wireguard.lists.zx2c4.com archive mirror
 help / color / mirror / Atom feed
From: Daniel <tech@tootai.net>
To: wireguard@lists.zx2c4.com
Subject: Re: ipv6 connexion fail - ipv4 OK
Date: Wed, 1 Sep 2021 19:44:47 +0200	[thread overview]
Message-ID: <eda71620-a941-e2c1-b7b3-bdc67d53e72b@tootai.net> (raw)
In-Reply-To: <d7095107-050f-2075-00cb-fdaa86d6daf5@tootai.net>

Again :)

Le 31/08/2021 à 19:50, Daniel a écrit :
> Hi
>
> Le 30/08/2021 à 19:59, Roman Mamedov a écrit :
>> On Mon, 30 Aug 2021 19:44:21 +0200
>> Daniel <tech@tootai.net> wrote:
>>
>>>> Do you get WG working at all, between some other two hosts (not 
>>>> involving this
>>>> particular server for now)?
>>> Yes. Clients are shown on both sides as connected, trafic seems to go
>>> out on each side but other one as received near to nothing.
>> I mean not just "shown as connected", but have you got actual traffic 
>> working
>> between any two hosts. Even just forgetting this server for a while. 
>> So that
>> you can rule out some general issue and concentrate on just the 
>> particular
>> machine setup.
>
> I went a step further. Server has a /64 on eth0, his address being 
> .1/64 Interface I gave to wireguard is called wigserver and get .a2/64 
> as address when up. Now I start the client which is a .24/64 while 
> tcpdump -ni any udp and port 38194 is running on the server. Output is
>
> 19:28:45.790295 eth0  In  IP6 2001:db8:16e:10::24.50012 > 
> 2001:db8:c2c:7c50::a2.38194: UDP, length 148
> 19:28:45.790629 eth0  Out IP6 2001:db8:c2c:7c50::a2.38194 > 
> 2001:db8:16e:10::24.50012: UDP, length 92
> 19:29:06.572059 eth0  Out IP6 2001:db8:c2c:7c50::1.38194 > 
> 2001:db8:16e:10::24.50012: UDP, length 148
> 19:29:11.947969 eth0  Out IP6 2001:db8:c2c:7c50::1.38194 > 
> 2001:db8:16e:10::24.50012: UDP, length 148
> 19:29:17.324065 eth0  Out IP6 2001:db8:c2c:7c50::1.38194 > 
> 2001:db8:16e:10::24.50012: UDP, length 148
>
> As you can see, the original request is going to the right IP which 
> respond with the right source IP (line 1 and 2) From here, all packets 
> are going out with the IP of eth0 not the one from wigserver which is 
> .a2/64. The client has "allowed ips = 10.99.98.0/27, ::/0"
>
> Remember, no FW involved. Before this test I bring up interfaces 
> without wireguard configuration and did server/client test like nc -lu 
> IP PORT on the server while on the client I used nc -u IP PORT 
> Everything worked well. I also started the client while server was not 
> running and got the ICMP6 respons "unreachable port" sended to the 
> client. I also tried to tell to the client to connect to the .1/64 
> insteed of the .a2/64, didn't work
>
> If someone had an idea on what's going on here, would be helpful ;)

I continue my investigations and modify client to connect to eth0 ipv6 
address .1/64 as well that I set debug using # modprobe wireguard && 
echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control 
command. I get the same result that when I connect to the .a2/64 IP 
address from the wireguard server.

Clearly, the first step seems to go well as I see

Sep  1 19:00:51 kirsch kernel: [ 3597.830187] wireguard: wigserver: 
Receiving handshake initiation from peer 1 ([2001:db8:16e:10::24]:42602/0%0)
Sep  1 19:00:51 kirsch kernel: [ 3597.830193] wireguard: wigserver: 
Sending handshake response to peer 1 ([2001:db8:16e:10::24]:42602/0%0)
Sep  1 19:00:51 kirsch kernel: [ 3597.830487] wireguard: wigserver: 
Keypair 1 created for peer 1

but then appear the problem, server did not receive the answer and try 
again and again and again. Please note that it tell 5s but it is in the 
same second or so.

Sep  1 19:00:52 kirsch kernel: [ 3599.369652] wireguard: wigserver: 
Handshake for peer 1 ([2001:db8:16e:10::24]:42602/0%0) did not complete 
after 5 seconds, r
etrying (try 13)

On the client, the answer is sended with the newly ipv6 address from the 
wireguard interface to the ipv6 address of the server wireguard interface

19:00:57.309251 IP6 2001:db8:c2c:7c50::24.42602 > 
2001:db8:c2c:7c50::1.38194: UDP, length 148

and this too, again and again and again.

Hints ?

Thanks for your support

-- 
Daniel

  reply	other threads:[~2021-09-01 17:46 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-25 15:25 Daniel
2021-08-26 11:14 ` Daniel
2021-08-27 16:14   ` Roman Mamedov
2021-08-27 17:16     ` Daniel
2021-08-27 21:35       ` [Warning: DMARC Fail Email] " Mike O'Connor
2021-08-27 21:44         ` Roman Mamedov
2021-08-27 21:54           ` Mike O'Connor
2021-08-30 10:24           ` Daniel
2021-08-30 12:55             ` Skyler Mäntysaari
2021-08-30 16:43             ` Roman Mamedov
2021-08-30 17:28               ` Daniel
2021-08-30 17:38                 ` Roman Mamedov
2021-08-30 17:44                   ` Daniel
2021-08-30 17:59                     ` Roman Mamedov
2021-08-31 17:50                       ` Daniel
2021-09-01 17:44                         ` Daniel [this message]
2021-09-03 13:59                       ` ipv6 connexion fail - ipv4 OK (SOLVED) Daniel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=eda71620-a941-e2c1-b7b3-bdc67d53e72b@tootai.net \
    --to=tech@tootai.net \
    --cc=wireguard@lists.zx2c4.com \
    --subject='Re: ipv6 connexion fail - ipv4 OK' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).