Wireguard + anycast

Wireguard + anycast

[Edward Vielmetti]

[-- Attachment #1.1: Type: text/plain, Size: 820 bytes --]

A little thought experiment which I haven't tried yet.

Using anycast, a single IP address can be routed to multiple machines in a
data center or around the world.

Is it at all possible that anycast and Wireguard would play together
nicely? In particular, is it plausible that you could give a client an
anycast address of a server to use as its endpoint, and that when it picked
the correct / closest one that it would do the right thing?

The naive approach would be to have all of the anycast devices share the
same private/public key pair, but that has a bad smell. And I don't know
what would happen if your routing changed in mid-connection.

(anycast is the technology used to give name servers a single global
address, like Google's 8.8.8.8 DNS)

-- 
Edward Vielmetti +1 734 330 2465
edward.vielmetti@gmail.com

[-- Attachment #1.2: Type: text/html, Size: 1244 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: Wireguard + anycast

[David Cowden]

[-- Attachment #1.1: Type: text/plain, Size: 1272 bytes --]

If Wireguard let you configure a list of allowed keys for a peer (instead
of a single key) that would be a logical solution without much extra
complexity at all I imagine.

On Thu, Jan 3, 2019 at 2:39 PM Edward Vielmetti <edward.vielmetti@gmail.com>
wrote:

> A little thought experiment which I haven't tried yet.
>
> Using anycast, a single IP address can be routed to multiple machines in a
> data center or around the world.
>
> Is it at all possible that anycast and Wireguard would play together
> nicely? In particular, is it plausible that you could give a client an
> anycast address of a server to use as its endpoint, and that when it picked
> the correct / closest one that it would do the right thing?
>
> The naive approach would be to have all of the anycast devices share the
> same private/public key pair, but that has a bad smell. And I don't know
> what would happen if your routing changed in mid-connection.
>
> (anycast is the technology used to give name servers a single global
> address, like Google's 8.8.8.8 DNS)
>
> --
> Edward Vielmetti +1 734 330 2465
> edward.vielmetti@gmail.com
>
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard
>

[-- Attachment #1.2: Type: text/html, Size: 2150 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: Wireguard + anycast

[Henning Reich]

[-- Attachment #1.1: Type: text/plain, Size: 1843 bytes --]

I think you could add multiple peers with the same (anycast) Endpoint but
different Key-Pairs (see the try of an example below).
Your DNS will select the IP for the closed one, and WG will try to connect
with each Key until success.
Or did I missing some important point?


cat /etc/wireguard/wg0.conf
[Interface]
Address = 172.16.0.2/24
ListenPort = 12345
PrivateKey = YIYTN0Hil/32QWTo3F1fTVc3SDkgncXLHbGFlCgIQnM=

# anycast-Server 1
[Peer]
PublicKey = K+m7KQWy78JIAL7+8oFUdgrlBQdS8NZ2IPJu1rPTsnQ=
AllowedIPs = 172.16.0.1/24, 192.168.178.0/24
Endpoint = my.anycast.com:12345

# anycast-Server 2
[Peer]
PublicKey = O79QWUAdNFbWFIuWeKp3264BL3RuWKF+WFO21r2tAo=
AllowedIPs = 172.16.0.1/24, 192.168.178.0/24
Endpoint = my.anycast.com:12345


Am Do., 3. Jan. 2019 um 23:38 Uhr schrieb Edward Vielmetti <
edward.vielmetti@gmail.com>:

> A little thought experiment which I haven't tried yet.
>
> Using anycast, a single IP address can be routed to multiple machines in a
> data center or around the world.
>
> Is it at all possible that anycast and Wireguard would play together
> nicely? In particular, is it plausible that you could give a client an
> anycast address of a server to use as its endpoint, and that when it picked
> the correct / closest one that it would do the right thing?
>
> The naive approach would be to have all of the anycast devices share the
> same private/public key pair, but that has a bad smell. And I don't know
> what would happen if your routing changed in mid-connection.
>
> (anycast is the technology used to give name servers a single global
> address, like Google's 8.8.8.8 DNS)
>
> --
> Edward Vielmetti +1 734 330 2465
> edward.vielmetti@gmail.com
>
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard
>

[-- Attachment #1.2: Type: text/html, Size: 3357 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: Wireguard + anycast

[Phil Hofer]

[-- Attachment #1.1.1: Type: text/plain, Size: 706 bytes --]


> If Wireguard let you configure a list of allowed keys for a peer (instead of a single key) that would be a logical solution without much extra complexity at all I imagine.

As a handshake initiator, you wouldn't know which key to use.
Similarly, when receiving a handshake initiation, you wouldn't
know which key to use to authenticate the handshake. You'd
have to fall back to trial decryption/encryption, which I
think is a non-starter.

The one-to-one correspondence of IP ranges to keys is
baked into the protocol pretty deeply. I'd say this is one
of those simplifying assumptions that Wireguard makes over
IPsec and friends that makes it easier to configure and
administrate.

-Phil

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 509 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard