Re: wireguard and shorewall

Am 05.12.2020 um 00:15 schrieb John Sager:
> 
> 
> On 04/12/2020 21:19, Erich Titl wrote:
>> Hi John
>>
>> Am 04.12.2020 um 19:17 schrieb John Sager:
>>> Let's call the two ends A & B. Each has an 'outside tunnel' address 
>>> via which they communicate with each other. These should be the 
>>> 'Endpoint' for the far end in the respective conf files, together 
>>> with the port that Wireguard listens on at the far end.
>>
>> What are the respective parameters for these end points
>>
>> I have on the central site, my internal network us on my own public 
>> (but unrouted) class C network 194.124.158.0/24
>>
>> [Interface]
>> Address = 192.168.17.1/24
>> PrivateKey = _my_private_key_
>> #ListenPort = 11194
>> #
>> #
>> # Peer1
>> [Peer]
>> PublicKey = _the_other_public_key_
>> AllowedIPs = 192.168.17.2/32
>>
>> Where does one define which ip the outside packet takes
> 
> That is 'Endpoint = <B's address:port>' defined under [Peer]

Which is not defined in the example and I have not found any document on 
the net which defines 'Endpoint'

> 
> Obviously you must already have a route defined to B as wg-quick won't 
> set that up - it only sets up routes in AllowedIPs.
> 

Well, the endpoint B appears undefined so it might use the default route 
(wrongly).

Here is my Peer config snippet now, I leave ListenPort to the default 
right now.

[Peer]
PublicKey = _peers_public_key_
AllowedIPs = 192.168.17.2/32
Endpoint = 194.124.158.76

But wireguard does not like this

gatekeeper# /etc/init.d/wireguard restart
Stopping wireguard VPN server on interface wg0
[#] ip link delete dev wg0
Starting wireguard VPN server on interface wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
Unable to find port of endpoint: `194.124.158.76'
Configuration parsing error
[#] ip link delete dev wg0

It looks like wg_quick does not like empty ports, so

[Peer]
PublicKey = _peers_public_key_
AllowedIPs = 192.168.17.2/32
Endpoint = 194.124.158.76:11194

Now this looks better

gatekeeper# /etc/init.d/wireguard restart
Stopping wireguard VPN server on interface wg0
[#] ip link delete dev wg0
Starting wireguard VPN server on interface wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 192.168.17.1/24 dev wg0
[#] ip link set mtu 1420 up dev wg0


but:

gatekeeper# ping 192.168.17.2
PING 192.168.17.2 (192.168.17.2): 56 data bytes
ping: sendto: Destination address required

So it appears there is no way to set up a road warrior as the central 
peer needs the address of the remote peer

And even though I con ping the local tunnel endpoint now

gatekeeper# ping 192.168.17.1
PING 192.168.17.1 (192.168.17.1): 56 data bytes
64 bytes from 192.168.17.1: seq=0 ttl=64 time=0.329 ms

It requires quite some twiddeling with shorewall until the remote tunnel 
endpoint can be reached, which brings up the shorewall issue on both sides.

I still cannot see how to bring up a road warrior this way.

cheers

ET

------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/