WireGuard Archive on lore.kernel.org
 help / color / Atom feed
From: David Kerr <david@kerr.net>
To: boerner@t-online.de
Cc: wireguard@lists.zx2c4.com
Subject: Re: Wireguard command line tools for Android
Date: Mon, 5 Aug 2019 17:28:41 -0400
Message-ID: <CAJJxGdF0y798ra2HwNZdJ_OpRnUG3H7Wb2bo7sWhLz0iK6fOKg@mail.gmail.com> (raw)
In-Reply-To: <5549622.se0SCevcK7@majestix.boerner.local>

[-- Attachment #1.1: Type: text/plain, Size: 2992 bytes --]

I assume you have set the client configs to connect to something like "
vpn.example.com:<port>" . How does DNS resolve this when inside your local
LAN?  Does it resolve to the same public IP address that your DSL router is
connected to, or does it resolve to an internal address like 192.168.1.1?

The way I have this working is to ensure that my VPN URL always resolves to
the external IP address, even when I am inside my home network.  To do that
I had to update my DNS server configuration to make sure that my VPN URL is
always resolved by an external DNS provider... I have my own custom network
gateway/router and set dnsmasq.static to include the line...

server=/vpn.example.com/8.8.8.8

Now this works for me because my wireguard server is running on my custom
gateway/router... no NAT forwarding to an internal host running wireguard.
If you are running wireguard on an internal server then you also need to
make sure that your firewall rules don't block connections to your external
interface from your local LAN and do the right NATing -- which is probably
not permitted by default.  I forget how to do this, but I'm sure google
will find some instructions.

David





On Mon, Aug 5, 2019 at 2:57 PM <boerner@t-online.de> wrote:

> Hey all,
>
> I've recently set up my private VPN with Wireguard. I am running my local
> server behind a DSL router with a variable public IP address, accessible
> via dyndns and NAT, and several mobile clients (Android, Notebooks).
> Everything is working fine so far, except of one issue that I would like
> discuss here:
> Roaming doesn't work reliably when a device leaves or re-enters the home
> LAN, nor when the public IP address is changed by my ISP. The reason seems
> clear to me: In these cases both peers change their IP address
> simultaneously whereas the Wireguard protocol relies on only one address
> changing at a time.
>
> My approach would be to shut down Wireguard on the clients as long as they
> are connected to their home network locally and to bring up the tunnel only
> when they leave the home network. Besides the roaming issue it  would be
> desirable to use the local connection when it is available rather than to
> take the detour over the internet. And it  should be done automatically so
> users need not remember to switch on/off VPN all the time.
> My idea was to use Tasker to perform something like wg-quick up|down tun1
> accordingly, but the Wireguard command line tools wg and wg-quick don't
> seem to be available (anymore). In older forum posts I've seen that you can
> install them from the app settings, but in my version (v0.0.20190708) this
> option is not available.
>
> Does anybody know about another solution? Or, as a question to the
> developers, would it be a big deal to bring back the command line feature?
>
> Thanks, Tom
>
>
>
>
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard
>

[-- Attachment #1.2: Type: text/html, Size: 4555 bytes --]

<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif">I assume you have set the client configs to connect to something like &quot;<a href="http://vpn.example.com">vpn.example.com</a>:&lt;port&gt;&quot; . How does DNS resolve this when inside your local LAN?  Does it resolve to the same public IP address that your DSL router is connected to, or does it resolve to an internal address like 192.168.1.1?</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">The way I have this working is to ensure that my VPN URL always resolves to the external IP address, even when I am inside my home network.  To do that I had to update my DNS server configuration to make sure that my VPN URL is always resolved by an external DNS provider... I have my own custom network gateway/router and set dnsmasq.static to include the line...</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">server=/<a href="http://vpn.example.com/8.8.8.8">vpn.example.com/8.8.8.8</a><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Now this works for me because my wireguard server is running on my custom gateway/router... no NAT forwarding to an internal host running wireguard.  If you are running wireguard on an internal server then you also need to make sure that your firewall rules don&#39;t block connections to your external interface from your local LAN and do the right NATing -- which is probably not permitted by default.  I forget how to do this, but I&#39;m sure google will find some instructions.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">David</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Aug 5, 2019 at 2:57 PM &lt;<a href="mailto:boerner@t-online.de">boerner@t-online.de</a>&gt; wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hey all,<br>
<br>
I&#39;ve recently set up my private VPN with Wireguard. I am running my local server behind a DSL router with a variable public IP address, accessible via dyndns and NAT, and several mobile clients (Android, Notebooks). <br>
Everything is working fine so far, except of one issue that I would like discuss here: <br>
Roaming doesn&#39;t work reliably when a device leaves or re-enters the home LAN, nor when the public IP address is changed by my ISP. The reason seems clear to me: In these cases both peers change their IP address simultaneously whereas the Wireguard protocol relies on only one address changing at a time.<br>
<br>
My approach would be to shut down Wireguard on the clients as long as they are connected to their home network locally and to bring up the tunnel only when they leave the home network. Besides the roaming issue it  would be desirable to use the local connection when it is available rather than to take the detour over the internet. And it  should be done automatically so users need not remember to switch on/off VPN all the time.<br>
My idea was to use Tasker to perform something like wg-quick up|down tun1 accordingly, but the Wireguard command line tools wg and wg-quick don&#39;t seem to be available (anymore). In older forum posts I&#39;ve seen that you can install them from the app settings, but in my version (v0.0.20190708) this option is not available.<br>
<br>
Does anybody know about another solution? Or, as a question to the developers, would it be a big deal to bring back the command line feature?<br>
<br>
Thanks, Tom<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
WireGuard mailing list<br>
<a href="mailto:WireGuard@lists.zx2c4.com" target="_blank">WireGuard@lists.zx2c4.com</a><br>
<a href="https://lists.zx2c4.com/mailman/listinfo/wireguard" rel="noreferrer" target="_blank">https://lists.zx2c4.com/mailman/listinfo/wireguard</a><br>
</blockquote></div>

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

  reply index

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-27 16:01 boerner
2019-08-05 21:28 ` David Kerr [this message]
2019-08-06  7:17   ` boerner
2019-08-06 12:33     ` David Kerr
2019-08-06 13:08       ` boerner
2019-08-06 13:18       ` Joachim Lindenberg
2019-08-07 10:52 ` Yağmur Oymak
2019-08-09  8:47   ` Thomas Börner
2019-08-09  8:52   ` Thomas Börner

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAJJxGdF0y798ra2HwNZdJ_OpRnUG3H7Wb2bo7sWhLz0iK6fOKg@mail.gmail.com \
    --to=david@kerr.net \
    --cc=boerner@t-online.de \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com zx2c4-wireguard@archiver.kernel.org
	public-inbox-index wireguard


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/ public-inbox