From: PGNet Dev <pgnet.dev@gmail.com>
To: wireguard@lists.zx2c4.com
Subject: more specific routes for IPs added to "AllowedIPs =" ?
Date: Wed, 30 Sep 2020 15:42:19 -0700 [thread overview]
Message-ID: <8e81c9fc-b43c-235f-5c6a-335c736d9f5e@gmail.com> (raw)
I've two linux machines connected with wg.
Machine #1 is a remote VM, & connects to the public 'net.
Machine #2 is local, on my LAN.
To date, they've only routed internal traffic. Nice -n- easy.
I'm adding forwarding of specific EXTERNAL traffic from the 'net, received at Machine #1, to port-specific services, on the LAN.
E.g. a 'listener' on a local lan machine, @ ip 10.0.0.1 port 11111
On the local end of the VPN, for any external IP that needs to traverse the VPN link, adding the specific IP to
AllowedIPs = ... X.X.X.X
works. Traffic flows.
BUT, that adds a local route
X.X.X.X dev wg0 scope link
so ALL local traffic from local lan to that IP, e.g. an ssh session, gets routed BACK via that new route over the VPN.
I'd like to limit that -- so that ONLY traffic from the 'net to that local listener on ip 10.0.0.1 port 11111 is routed back via the VPN; all _other_ traffic to the originating IP (e.g., that ssh connection), gets routed over my normal default route.
What's the cleanest way -- in wireguard config -- to
(a) allow any/all IPs over the VPN
(b) limit the route to the specific ip target/port
So far, I seem to _need_ that originating IP in the "allowedips ="; which creates the 'overreaching' route ...
I'm guessing some judicious use of PostUp/Down routes set?
next reply other threads:[~2020-10-01 11:14 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-30 22:42 PGNet Dev [this message]
[not found] ` <CAHwJnhEt0=uBBNmtK2GtTrq-QRvvBMOxPwHu+yUJg=Pwm7g0wA@mail.gmail.com>
2020-10-01 14:38 ` more specific routes for IPs added to "AllowedIPs =" ? PGNet Dev
2020-10-01 16:51 ` Roman Mamedov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8e81c9fc-b43c-235f-5c6a-335c736d9f5e@gmail.com \
--to=pgnet.dev@gmail.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).