I've been using Wireguard on windows to connect to Torguard using the default Wireguard app for some time, everything works, so I know the problem is not with the config file or server setup.
I'm using the exact same config (while the windows client is down, of course) to connect from Ubuntu 20.04 and the routing doesn't seem to work. I'm out of ideas, maybe someone can help me. Same thing happens on AMD64 (VM under Hyper-V) and on ARM64 (raspberry-pi/4 with 8 gigs or RAM).
[email protected]:~/mystack$ wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.29.0.***/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
[#] ip -4 route add 128.0.0.0/1 dev wg0
[#] ip -4 route add 0.0.0.0/1 dev wg0
[email protected]:~/mystack$
And indeed an interface is created, and routing is set up:
(192.168.86.0/24 is google-wifi's network, 10.1.*,10.10.*, and 172.* are docker's networks)
[email protected]:~/mystack$ ip link show wg0
194: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/none
[email protected]:~/mystack$ ip r
0.0.0.0/1 dev wg0 scope link
default via 192.168.86.1 dev eth0 proto dhcp src 192.168.86.122 metric 100
10.1.1.0/24 dev br-4f3e279976ca proto kernel scope link src 10.1.1.1
10.10.10.0/24 dev br-9c24576b7aa1 proto kernel scope link src 10.10.10.1
10.29.0.0/24 dev wg0 proto kernel scope link src 10.29.0.***
128.0.0.0/1 dev wg0 scope link
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
192.168.86.0/24 dev eth0 proto kernel scope link src 192.168.86.122
192.168.86.1 dev eth0 proto dhcp scope link src 192.168.86.122 metric 100
[email protected]:~/mystack$ ifconfig wg0
wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP> mtu 1420
inet 10.29.0.*** netmask 255.255.255.0 destination 10.29.0.***
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 1000 (UNSPEC)
RX packets 1 bytes 92 (92.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 2 bytes 180 (180.0 B)
TX errors 0 dropped 1378 overruns 0 carrier 0 collisions 0
[email protected]:~/mystack$
However, the routing doesn't work, ping doesn't work
On a hunch I added the 'table=off' directive, to prevent Wireguard from setting up routing. And suddenly ping works!
[email protected]:~/mystack$ wg-quick down wg0
[#] ip link delete dev wg0
[#] resolvconf -d wg0 -f
[email protected]:~/mystack$ sudo -E vi /etc/wireguard/wg0.conf
[email protected]:~/mystack$ wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.29.0.***/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
[email protected]:~/mystack$ ip link show wg0
197: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/none
[email protected]:~/mystack$ ip r
default via 192.168.86.1 dev eth0 proto dhcp src 192.168.86.122 metric 100
10.1.1.0/24 dev br-4f3e279976ca proto kernel scope link src 10.1.1.1
10.10.10.0/24 dev br-9c24576b7aa1 proto kernel scope link src 10.10.10.1
10.29.0.0/24 dev wg0 proto kernel scope link src 10.29.0.***
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
192.168.86.0/24 dev eth0 proto kernel scope link src 192.168.86.122
192.168.86.1 dev eth0 proto dhcp scope link src 192.168.86.122 metric 100
[email protected]:~/mystack$ ifconfig wg0
wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP> mtu 1420
inet 10.29.0.*** netmask 255.255.255.0 destination 10.29.0.***
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 1000 (UNSPEC)
RX packets 1 bytes 92 (92.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 2 bytes 180 (180.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
[email protected]:~/mystack$ ping 10.29.0.1
PING 10.29.0.1 (10.29.0.1) 56(84) bytes of data.
64 bytes from 10.29.0.1: icmp_seq=1 ttl=64 time=45.9 ms
64 bytes from 10.29.0.1: icmp_seq=2 ttl=64 time=45.0 ms
64 bytes from 10.29.0.1: icmp_seq=3 ttl=64 time=46.3 ms
64 bytes from 10.29.0.1: icmp_seq=4 ttl=64 time=46.6 ms
64 bytes from 10.29.0.1: icmp_seq=5 ttl=64 time=46.2 ms
64 bytes from 10.29.0.1: icmp_seq=6 ttl=64 time=47.7 ms
^C
--- 10.29.0.1 ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5007ms
rtt min/avg/max/mdev = 45.018/46.280/47.720/0.808 ms
[email protected]:~/mystack$
Now I tried adding the routing of the lower half manually and got traceroute working:
[email protected]:~/mystack$ sudo ip r add 0.0.0.0/1 dev wg0
[email protected]:~/mystack$ ip r
0.0.0.0/1 dev wg0 scope link
...................
[email protected]:~/mystack$ traceroute 1.1.1.1
traceroute to 1.1.1.1 (1.1.1.1), 64 hops max
1 10.29.0.1 46.497ms 45.750ms 44.777ms
2 128.199.32.254 45.407ms 46.283ms 54.180ms
3 138.197.250.122 46.796ms 46.541ms 45.867ms
4 138.197.250.94 45.288ms 45.667ms 45.754ms
5 80.249.211.140 57.569ms 59.616ms 66.315ms
6 1.1.1.1 46.149ms 47.032ms 47.249ms
[email protected]:~/mystack$
However if I add the upper half everything breaks.
[email protected]:~/mystack$ sudo ip r add 128.0.0.0/1 dev wg0
[email protected]:~/mystack$ ip r
0.0.0.0/1 dev wg0 scope link
...
128.0.0.0/1 dev wg0 scope link
...
[email protected]:~/mystack$ traceroute cnn.com
traceroute to cnn.com (151.101.193.67), 64 hops max
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * *
Question
chuck 0
I've been using Wireguard on windows to connect to Torguard using the default Wireguard app for some time, everything works, so I know the problem is not with the config file or server setup.
I'm using the exact same config (while the windows client is down, of course) to connect from Ubuntu 20.04 and the routing doesn't seem to work. I'm out of ideas, maybe someone can help me. Same thing happens on AMD64 (VM under Hyper-V) and on ARM64 (raspberry-pi/4 with 8 gigs or RAM).
Here's the config:
[Interface] PrivateKey = ******** ListenPort = 51820 Address = 10.29.0.***/24 DNS = 1.1.1.1 [Peer] PublicKey = ****************** AllowedIPs = 0.0.0.0/1, 128.0.0.0/1 Endpoint = 178.62.238.***:443 PersistentKeepalive = 25
I do 'wq-quick up wg0' and get this output:
[email protected]:~/mystack$ wg-quick up wg0 [#] ip link add wg0 type wireguard [#] wg setconf wg0 /dev/fd/63 [#] ip -4 address add 10.29.0.***/24 dev wg0 [#] ip link set mtu 1420 up dev wg0 [#] resolvconf -a wg0 -m 0 -x [#] ip -4 route add 128.0.0.0/1 dev wg0 [#] ip -4 route add 0.0.0.0/1 dev wg0 [email protected]:~/mystack$
And indeed an interface is created, and routing is set up:
(192.168.86.0/24 is google-wifi's network, 10.1.*,10.10.*, and 172.* are docker's networks)
However, the routing doesn't work, ping doesn't work
[email protected]:~/mystack$ traceroute 1.1.1.1 traceroute to 1.1.1.1 (1.1.1.1), 64 hops max 1 * * * 2 * * * ^C [email protected]:~/mystack$ ping 10.29.0.1 PING 10.29.0.1 (10.29.0.1) 56(84) bytes of data. ^C --- 10.29.0.1 ping statistics --- 23 packets transmitted, 0 received, 100% packet loss, time 22535ms [email protected]:~/mystack$
On a hunch I added the 'table=off' directive, to prevent Wireguard from setting up routing. And suddenly ping works!
Now I tried adding the routing of the lower half manually and got traceroute working:
[email protected]:~/mystack$ sudo ip r add 0.0.0.0/1 dev wg0 [email protected]:~/mystack$ ip r 0.0.0.0/1 dev wg0 scope link ................... [email protected]:~/mystack$ traceroute 1.1.1.1 traceroute to 1.1.1.1 (1.1.1.1), 64 hops max 1 10.29.0.1 46.497ms 45.750ms 44.777ms 2 128.199.32.254 45.407ms 46.283ms 54.180ms 3 138.197.250.122 46.796ms 46.541ms 45.867ms 4 138.197.250.94 45.288ms 45.667ms 45.754ms 5 80.249.211.140 57.569ms 59.616ms 66.315ms 6 1.1.1.1 46.149ms 47.032ms 47.249ms [email protected]:~/mystack$
However if I add the upper half everything breaks.
[email protected]:~/mystack$ sudo ip r add 128.0.0.0/1 dev wg0 [email protected]:~/mystack$ ip r 0.0.0.0/1 dev wg0 scope link ... 128.0.0.0/1 dev wg0 scope link ... [email protected]:~/mystack$ traceroute cnn.com traceroute to cnn.com (151.101.193.67), 64 hops max 1 * * * 2 * * * 3 * * * 4 * * * 5 * * * 6 * *
Any ideas?
Link to post
Share on other sites
12 answers to this question
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.