WireGuard Archive on lore.kernel.org
 help / color / Atom feed
* WireGuard as gateway; excluding private IPs
@ 2019-06-08  8:02 Yeri Tiete
  0 siblings, 0 replies; only message in thread
From: Yeri Tiete @ 2019-06-08  8:02 UTC (permalink / raw)
  To: wireguard

[-- Attachment #1.1.1: Type: text/plain, Size: 1488 bytes --]

This is a personal project after hitting a wall for the Nth time with the
GFW. Where oVPN gets RST or otherwise blocked, it seems WG is still able to
by-pass the firewall.

I was playing around with a couple of devices; routing everything through
WG except for LAN, plus have my devices auto connect no matter where I am.

I can select to exclude private IPs and it'll update 0.0.0.0/0 to include
only public IPs. This seems to be working fine on Android: WG connects,
there's a handshake, traffic gets routed through WG gateway, and I am still
able to connect to my local network devices.

On OSX and iOS on the other hand, once I select *exclude private IPs* the
handshake fails and WG doesn't connect. No traffic gets routed and my
devices can't connect until I turn off WG.

On the other hand -- if I don't select *exclude private IPs,* on iOS and
OSX I can still access LAN IPs just fine -- but on Android that doesn't
work.

In all cases the official app is used.

Any clue why there's a difference? The server address is a public IP.

That being said I seem to be able to make it work -- it's just that the
behaviour is different.

One more thing:

Android doesn't have a feature to connect on-demand the same way iOS and
OSX do. Is this a limitation of Android? Ie I can select it to be
always-on, but the options are not as granular as iOS where I can define to
be on for Cell, WiFi and define the SSIDs.

Thanks,
Yeri Tiete | Corp Ops Engineer | yeri@google.com | +65 9225 0750

[-- Attachment #1.1.2: Type: text/html, Size: 3791 bytes --]

<div dir="ltr"><div>This is a personal project after hitting a wall for the Nth time with the GFW. Where oVPN gets RST or otherwise blocked, it seems WG is still able to by-pass the firewall.</div><div><br></div><div>I was playing around with a couple of devices; routing everything through WG except for LAN, plus have my devices auto connect no matter where I am. <br></div><div><br></div><div>I can select to exclude private IPs and it&#39;ll update <a href="http://0.0.0.0/0">0.0.0.0/0</a> to include only public IPs. This seems to be working fine on Android: WG connects, there&#39;s a handshake, traffic gets routed through WG gateway, and I am still able to connect to my local network devices. <br></div><div><br></div><div>On OSX and iOS on the other hand, once I select <i>exclude private IPs</i> the handshake fails and WG doesn&#39;t connect. No traffic gets routed and my devices can&#39;t connect until I turn off WG. <br></div><div><br></div><div>On the other hand -- if I don&#39;t select <i>exclude private IPs,</i> on iOS and OSX I can still access LAN IPs just fine -- but on Android that doesn&#39;t work. <br></div><div><br></div><div>In all cases the official app is used.</div><div><br></div><div>Any clue why there&#39;s a difference? The server address is a public IP. <br></div><div><br></div><div>That being said I seem to be able to make it work -- it&#39;s just that the behaviour is different. <br></div><div><br></div><div>One more thing:<br></div><div><br></div><div>Android doesn&#39;t have a feature to connect on-demand the same way iOS and OSX do. Is this a limitation of Android? Ie I can select it to be always-on, but the options are not as granular as iOS where I can define to be on for Cell, WiFi and define the SSIDs. <br></div><div><br></div><div>Thanks, <br></div><div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div style="line-height:1.5em;padding-top:10px;margin-top:10px;color:rgb(85,85,85);font-family:sans-serif"><span style="border-top-width:2px;border-right-width:0px;border-bottom-width:0px;border-left-width:0px;border-top-style:solid;border-right-style:solid;border-bottom-style:solid;border-left-style:solid;border-top-color:rgb(213,15,37);border-right-color:rgb(213,15,37);border-bottom-color:rgb(213,15,37);border-left-color:rgb(213,15,37);padding-top:2px;margin-top:2px">Yeri Tiete |</span><span style="border-top-width:2px;border-right-width:0px;border-bottom-width:0px;border-left-width:0px;border-top-style:solid;border-right-style:solid;border-bottom-style:solid;border-left-style:solid;border-top-color:rgb(51,105,232);border-right-color:rgb(51,105,232);border-bottom-color:rgb(51,105,232);border-left-color:rgb(51,105,232);padding-top:2px;margin-top:2px"> Corp Ops Engineer </span><span style="border-top-width:2px;border-right-width:0px;border-bottom-width:0px;border-left-width:0px;border-top-style:solid;border-right-style:solid;border-bottom-style:solid;border-left-style:solid;border-top-color:rgb(0,153,57);border-right-color:rgb(0,153,57);border-bottom-color:rgb(0,153,57);border-left-color:rgb(0,153,57);padding-top:2px;margin-top:2px">| <a href="mailto:yeri@google.com" target="_blank">yeri@google.com</a> |</span><span style="border-top-width:2px;border-right-width:0px;border-bottom-width:0px;border-left-width:0px;border-top-style:solid;border-right-style:solid;border-bottom-style:solid;border-left-style:solid;border-top-color:rgb(238,178,17);border-right-color:rgb(238,178,17);border-bottom-color:rgb(238,178,17);border-left-color:rgb(238,178,17);padding-top:2px;margin-top:2px"> +65 9225 0750</span></div></div></div></div></div></div></div></div></div></div></div></div></div></div>

[-- Attachment #1.2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4839 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-08  8:02 WireGuard as gateway; excluding private IPs Yeri Tiete

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com zx2c4-wireguard@archiver.kernel.org
	public-inbox-index wireguard


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/ public-inbox