WireGuard Archive on lore.kernel.org
 help / color / Atom feed
From: Reid Rankin <reidrankin@gmail.com>
To: John huttley <john@mib-infotech.co.nz>
Cc: wireguard@lists.zx2c4.com
Subject: Re: Port dependent issues on iOS 13
Date: Wed, 25 Sep 2019 20:13:43 -0400
Message-ID: <CAMaqUZ2wFdWUcjCK8WMtkitGci6m92_s7ZNBdMD_8CKKykuW0Q@mail.gmail.com> (raw)
In-Reply-To: <bd2be5bf-13c6-8c38-e4e1-705fcfa98f73@mib-infotech.co.nz>

[-- Attachment #1.1: Type: text/plain, Size: 1740 bytes --]

FWIW, all those ports (4500, 1500, 500) seem to work for me with iOS 13 and
WireGuard for iOS build 0.0.20190610 (13).

On Wed, Sep 25, 2019 at 6:03 PM John huttley <john@mib-infotech.co.nz>
wrote:

> Hi,
>
> Port  4500 is the IPSec UDP nat port and 500 is IKE.
>
> Anyconnect uses ISPEC so I think those ports are simply in use.
>
>
> --John
> On 24/09/19 9:36 PM, wireguard@p-np.de wrote:
>
> Hello,
>
> in place upgrades from iOS 12 -> iOS 13 (release) seem to work well in
> general. But there is a bizarre issue depending on *remote* endpoint
> ports. If you have, in my case, 4500/UDP configured as remote endpoint the
> tunnel does not send or receive traffic. Changing it to any other port
> works. Changing back to 4500/UDP breaks it again reproducibly. For others,
> documented here
> <https://www.reddit.com/r/WireGuard/comments/d6in39/wg_broken_on_ios_13/> ,
> it is 1500/UDP, in #WireGuard there has been a documented issue for 500/UDP
> not working.
>
> I have AnyConnect installed in parallel and checked, whether that's
> related. But removing and resetting Network settings did not fix port 4500
> for me.
>
> As there is no port number dependent branching in the WireGuard-iOS code
> base, this is likely an iOS regression. Does any one of you have a working
> channel to Apple to report this?
>
> Thank you for an else excellent product. Let me know if I can be of any
> help.
>
> Best regards,
>
> Christian
>
> _______________________________________________
> WireGuard mailing listWireGuard@lists.zx2c4.comhttps://lists.zx2c4.com/mailman/listinfo/wireguard
>
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard
>

[-- Attachment #1.2: Type: text/html, Size: 3188 bytes --]

<div><div dir="auto">FWIW, all those ports (4500, 1500, 500) seem to work for me with iOS 13 and WireGuard for iOS build 0.0.20190610 (13).</div></div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 25, 2019 at 6:03 PM John huttley &lt;<a href="mailto:john@mib-infotech.co.nz">john@mib-infotech.co.nz</a>&gt; wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div text="#000000" bgcolor="#FFFFFF">
    <p>Hi, <br>
    </p>
    <p>Port  4500 is the IPSec UDP nat port and 500 is IKE.</p>
    <p>Anyconnect uses ISPEC so I think those ports are simply in use.</p></div><div text="#000000" bgcolor="#FFFFFF">
    <p><br>
    </p>
    <p>--John<br>
    </p>
    <div>On 24/09/19 9:36 PM, <a href="mailto:wireguard@p-np.de" target="_blank">wireguard@p-np.de</a>
      wrote:<br>
    </div>
    <blockquote type="cite">
      
      
      <div> Hello, </div>
      <div> <br>
      </div>
      <div> in place upgrades from iOS 12 -&gt; iOS 13 (release) seem to
        work well in general. But there is a bizarre issue depending on
        <strong>remote</strong> endpoint ports. If you have, in my case,
        4500/UDP configured as remote endpoint the tunnel does not send
        or receive traffic. Changing it to any other port works.
        Changing back to 4500/UDP breaks it again reproducibly. For
        others, documented <a href="https://www.reddit.com/r/WireGuard/comments/d6in39/wg_broken_on_ios_13/" target="_blank">here</a> , it is 1500/UDP, in
        #WireGuard there has been a documented issue for 500/UDP not
        working. </div>
      <div> <br>
      </div>
      <div> I have AnyConnect installed in parallel and checked, whether
        that&#39;s related. But removing and resetting Network settings did
        not fix port 4500 for me. </div>
      <div> <br>
      </div>
      <div> As there is no port number dependent branching in the
        WireGuard-iOS code base, this is likely an iOS regression. Does
        any one of you have a working channel to Apple to report this? </div>
      <div> <br>
      </div>
      <div> Thank you for an else excellent product. Let me know if I
        can be of any help. </div>
      <div> <br>
      </div>
      <div> Best regards, </div>
      <div> <br>
      </div>
      <div> Christian </div>
      <br>
      <fieldset></fieldset>
      <pre>_______________________________________________
WireGuard mailing list
<a href="mailto:WireGuard@lists.zx2c4.com" target="_blank">WireGuard@lists.zx2c4.com</a>
<a href="https://lists.zx2c4.com/mailman/listinfo/wireguard" target="_blank">https://lists.zx2c4.com/mailman/listinfo/wireguard</a>
</pre>
    </blockquote>
  </div>

_______________________________________________<br>
WireGuard mailing list<br>
<a href="mailto:WireGuard@lists.zx2c4.com" target="_blank">WireGuard@lists.zx2c4.com</a><br>
<a href="https://lists.zx2c4.com/mailman/listinfo/wireguard" rel="noreferrer" target="_blank">https://lists.zx2c4.com/mailman/listinfo/wireguard</a><br>
</blockquote></div></div>

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

      reply index

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-24  9:36 wireguard
2019-09-25 22:01 ` John huttley
2019-09-26  0:13   ` Reid Rankin [this message]

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAMaqUZ2wFdWUcjCK8WMtkitGci6m92_s7ZNBdMD_8CKKykuW0Q@mail.gmail.com \
    --to=reidrankin@gmail.com \
    --cc=john@mib-infotech.co.nz \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com zx2c4-wireguard@archiver.kernel.org
	public-inbox-index wireguard

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/ public-inbox