
= --Apple-Mail-760005A2-4FAD-424F-BABD-445DBFF65E15-- --===============7882725213005794181== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard --===============7882725213005794181==--