WireGuard Archive on lore.kernel.org
 help / color / Atom feed
From: Yeri Tiete <yeri@google.com>
To: wireguard@lists.zx2c4.com
Subject: WireGuard as gateway; excluding private IPs
Date: Sat, 8 Jun 2019 16:02:02 +0800
Message-ID: <CAKDvA6JSXfjSUF3iwxorKWW9ogkf-MZtX-A+btTyqEE1++M+ow@mail.gmail.com> (raw)

[-- Attachment #1.1.1: Type: text/plain, Size: 1488 bytes --]

This is a personal project after hitting a wall for the Nth time with the
GFW. Where oVPN gets RST or otherwise blocked, it seems WG is still able to
by-pass the firewall.

I was playing around with a couple of devices; routing everything through
WG except for LAN, plus have my devices auto connect no matter where I am.

I can select to exclude private IPs and it'll update 0.0.0.0/0 to include
only public IPs. This seems to be working fine on Android: WG connects,
there's a handshake, traffic gets routed through WG gateway, and I am still
able to connect to my local network devices.

On OSX and iOS on the other hand, once I select *exclude private IPs* the
handshake fails and WG doesn't connect. No traffic gets routed and my
devices can't connect until I turn off WG.

On the other hand -- if I don't select *exclude private IPs,* on iOS and
OSX I can still access LAN IPs just fine -- but on Android that doesn't
work.

In all cases the official app is used.

Any clue why there's a difference? The server address is a public IP.

That being said I seem to be able to make it work -- it's just that the
behaviour is different.

One more thing:

Android doesn't have a feature to connect on-demand the same way iOS and
OSX do. Is this a limitation of Android? Ie I can select it to be
always-on, but the options are not as granular as iOS where I can define to
be on for Cell, WiFi and define the SSIDs.

Thanks,
Yeri Tiete | Corp Ops Engineer | yeri@google.com | +65 9225 0750

[-- Attachment #1.1.2: Type: text/html, Size: 3791 bytes --]

<div dir="ltr"><div>This is a personal project after hitting a wall for the Nth time with the GFW. Where oVPN gets RST or otherwise blocked, it seems WG is still able to by-pass the firewall.</div><div><br></div><div>I was playing around with a couple of devices; routing everything through WG except for LAN, plus have my devices auto connect no matter where I am. <br></div><div><br></div><div>I can select to exclude private IPs and it&#39;ll update <a href="http://0.0.0.0/0">0.0.0.0/0</a> to include only public IPs. This seems to be working fine on Android: WG connects, there&#39;s a handshake, traffic gets routed through WG gateway, and I am still able to connect to my local network devices. <br></div><div><br></div><div>On OSX and iOS on the other hand, once I select <i>exclude private IPs</i> the handshake fails and WG doesn&#39;t connect. No traffic gets routed and my devices can&#39;t connect until I turn off WG. <br></div><div><br></div><div>On the other hand -- if I don&#39;t select <i>exclude private IPs,</i> on iOS and OSX I can still access LAN IPs just fine -- but on Android that doesn&#39;t work. <br></div><div><br></div><div>In all cases the official app is used.</div><div><br></div><div>Any clue why there&#39;s a difference? The server address is a public IP. <br></div><div><br></div><div>That being said I seem to be able to make it work -- it&#39;s just that the behaviour is different. <br></div><div><br></div><div>One more thing:<br></div><div><br></div><div>Android doesn&#39;t have a feature to connect on-demand the same way iOS and OSX do. Is this a limitation of Android? Ie I can select it to be always-on, but the options are not as granular as iOS where I can define to be on for Cell, WiFi and define the SSIDs. <br></div><div><br></div><div>Thanks, <br></div><div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div style="line-height:1.5em;padding-top:10px;margin-top:10px;color:rgb(85,85,85);font-family:sans-serif"><span style="border-top-width:2px;border-right-width:0px;border-bottom-width:0px;border-left-width:0px;border-top-style:solid;border-right-style:solid;border-bottom-style:solid;border-left-style:solid;border-top-color:rgb(213,15,37);border-right-color:rgb(213,15,37);border-bottom-color:rgb(213,15,37);border-left-color:rgb(213,15,37);padding-top:2px;margin-top:2px">Yeri Tiete |</span><span style="border-top-width:2px;border-right-width:0px;border-bottom-width:0px;border-left-width:0px;border-top-style:solid;border-right-style:solid;border-bottom-style:solid;border-left-style:solid;border-top-color:rgb(51,105,232);border-right-color:rgb(51,105,232);border-bottom-color:rgb(51,105,232);border-left-color:rgb(51,105,232);padding-top:2px;margin-top:2px"> Corp Ops Engineer </span><span style="border-top-width:2px;border-right-width:0px;border-bottom-width:0px;border-left-width:0px;border-top-style:solid;border-right-style:solid;border-bottom-style:solid;border-left-style:solid;border-top-color:rgb(0,153,57);border-right-color:rgb(0,153,57);border-bottom-color:rgb(0,153,57);border-left-color:rgb(0,153,57);padding-top:2px;margin-top:2px">| <a href="mailto:yeri@google.com" target="_blank">yeri@google.com</a> |</span><span style="border-top-width:2px;border-right-width:0px;border-bottom-width:0px;border-left-width:0px;border-top-style:solid;border-right-style:solid;border-bottom-style:solid;border-left-style:solid;border-top-color:rgb(238,178,17);border-right-color:rgb(238,178,17);border-bottom-color:rgb(238,178,17);border-left-color:rgb(238,178,17);padding-top:2px;margin-top:2px"> +65 9225 0750</span></div></div></div></div></div></div></div></div></div></div></div></div></div></div>

[-- Attachment #1.2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4839 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

                 reply index

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAKDvA6JSXfjSUF3iwxorKWW9ogkf-MZtX-A+btTyqEE1++M+ow@mail.gmail.com \
    --to=yeri@google.com \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com zx2c4-wireguard@archiver.kernel.org
	public-inbox-index wireguard


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/ public-inbox