WireGuard Archive on lore.kernel.org
 help / color / Atom feed
* Wireguard wg-quick defaults conflict with Kubernetes firewall
@ 2020-09-27 16:22 Sebastian Rose
  0 siblings, 0 replies; only message in thread
From: Sebastian Rose @ 2020-09-27 16:22 UTC (permalink / raw)
  To: wireguard


wg-quick in its default configuration causes routing conflicts when the same host is also running a kubernetes
master node. The issue seems to be how wg-quick marks the traffic to route to the Wireguard peer: 
This leads to a loss of network connectivity when Kubernetes and Wireguard are running simultaneously on the
same host.

wg-quick (when not instructed otherwise) generates an wg0 interface like this:

> interface: wg0
>   public key: [REMOVED]
>   private key: (hidden)
>   listening port: 37827
>   fwmark: 0xca6c
> peer: [REMOVED]
>   endpoint: [IPV4]:51820
>   allowed ips:, ::/0
>   latest handshake: 1 minute, 21 seconds ago
>   transfer: 161.54 KiB received, 185.11 KiB sent

Additionally, the following routing rule gets created
> rule 32765:	not from all fwmark 0xca6c lookup 51820

> # ip route show table 51820
> default dev wg0 scope link

This got created with the following configuration:

> # wg showconf wg0
> [Interface]
> ListenPort = 36768
> FwMark = 0xca6c
> PrivateKey = [REMOVED]
> [Peer]
> PublicKey = [REMOVED]
> AllowedIPs =, ::/0
> Endpoint = [IPV4]:51820

As part of a kubernetes installation, the following firewall rules get added:

> # iptables -L KUBE-FIREWALL
> Chain KUBE-FIREWALL (2 references)
> target     prot opt source               destination         
> DROP       all  -- !          /* block incoming localnet connections */ ! ctstate RELATED,ESTABLISHED,DNAT
> DROP       all  --  anywhere             anywhere             /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

As far as I can tell, Wireguard marks its traffic with 0xca6c and Kubernetes wants to drop traffic that's
marked 0x8000. Since 0xca6c ∧ 0x8000 = 0x8000 all Wireguard traffic gets dropped and there is no network

Proposed solution:

Change FwMark in the [Interface] section of the wg0.conf to something like

> FwMark = 0x4a6c

This will cause the kubernetes firewall not to conflict anymore with the defaults of wg-quick.


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-27 16:22 Wireguard wg-quick defaults conflict with Kubernetes firewall Sebastian Rose

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
	public-inbox-index wireguard

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone https://public-inbox.org/public-inbox.git