WireGuard Archive on lore.kernel.org
 help / color / Atom feed
* Routing only to latest peer in the config list seems to work
@ 2018-08-29  7:43 danny.korpan
  2018-09-06 17:13 ` Ryan Whelan
  0 siblings, 1 reply; 5+ messages in thread
From: danny.korpan @ 2018-08-29  7:43 UTC (permalink / raw)
  To: wireguard

Hi,

I have the problem with my wireguard server, that only the latest user
"peer" from the server config can route/ping to the internal wireguard
server IP or the clients in the network behind the wireguard server upon
successful connection. All peers can connect to the server, but only the
latest in the list last can ping other servers.
I can't locate the error in the configs... does anybody have an idea?

My wireguard server and client version is using 0.0.20180809-wg1~xenial with
Ubuntu 18.04.1

wg0.conf
[Interface]
Address = 192.168.50.1/24
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A
POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D
POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820
PrivateKey = XXX

[Peer]
#User 1
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24

[Peer]
#User 2
PublicKey = XXX
PresharedKey = XXX
#AllowedIPs = 192.168.50.0/24

[Peer]
#User 3
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24

[Peer]
#User 4
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24



client.config
[Interface]
PrivateKey = XXX
DNS = 192.168.178.1
Address = 192.168.50.2/24

[Peer]
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24, 190.168.178.0/24
Endpoint = my.remote.server:51820
PersistentKeepalive = 25

My sysctl.conf includes
net.ipv4.conf.all.proxy_arp = 1
net.ipv4.ip_forward = 1

Does anybody have an idea?


Kind Regards,
Danny

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: Routing only to latest peer in the config list seems to work
  2018-08-29  7:43 Routing only to latest peer in the config list seems to work danny.korpan
@ 2018-09-06 17:13 ` Ryan Whelan
  2018-09-08  8:36   ` AW: " danny.korpan
  0 siblings, 1 reply; 5+ messages in thread
From: Ryan Whelan @ 2018-09-06 17:13 UTC (permalink / raw)
  To: danny.korpan; +Cc: WireGuard mailing list

[-- Attachment #1: Type: text/plain, Size: 1891 bytes --]

You're using the same AllowedIPs for multiple peers.

On Thu, Sep 6, 2018 at 12:15 PM <danny.korpan@mailbox.org> wrote:

> Hi,
>
> I have the problem with my wireguard server, that only the latest user
> "peer" from the server config can route/ping to the internal wireguard
> server IP or the clients in the network behind the wireguard server upon
> successful connection. All peers can connect to the server, but only the
> latest in the list last can ping other servers.
> I can't locate the error in the configs... does anybody have an idea?
>
> My wireguard server and client version is using 0.0.20180809-wg1~xenial
> with
> Ubuntu 18.04.1
>
> wg0.conf
> [Interface]
> Address = 192.168.50.1/24
> PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A
> POSTROUTING -o eth0 -j MASQUERADE
> PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D
> POSTROUTING -o eth0 -j MASQUERADE
> ListenPort = 51820
> PrivateKey = XXX
>
> [Peer]
> #User 1
> PublicKey = XXX
> PresharedKey = XXX
> AllowedIPs = 192.168.50.0/24
>
> [Peer]
> #User 2
> PublicKey = XXX
> PresharedKey = XXX
> #AllowedIPs = 192.168.50.0/24
>
> [Peer]
> #User 3
> PublicKey = XXX
> PresharedKey = XXX
> AllowedIPs = 192.168.50.0/24
>
> [Peer]
> #User 4
> PublicKey = XXX
> PresharedKey = XXX
> AllowedIPs = 192.168.50.0/24
>
>
>
> client.config
> [Interface]
> PrivateKey = XXX
> DNS = 192.168.178.1
> Address = 192.168.50.2/24
>
> [Peer]
> PublicKey = XXX
> PresharedKey = XXX
> AllowedIPs = 192.168.50.0/24, 190.168.178.0/24
> Endpoint = my.remote.server:51820
> PersistentKeepalive = 25
>
> My sysctl.conf includes
> net.ipv4.conf.all.proxy_arp = 1
> net.ipv4.ip_forward = 1
>
> Does anybody have an idea?
>
>
> Kind Regards,
> Danny
>
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard
>

[-- Attachment #2: Type: text/html, Size: 3114 bytes --]

<div dir="ltr">You&#39;re using the same AllowedIPs for multiple peers.</div><br><div class="gmail_quote"><div dir="ltr">On Thu, Sep 6, 2018 at 12:15 PM &lt;<a href="mailto:danny.korpan@mailbox.org">danny.korpan@mailbox.org</a>&gt; wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
I have the problem with my wireguard server, that only the latest user<br>
&quot;peer&quot; from the server config can route/ping to the internal wireguard<br>
server IP or the clients in the network behind the wireguard server upon<br>
successful connection. All peers can connect to the server, but only the<br>
latest in the list last can ping other servers.<br>
I can&#39;t locate the error in the configs... does anybody have an idea?<br>
<br>
My wireguard server and client version is using 0.0.20180809-wg1~xenial with<br>
Ubuntu 18.04.1<br>
<br>
wg0.conf<br>
[Interface]<br>
Address = <a href="http://192.168.50.1/24" rel="noreferrer" target="_blank">192.168.50.1/24</a><br>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A<br>
POSTROUTING -o eth0 -j MASQUERADE<br>
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D<br>
POSTROUTING -o eth0 -j MASQUERADE<br>
ListenPort = 51820<br>
PrivateKey = XXX<br>
<br>
[Peer]<br>
#User 1<br>
PublicKey = XXX<br>
PresharedKey = XXX<br>
AllowedIPs = <a href="http://192.168.50.0/24" rel="noreferrer" target="_blank">192.168.50.0/24</a><br>
<br>
[Peer]<br>
#User 2<br>
PublicKey = XXX<br>
PresharedKey = XXX<br>
#AllowedIPs = <a href="http://192.168.50.0/24" rel="noreferrer" target="_blank">192.168.50.0/24</a><br>
<br>
[Peer]<br>
#User 3<br>
PublicKey = XXX<br>
PresharedKey = XXX<br>
AllowedIPs = <a href="http://192.168.50.0/24" rel="noreferrer" target="_blank">192.168.50.0/24</a><br>
<br>
[Peer]<br>
#User 4<br>
PublicKey = XXX<br>
PresharedKey = XXX<br>
AllowedIPs = <a href="http://192.168.50.0/24" rel="noreferrer" target="_blank">192.168.50.0/24</a><br>
<br>
<br>
<br>
client.config<br>
[Interface]<br>
PrivateKey = XXX<br>
DNS = 192.168.178.1<br>
Address = <a href="http://192.168.50.2/24" rel="noreferrer" target="_blank">192.168.50.2/24</a><br>
<br>
[Peer]<br>
PublicKey = XXX<br>
PresharedKey = XXX<br>
AllowedIPs = <a href="http://192.168.50.0/24" rel="noreferrer" target="_blank">192.168.50.0/24</a>, <a href="http://190.168.178.0/24" rel="noreferrer" target="_blank">190.168.178.0/24</a><br>
Endpoint = my.remote.server:51820<br>
PersistentKeepalive = 25<br>
<br>
My sysctl.conf includes<br>
net.ipv4.conf.all.proxy_arp = 1<br>
net.ipv4.ip_forward = 1<br>
<br>
Does anybody have an idea?<br>
<br>
<br>
Kind Regards,<br>
Danny<br>
<br>
_______________________________________________<br>
WireGuard mailing list<br>
<a href="mailto:WireGuard@lists.zx2c4.com" target="_blank">WireGuard@lists.zx2c4.com</a><br>
<a href="https://lists.zx2c4.com/mailman/listinfo/wireguard" rel="noreferrer" target="_blank">https://lists.zx2c4.com/mailman/listinfo/wireguard</a><br>
</blockquote></div>

^ permalink raw reply	[flat|nested] 5+ messages in thread

* AW: Routing only to latest peer in the config list seems to work
  2018-09-06 17:13 ` Ryan Whelan
@ 2018-09-08  8:36   ` " danny.korpan
  2018-09-08 10:21     ` Steven Honson
  0 siblings, 1 reply; 5+ messages in thread
From: danny.korpan @ 2018-09-08  8:36 UTC (permalink / raw)
  To: Ryan Whelan; +Cc: wireguard

[-- Attachment #1: Type: text/plain, Size: 2537 bytes --]

Hi,

 

I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing.

 

Kind Regards,

Danny

 

Von: Ryan Whelan <rcwhelan@gmail.com> 
Gesendet: Donnerstag, 6. September 2018 19:14
An: danny.korpan@mailbox.org
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
Betreff: Re: Routing only to latest peer in the config list seems to work

 

You're using the same AllowedIPs for multiple peers.

 

On Thu, Sep 6, 2018 at 12:15 PM <danny.korpan@mailbox.org <mailto:danny.korpan@mailbox.org> > wrote:

Hi,

I have the problem with my wireguard server, that only the latest user
"peer" from the server config can route/ping to the internal wireguard
server IP or the clients in the network behind the wireguard server upon
successful connection. All peers can connect to the server, but only the
latest in the list last can ping other servers.
I can't locate the error in the configs... does anybody have an idea?

My wireguard server and client version is using 0.0.20180809-wg1~xenial with
Ubuntu 18.04.1

wg0.conf
[Interface]
Address = 192.168.50.1/24 <http://192.168.50.1/24> 
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A
POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D
POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820
PrivateKey = XXX

[Peer]
#User 1
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> 

[Peer]
#User 2
PublicKey = XXX
PresharedKey = XXX
#AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> 

[Peer]
#User 3
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> 

[Peer]
#User 4
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> 



client.config
[Interface]
PrivateKey = XXX
DNS = 192.168.178.1
Address = 192.168.50.2/24 <http://192.168.50.2/24> 

[Peer]
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> , 190.168.178.0/24 <http://190.168.178.0/24> 
Endpoint = my.remote.server:51820
PersistentKeepalive = 25

My sysctl.conf includes
net.ipv4.conf.all.proxy_arp = 1
net.ipv4.ip_forward = 1

Does anybody have an idea?


Kind Regards,
Danny

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com <mailto:WireGuard@lists.zx2c4.com> 
https://lists.zx2c4.com/mailman/listinfo/wireguard


[-- Attachment #2: Type: text/html, Size: 6414 bytes --]

<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
	{mso-style-name:msonormal;
	mso-margin-top-alt:auto;
	margin-right:0cm;
	mso-margin-bottom-alt:auto;
	margin-left:0cm;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
span.E-MailFormatvorlage18
	{mso-style-type:personal-reply;
	font-family:"Arial",sans-serif;
	color:windowtext;
	font-weight:normal;
	font-style:normal;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri",sans-serif;
	mso-fareast-language:EN-US;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>Hi,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'><o:p>&nbsp;</o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'><o:p>&nbsp;</o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>Kind Regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>Danny<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'><o:p>&nbsp;</o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b>Von:</b> Ryan Whelan &lt;rcwhelan@gmail.com&gt; <br><b>Gesendet:</b> Donnerstag, 6. September 2018 19:14<br><b>An:</b> danny.korpan@mailbox.org<br><b>Cc:</b> WireGuard mailing list &lt;wireguard@lists.zx2c4.com&gt;<br><b>Betreff:</b> Re: Routing only to latest peer in the config list seems to work<o:p></o:p></p></div></div><p class=MsoNormal><o:p>&nbsp;</o:p></p><div><p class=MsoNormal>You're using the same AllowedIPs for multiple peers.<o:p></o:p></p></div><p class=MsoNormal><o:p>&nbsp;</o:p></p><div><div><p class=MsoNormal>On Thu, Sep 6, 2018 at 12:15 PM &lt;<a href="mailto:danny.korpan@mailbox.org">danny.korpan@mailbox.org</a>&gt; wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><p class=MsoNormal>Hi,<br><br>I have the problem with my wireguard server, that only the latest user<br>&quot;peer&quot; from the server config can route/ping to the internal wireguard<br>server IP or the clients in the network behind the wireguard server upon<br>successful connection. All peers can connect to the server, but only the<br>latest in the list last can ping other servers.<br>I can't locate the error in the configs... does anybody have an idea?<br><br>My wireguard server and client version is using 0.0.20180809-wg1~xenial with<br>Ubuntu 18.04.1<br><br>wg0.conf<br>[Interface]<br>Address = <a href="http://192.168.50.1/24" target="_blank">192.168.50.1/24</a><br>PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A<br>POSTROUTING -o eth0 -j MASQUERADE<br>PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D<br>POSTROUTING -o eth0 -j MASQUERADE<br>ListenPort = 51820<br>PrivateKey = XXX<br><br>[Peer]<br>#User 1<br>PublicKey = XXX<br>PresharedKey = XXX<br>AllowedIPs = <a href="http://192.168.50.0/24" target="_blank">192.168.50.0/24</a><br><br>[Peer]<br>#User 2<br>PublicKey = XXX<br>PresharedKey = XXX<br>#AllowedIPs = <a href="http://192.168.50.0/24" target="_blank">192.168.50.0/24</a><br><br>[Peer]<br>#User 3<br>PublicKey = XXX<br>PresharedKey = XXX<br>AllowedIPs = <a href="http://192.168.50.0/24" target="_blank">192.168.50.0/24</a><br><br>[Peer]<br>#User 4<br>PublicKey = XXX<br>PresharedKey = XXX<br>AllowedIPs = <a href="http://192.168.50.0/24" target="_blank">192.168.50.0/24</a><br><br><br><br>client.config<br>[Interface]<br>PrivateKey = XXX<br>DNS = 192.168.178.1<br>Address = <a href="http://192.168.50.2/24" target="_blank">192.168.50.2/24</a><br><br>[Peer]<br>PublicKey = XXX<br>PresharedKey = XXX<br>AllowedIPs = <a href="http://192.168.50.0/24" target="_blank">192.168.50.0/24</a>, <a href="http://190.168.178.0/24" target="_blank">190.168.178.0/24</a><br>Endpoint = my.remote.server:51820<br>PersistentKeepalive = 25<br><br>My sysctl.conf includes<br>net.ipv4.conf.all.proxy_arp = 1<br>net.ipv4.ip_forward = 1<br><br>Does anybody have an idea?<br><br><br>Kind Regards,<br>Danny<br><br>_______________________________________________<br>WireGuard mailing list<br><a href="mailto:WireGuard@lists.zx2c4.com" target="_blank">WireGuard@lists.zx2c4.com</a><br><a href="https://lists.zx2c4.com/mailman/listinfo/wireguard" target="_blank">https://lists.zx2c4.com/mailman/listinfo/wireguard</a><o:p></o:p></p></blockquote></div></div></div></body></html>

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: Routing only to latest peer in the config list seems to work
  2018-09-08  8:36   ` AW: " danny.korpan
@ 2018-09-08 10:21     ` Steven Honson
  2018-09-08 17:28       ` AW: " danny.korpan
  0 siblings, 1 reply; 5+ messages in thread
From: Steven Honson @ 2018-09-08 10:21 UTC (permalink / raw)
  To: danny.korpan; +Cc: wireguard

[-- Attachment #1: Type: text/plain, Size: 3459 bytes --]

Hi Danny,

Have you also changed the mask for each of the peers on your central node to /32? If not you’ll need to do this, as leaving them as /24 still effectively makes them all the same route. Ie 192.168.50.1/24 and 192.168.50.2/24 are both the same still. The “AllowedIPs" on the central node to be 192.168.50.1/32, 192.168.50.2/32 etc in your example.

You can leave the “Address” IPs with a /24 mask.

Are you able to share an updated copy of your configs?

Cheers,
Steven

> On 8 Sep 2018, at 6:36 pm, danny.korpan@mailbox.org wrote:
> 
> Hi,
>  
> I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing.
>  
> Kind Regards,
> Danny
>  
> Von: Ryan Whelan <rcwhelan@gmail.com> 
> Gesendet: Donnerstag, 6. September 2018 19:14
> An: danny.korpan@mailbox.org
> Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
> Betreff: Re: Routing only to latest peer in the config list seems to work
>  
> You're using the same AllowedIPs for multiple peers.
>  
> On Thu, Sep 6, 2018 at 12:15 PM <danny.korpan@mailbox.org <mailto:danny.korpan@mailbox.org>> wrote:
> Hi,
> 
> I have the problem with my wireguard server, that only the latest user
> "peer" from the server config can route/ping to the internal wireguard
> server IP or the clients in the network behind the wireguard server upon
> successful connection. All peers can connect to the server, but only the
> latest in the list last can ping other servers.
> I can't locate the error in the configs... does anybody have an idea?
> 
> My wireguard server and client version is using 0.0.20180809-wg1~xenial with
> Ubuntu 18.04.1
> 
> wg0.conf
> [Interface]
> Address = 192.168.50.1/24 <http://192.168.50.1/24>
> PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A
> POSTROUTING -o eth0 -j MASQUERADE
> PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D
> POSTROUTING -o eth0 -j MASQUERADE
> ListenPort = 51820
> PrivateKey = XXX
> 
> [Peer]
> #User 1
> PublicKey = XXX
> PresharedKey = XXX
> AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24>
> 
> [Peer]
> #User 2
> PublicKey = XXX
> PresharedKey = XXX
> #AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24>
> 
> [Peer]
> #User 3
> PublicKey = XXX
> PresharedKey = XXX
> AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24>
> 
> [Peer]
> #User 4
> PublicKey = XXX
> PresharedKey = XXX
> AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24>
> 
> 
> 
> client.config
> [Interface]
> PrivateKey = XXX
> DNS = 192.168.178.1
> Address = 192.168.50.2/24 <http://192.168.50.2/24>
> 
> [Peer]
> PublicKey = XXX
> PresharedKey = XXX
> AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24>, 190.168.178.0/24 <http://190.168.178.0/24>
> Endpoint = my.remote.server:51820
> PersistentKeepalive = 25
> 
> My sysctl.conf includes
> net.ipv4.conf.all.proxy_arp = 1
> net.ipv4.ip_forward = 1
> 
> Does anybody have an idea?
> 
> 
> Kind Regards,
> Danny
> 
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com <mailto:WireGuard@lists.zx2c4.com>
> https://lists.zx2c4.com/mailman/listinfo/wireguard <https://lists.zx2c4.com/mailman/listinfo/wireguard>_______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard


[-- Attachment #2: Type: text/html, Size: 12313 bytes --]

<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Danny,<div class=""><br class=""></div><div class="">Have you also changed the mask for each of the peers on your central node to /32? If not you’ll need to do this, as leaving them as /24 still effectively makes them all the same route. Ie 192.168.50.1/24 and 192.168.50.2/24 are both the same still. The “AllowedIPs" on the central node to be 192.168.50.1/32, 192.168.50.2/32 etc in your example.<br class=""><div><br class=""></div><div>You can leave the “Address” IPs with a /24 mask.</div><div><br class=""></div><div>Are you able to share an updated copy of your configs?</div><div><br class=""></div><div>Cheers,</div><div>Steven</div><div><br class=""><blockquote type="cite" class=""><div class="">On 8 Sep 2018, at 6:36 pm, <a href="mailto:danny.korpan@mailbox.org" class="">danny.korpan@mailbox.org</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif;" class="">Hi,<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif;" class=""><o:p class="">&nbsp;</o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif;" class="">I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif;" class=""><o:p class="">&nbsp;</o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif;" class="">Kind Regards,<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif;" class="">Danny<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif;" class=""><o:p class="">&nbsp;</o:p></span></div><div style="border-style: none none none solid; border-left-width: 1.5pt; border-left-color: blue; padding: 0cm 0cm 0cm 4pt;" class=""><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">Von:</b><span class="Apple-converted-space">&nbsp;</span>Ryan Whelan &lt;<a href="mailto:rcwhelan@gmail.com" class="">rcwhelan@gmail.com</a>&gt;<span class="Apple-converted-space">&nbsp;</span><br class=""><b class="">Gesendet:</b><span class="Apple-converted-space">&nbsp;</span>Donnerstag, 6. September 2018 19:14<br class=""><b class="">An:</b><span class="Apple-converted-space">&nbsp;</span><a href="mailto:danny.korpan@mailbox.org" class="">danny.korpan@mailbox.org</a><br class=""><b class="">Cc:</b><span class="Apple-converted-space">&nbsp;</span>WireGuard mailing list &lt;wireguard@lists.zx2c4.com&gt;<br class=""><b class="">Betreff:</b><span class="Apple-converted-space">&nbsp;</span>Re: Routing only to latest peer in the config list seems to work<o:p class=""></o:p></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class="">&nbsp;</o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">You're using the same AllowedIPs for multiple peers.<o:p class=""></o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class="">&nbsp;</o:p></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">On Thu, Sep 6, 2018 at 12:15 PM &lt;<a href="mailto:danny.korpan@mailbox.org" style="color: purple; text-decoration: underline;" class="">danny.korpan@mailbox.org</a>&gt; wrote:<o:p class=""></o:p></div></div><blockquote style="border-style: none none none solid; border-left-width: 1pt; border-left-color: rgb(204, 204, 204); padding: 0cm 0cm 0cm 6pt; margin-left: 4.8pt; margin-right: 0cm;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi,<br class=""><br class="">I have the problem with my wireguard server, that only the latest user<br class="">"peer" from the server config can route/ping to the internal wireguard<br class="">server IP or the clients in the network behind the wireguard server upon<br class="">successful connection. All peers can connect to the server, but only the<br class="">latest in the list last can ping other servers.<br class="">I can't locate the error in the configs... does anybody have an idea?<br class=""><br class="">My wireguard server and client version is using 0.0.20180809-wg1~xenial with<br class="">Ubuntu 18.04.1<br class=""><br class="">wg0.conf<br class="">[Interface]<br class="">Address =<span class="Apple-converted-space">&nbsp;</span><a href="http://192.168.50.1/24" target="_blank" style="color: purple; text-decoration: underline;" class="">192.168.50.1/24</a><br class="">PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A<br class="">POSTROUTING -o eth0 -j MASQUERADE<br class="">PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D<br class="">POSTROUTING -o eth0 -j MASQUERADE<br class="">ListenPort = 51820<br class="">PrivateKey = XXX<br class=""><br class="">[Peer]<br class="">#User 1<br class="">PublicKey = XXX<br class="">PresharedKey = XXX<br class="">AllowedIPs =<span class="Apple-converted-space">&nbsp;</span><a href="http://192.168.50.0/24" target="_blank" style="color: purple; text-decoration: underline;" class="">192.168.50.0/24</a><br class=""><br class="">[Peer]<br class="">#User 2<br class="">PublicKey = XXX<br class="">PresharedKey = XXX<br class="">#AllowedIPs =<span class="Apple-converted-space">&nbsp;</span><a href="http://192.168.50.0/24" target="_blank" style="color: purple; text-decoration: underline;" class="">192.168.50.0/24</a><br class=""><br class="">[Peer]<br class="">#User 3<br class="">PublicKey = XXX<br class="">PresharedKey = XXX<br class="">AllowedIPs =<span class="Apple-converted-space">&nbsp;</span><a href="http://192.168.50.0/24" target="_blank" style="color: purple; text-decoration: underline;" class="">192.168.50.0/24</a><br class=""><br class="">[Peer]<br class="">#User 4<br class="">PublicKey = XXX<br class="">PresharedKey = XXX<br class="">AllowedIPs =<span class="Apple-converted-space">&nbsp;</span><a href="http://192.168.50.0/24" target="_blank" style="color: purple; text-decoration: underline;" class="">192.168.50.0/24</a><br class=""><br class=""><br class=""><br class="">client.config<br class="">[Interface]<br class="">PrivateKey = XXX<br class="">DNS = 192.168.178.1<br class="">Address =<span class="Apple-converted-space">&nbsp;</span><a href="http://192.168.50.2/24" target="_blank" style="color: purple; text-decoration: underline;" class="">192.168.50.2/24</a><br class=""><br class="">[Peer]<br class="">PublicKey = XXX<br class="">PresharedKey = XXX<br class="">AllowedIPs =<span class="Apple-converted-space">&nbsp;</span><a href="http://192.168.50.0/24" target="_blank" style="color: purple; text-decoration: underline;" class="">192.168.50.0/24</a>,<span class="Apple-converted-space">&nbsp;</span><a href="http://190.168.178.0/24" target="_blank" style="color: purple; text-decoration: underline;" class="">190.168.178.0/24</a><br class="">Endpoint = my.remote.server:51820<br class="">PersistentKeepalive = 25<br class=""><br class="">My sysctl.conf includes<br class="">net.ipv4.conf.all.proxy_arp = 1<br class="">net.ipv4.ip_forward = 1<br class=""><br class="">Does anybody have an idea?<br class=""><br class=""><br class="">Kind Regards,<br class="">Danny<br class=""><br class="">_______________________________________________<br class="">WireGuard mailing list<br class=""><a href="mailto:WireGuard@lists.zx2c4.com" target="_blank" style="color: purple; text-decoration: underline;" class="">WireGuard@lists.zx2c4.com</a><br class=""><a href="https://lists.zx2c4.com/mailman/listinfo/wireguard" target="_blank" style="color: purple; text-decoration: underline;" class="">https://lists.zx2c4.com/mailman/listinfo/wireguard</a><o:p class=""></o:p></div></blockquote></div></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">WireGuard mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class=""><a href="mailto:WireGuard@lists.zx2c4.com" class="">WireGuard@lists.zx2c4.com</a></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class=""><a href="https://lists.zx2c4.com/mailman/listinfo/wireguard" class="">https://lists.zx2c4.com/mailman/listinfo/wireguard</a></span></div></blockquote></div><br class=""></div></body></html>

^ permalink raw reply	[flat|nested] 5+ messages in thread

* AW: Routing only to latest peer in the config list seems to work
  2018-09-08 10:21     ` Steven Honson
@ 2018-09-08 17:28       ` " danny.korpan
  0 siblings, 0 replies; 5+ messages in thread
From: danny.korpan @ 2018-09-08 17:28 UTC (permalink / raw)
  To: Steven Honson; +Cc: wireguard

[-- Attachment #1: Type: text/plain, Size: 3881 bytes --]

Hi,

 

your solution solved my problem: Chaning subnet to 32 instead of 24.

 

Thank you and kind regards,

Danny

 

Von: Steven Honson <steven@honson.id.au> 
Gesendet: Samstag, 8. September 2018 12:22
An: danny.korpan@mailbox.org
Cc: wireguard@lists.zx2c4.com
Betreff: Re: Routing only to latest peer in the config list seems to work

 

Hi Danny,

 

Have you also changed the mask for each of the peers on your central node to /32? If not you’ll need to do this, as leaving them as /24 still effectively makes them all the same route. Ie 192.168.50.1/24 and 192.168.50.2/24 are both the same still. The “AllowedIPs" on the central node to be 192.168.50.1/32, 192.168.50.2/32 etc in your example.

 

You can leave the “Address” IPs with a /24 mask.

 

Are you able to share an updated copy of your configs?

 

Cheers,

Steven





On 8 Sep 2018, at 6:36 pm, danny.korpan@mailbox.org <mailto:danny.korpan@mailbox.org>  wrote:

 

Hi,

 

I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing.

 

Kind Regards,

Danny

 

Von: Ryan Whelan <rcwhelan@gmail.com <mailto:rcwhelan@gmail.com> > 
Gesendet: Donnerstag, 6. September 2018 19:14
An: danny.korpan@mailbox.org <mailto:danny.korpan@mailbox.org> 
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com <mailto:wireguard@lists.zx2c4.com> >
Betreff: Re: Routing only to latest peer in the config list seems to work

 

You're using the same AllowedIPs for multiple peers.

 

On Thu, Sep 6, 2018 at 12:15 PM < <mailto:danny.korpan@mailbox.org> danny.korpan@mailbox.org> wrote:

Hi,

I have the problem with my wireguard server, that only the latest user
"peer" from the server config can route/ping to the internal wireguard
server IP or the clients in the network behind the wireguard server upon
successful connection. All peers can connect to the server, but only the
latest in the list last can ping other servers.
I can't locate the error in the configs... does anybody have an idea?

My wireguard server and client version is using 0.0.20180809-wg1~xenial with
Ubuntu 18.04.1

wg0.conf
[Interface]
Address =  <http://192.168.50.1/24> 192.168.50.1/24
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A
POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D
POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820
PrivateKey = XXX

[Peer]
#User 1
PublicKey = XXX
PresharedKey = XXX
AllowedIPs =  <http://192.168.50.0/24> 192.168.50.0/24

[Peer]
#User 2
PublicKey = XXX
PresharedKey = XXX
#AllowedIPs =  <http://192.168.50.0/24> 192.168.50.0/24

[Peer]
#User 3
PublicKey = XXX
PresharedKey = XXX
AllowedIPs =  <http://192.168.50.0/24> 192.168.50.0/24

[Peer]
#User 4
PublicKey = XXX
PresharedKey = XXX
AllowedIPs =  <http://192.168.50.0/24> 192.168.50.0/24



client.config
[Interface]
PrivateKey = XXX
DNS = 192.168.178.1
Address =  <http://192.168.50.2/24> 192.168.50.2/24

[Peer]
PublicKey = XXX
PresharedKey = XXX
AllowedIPs =  <http://192.168.50.0/24> 192.168.50.0/24,  <http://190.168.178.0/24> 190.168.178.0/24
Endpoint = my.remote.server:51820
PersistentKeepalive = 25

My sysctl.conf includes
net.ipv4.conf.all.proxy_arp = 1
net.ipv4.ip_forward = 1

Does anybody have an idea?


Kind Regards,
Danny

_______________________________________________
WireGuard mailing list
 <mailto:WireGuard@lists.zx2c4.com> WireGuard@lists.zx2c4.com
 <https://lists.zx2c4.com/mailman/listinfo/wireguard> https://lists.zx2c4.com/mailman/listinfo/wireguard

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com <mailto:WireGuard@lists.zx2c4.com> 
https://lists.zx2c4.com/mailman/listinfo/wireguard

 


[-- Attachment #2: Type: text/html, Size: 10894 bytes --]

<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Helvetica;
	panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
	{mso-style-name:msonormal;
	mso-margin-top-alt:auto;
	margin-right:0cm;
	mso-margin-bottom-alt:auto;
	margin-left:0cm;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
span.apple-converted-space
	{mso-style-name:apple-converted-space;}
span.E-MailFormatvorlage20
	{mso-style-type:personal-reply;
	font-family:"Arial",sans-serif;
	color:windowtext;
	font-weight:normal;
	font-style:normal;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>Hi,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'><o:p>&nbsp;</o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>your solution solved my problem: Chaning subnet to 32 instead of 24.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'><o:p>&nbsp;</o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>Thank you and kind regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'>Danny<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-US'><o:p>&nbsp;</o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b>Von:</b> Steven Honson &lt;steven@honson.id.au&gt; <br><b>Gesendet:</b> Samstag, 8. September 2018 12:22<br><b>An:</b> danny.korpan@mailbox.org<br><b>Cc:</b> wireguard@lists.zx2c4.com<br><b>Betreff:</b> Re: Routing only to latest peer in the config list seems to work<o:p></o:p></p></div></div><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>Hi Danny,<o:p></o:p></p><div><p class=MsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=MsoNormal>Have you also changed the mask for each of the peers on your central node to /32? If not you’ll need to do this, as leaving them as /24 still effectively makes them all the same route. Ie 192.168.50.1/24 and 192.168.50.2/24 are both the same still. The “AllowedIPs&quot; on the central node to be 192.168.50.1/32, 192.168.50.2/32 etc in your example.<o:p></o:p></p><div><p class=MsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=MsoNormal>You can leave the “Address” IPs with a /24 mask.<o:p></o:p></p></div><div><p class=MsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=MsoNormal>Are you able to share an updated copy of your configs?<o:p></o:p></p></div><div><p class=MsoNormal><o:p>&nbsp;</o:p></p></div><div><p class=MsoNormal>Cheers,<o:p></o:p></p></div><div><p class=MsoNormal>Steven<o:p></o:p></p></div><div><p class=MsoNormal><br><br><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal>On 8 Sep 2018, at 6:36 pm, <a href="mailto:danny.korpan@mailbox.org">danny.korpan@mailbox.org</a> wrote:<o:p></o:p></p></div><p class=MsoNormal><o:p>&nbsp;</o:p></p><div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif'>Hi,</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif'>&nbsp;</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif'>I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing.</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif'>&nbsp;</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif'>Kind Regards,</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif'>Danny</span><o:p></o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif'>&nbsp;</span><o:p></o:p></p></div><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><div><p class=MsoNormal><b>Von:</b><span class=apple-converted-space>&nbsp;</span>Ryan Whelan &lt;<a href="mailto:rcwhelan@gmail.com">rcwhelan@gmail.com</a>&gt;<span class=apple-converted-space>&nbsp;</span><br><b>Gesendet:</b><span class=apple-converted-space>&nbsp;</span>Donnerstag, 6. September 2018 19:14<br><b>An:</b><span class=apple-converted-space>&nbsp;</span><a href="mailto:danny.korpan@mailbox.org">danny.korpan@mailbox.org</a><br><b>Cc:</b><span class=apple-converted-space>&nbsp;</span>WireGuard mailing list &lt;<a href="mailto:wireguard@lists.zx2c4.com">wireguard@lists.zx2c4.com</a>&gt;<br><b>Betreff:</b><span class=apple-converted-space>&nbsp;</span>Re: Routing only to latest peer in the config list seems to work<o:p></o:p></p></div></div></div><div><p class=MsoNormal>&nbsp;<o:p></o:p></p></div><div><div><p class=MsoNormal>You're using the same AllowedIPs for multiple peers.<o:p></o:p></p></div></div><div><p class=MsoNormal>&nbsp;<o:p></o:p></p></div><div><div><div><p class=MsoNormal>On Thu, Sep 6, 2018 at 12:15 PM &lt;<a href="mailto:danny.korpan@mailbox.org"><span style='color:purple'>danny.korpan@mailbox.org</span></a>&gt; wrote:<o:p></o:p></p></div></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt'><div><p class=MsoNormal>Hi,<br><br>I have the problem with my wireguard server, that only the latest user<br>&quot;peer&quot; from the server config can route/ping to the internal wireguard<br>server IP or the clients in the network behind the wireguard server upon<br>successful connection. All peers can connect to the server, but only the<br>latest in the list last can ping other servers.<br>I can't locate the error in the configs... does anybody have an idea?<br><br>My wireguard server and client version is using 0.0.20180809-wg1~xenial with<br>Ubuntu 18.04.1<br><br>wg0.conf<br>[Interface]<br>Address =<span class=apple-converted-space>&nbsp;</span><a href="http://192.168.50.1/24" target="_blank"><span style='color:purple'>192.168.50.1/24</span></a><br>PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A<br>POSTROUTING -o eth0 -j MASQUERADE<br>PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D<br>POSTROUTING -o eth0 -j MASQUERADE<br>ListenPort = 51820<br>PrivateKey = XXX<br><br>[Peer]<br>#User 1<br>PublicKey = XXX<br>PresharedKey = XXX<br>AllowedIPs =<span class=apple-converted-space>&nbsp;</span><a href="http://192.168.50.0/24" target="_blank"><span style='color:purple'>192.168.50.0/24</span></a><br><br>[Peer]<br>#User 2<br>PublicKey = XXX<br>PresharedKey = XXX<br>#AllowedIPs =<span class=apple-converted-space>&nbsp;</span><a href="http://192.168.50.0/24" target="_blank"><span style='color:purple'>192.168.50.0/24</span></a><br><br>[Peer]<br>#User 3<br>PublicKey = XXX<br>PresharedKey = XXX<br>AllowedIPs =<span class=apple-converted-space>&nbsp;</span><a href="http://192.168.50.0/24" target="_blank"><span style='color:purple'>192.168.50.0/24</span></a><br><br>[Peer]<br>#User 4<br>PublicKey = XXX<br>PresharedKey = XXX<br>AllowedIPs =<span class=apple-converted-space>&nbsp;</span><a href="http://192.168.50.0/24" target="_blank"><span style='color:purple'>192.168.50.0/24</span></a><br><br><br><br>client.config<br>[Interface]<br>PrivateKey = XXX<br>DNS = 192.168.178.1<br>Address =<span class=apple-converted-space>&nbsp;</span><a href="http://192.168.50.2/24" target="_blank"><span style='color:purple'>192.168.50.2/24</span></a><br><br>[Peer]<br>PublicKey = XXX<br>PresharedKey = XXX<br>AllowedIPs =<span class=apple-converted-space>&nbsp;</span><a href="http://192.168.50.0/24" target="_blank"><span style='color:purple'>192.168.50.0/24</span></a>,<span class=apple-converted-space>&nbsp;</span><a href="http://190.168.178.0/24" target="_blank"><span style='color:purple'>190.168.178.0/24</span></a><br>Endpoint = my.remote.server:51820<br>PersistentKeepalive = 25<br><br>My sysctl.conf includes<br>net.ipv4.conf.all.proxy_arp = 1<br>net.ipv4.ip_forward = 1<br><br>Does anybody have an idea?<br><br><br>Kind Regards,<br>Danny<br><br>_______________________________________________<br>WireGuard mailing list<br><a href="mailto:WireGuard@lists.zx2c4.com" target="_blank"><span style='color:purple'>WireGuard@lists.zx2c4.com</span></a><br><a href="https://lists.zx2c4.com/mailman/listinfo/wireguard" target="_blank"><span style='color:purple'>https://lists.zx2c4.com/mailman/listinfo/wireguard</span></a><o:p></o:p></p></div></blockquote></div></div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif'>_______________________________________________<br>WireGuard mailing list<br><a href="mailto:WireGuard@lists.zx2c4.com">WireGuard@lists.zx2c4.com</a><br><a href="https://lists.zx2c4.com/mailman/listinfo/wireguard">https://lists.zx2c4.com/mailman/listinfo/wireguard</a></span><o:p></o:p></p></div></blockquote></div><p class=MsoNormal><o:p>&nbsp;</o:p></p></div></div></div></body></html>

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, back to index

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-08-29  7:43 Routing only to latest peer in the config list seems to work danny.korpan
2018-09-06 17:13 ` Ryan Whelan
2018-09-08  8:36   ` AW: " danny.korpan
2018-09-08 10:21     ` Steven Honson
2018-09-08 17:28       ` AW: " danny.korpan

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com zx2c4-wireguard@archiver.kernel.org
	public-inbox-index wireguard


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/ public-inbox