[prev in list] [next in list] [prev in thread] [next in thread]
List: wireguard
Subject: Fwd: Bridging wg and normal interfaces?
From: Rafał_Grasman <grasmanek94 () gmail ! com>
Date: 2018-01-27 13:24:13
Message-ID: CAMEMCsJ3Rc7SY5c+BQv5xcs9hkM=uKEaL4e2HRD4KXJ19ZyASA () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
Ah alright thanks for the info, I finally figured out everything by myself
though I still have one small problem.
For reference, here's everything I have done:
<begin>
Isolated VM's DHCP: 172.16.1.0/16
Switch wg0: 172.16.0.2/30
Switch ens3: 172.16.1.1/16
Switch ens2: 192.168.2.xx/24 gw 192.168.2.254/24
Router wg0: 172.16.0.1/30
Router eth0: 35.224.54.65/32
# both machines
echo "deb http://deb.debian.org/debian/ unstable main" >
/etc/apt/sources.list.d/unstable-wireguard.list
printf 'Package: *\nPin: release a=unstable\nPin-Priority: 150\n' >
/etc/apt/preferences.d/limit-unstable
apt update
apt-get install -y linux-headers-$(uname -r) wireguard
# both machines /etc/sysctl.conf
net.ipv4.ip_forward=1
net.ipv4.conf.all.proxy_arp = 1
# post up (ens3 of switch) and (eth0 of router) run (wg-quick up wg0)
####isc-dhcp-server (on switch ens3):
option domain-name "pcr";
option domain-name-servers 8.8.8.8, 8.8.4.4;
default-lease-time 600;
max-lease-time 7200;
ddns-update-style none;
authoritative;
subnet 172.16.0.0 netmask 255.255.0.0 {
range 172.16.1.2 172.16.255.253;
option routers 172.16.0.1;
}
############### lan vm /etc/wireguard/wg0.conf
[Interface]
PrivateKey = *************
ListenPort = 12345
Address = 172.16.0.2/30
PostUp = ip route add 172.16.0.1/32 via 172.16.0.2 dev wg0 ; route del
default gw 192.168.2.254 ; ip route add 192.168.2.254 dev ens2 ; route add
default gw 172.16.0.1 dev wg0 ; ip route add 35.224.54.65 via 192.168.2.254
; iptables -A FORWARD -i ens3 -o wg0 -j ACCEPT ; iptables -A FORWARD -i wg0
-o ens3 -j ACCEPT
[Peer]
PublicKey = *************
Endpoint = 35.224.54.65:12345
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 1
############### google vm /etc/wireguard/wg0.conf
[Interface]
PrivateKey = *************
ListenPort = 12345
Address = 172.16.0.1/30
PostUp = ip route add 172.16.0.2/32 via 172.16.0.1 dev wg0 ; ip route add
172.16.0.0/16 via 172.16.0.2 dev wg0 ; iptables -A INPUT -i eth0 -p tcp -m
tcp --dport 22 -j ACCEPT ; iptables -t nat -A POSTROUTING -o eth0 -j
MASQUERADE ; iptables -A FORWARD -i wg0 -j ACCEPT
[Peer]
PublicKey = *************
AllowedIPs = 0.0.0.0/0
<end>
Now the problem I face: whenever I run 'wg-quick up wg0' on a Google Cloud
Engine VM, I can't SSH to it anymore from the WAN side, but the weird thing
is, from the 'switch' I can ping the router just fine, they have a
connection, I can even SSH (sometimes not).
Now what's weird is, when I do all configuration steps with commands (ip ..
wg set .. blabla), and make it with those commands just like the config,
everything works fine. so I have a script that just does the commands.. but
wg-quick should work, everything is the same. Yet this happens.. anything I
can do to debug this behaviour?
On 25 January 2018 at 12:08, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> WireGuard is layer 3, not layer 2, so bridging is not what you want.
>
> Instead, do ordinary IP routing between different subnets. As you
> appear to already have different subnets, this shouldn't be a problem.
>
> If you'd like to overlap within the same subnet, there's always proxy
> arp, but I'd caution against that approach.
>
> Lots of people run into this confusion about layer 2 vs layer 3. We
> can probably walk you through getting things rolling for your
> particular setup in #wireguard on Freenode, if you have IRC.
>
> Jason
>
[Attachment #5 (text/html)]
<div dir="ltr"><div class="gmail_quote"><div dir="ltr">Ah alright thanks for the \
info, I finally figured out everything by myself though I still have one small \
problem.<div><br></div><div>For reference, here's everything I have \
done:</div><div><br></div><div><begin></div><div><br></div><div><div>Isolated \
VM's DHCP: <a href="http://172.16.1.0/16" \
target="_blank">172.16.1.0/16</a></div><div><br></div><div>Switch wg0: <a \
href="http://172.16.0.2/30" target="_blank">172.16.0.2/30</a></div><div>Switch ens3: \
<a href="http://172.16.1.1/16" target="_blank">172.16.1.1/16</a></div><div>Switch \
ens2: 192.168.2.xx/24 gw <a href="http://192.168.2.254/24" \
target="_blank">192.168.2.254/24</a></div><div><br></div><div>Router wg0: <a \
href="http://172.16.0.1/30" target="_blank">172.16.0.1/30</a></div><div>Router eth0: \
<a href="http://35.224.54.65/32" \
target="_blank">35.224.54.65/32</a></div><div><br></div><div># both \
machines</div><div>echo "deb <a href="http://deb.debian.org/debian/" \
target="_blank">http://deb.debian.org/debian/</a> unstable main" > \
/etc/apt/sources.list.d/<wbr>unstable-wireguard.list</div><div>printf 'Package: \
*\nPin: release a=unstable\nPin-Priority: 150\n' > \
/etc/apt/preferences.d/limit-<wbr>unstable</div><div>apt update</div><div>apt-get \
install -y linux-headers-$(uname -r) wireguard</div><div><br></div><div># both \
machines /etc/sysctl.conf</div><div>net.ipv4.ip_forward=1</div><div>net.ipv4.conf.all.proxy_arp \
= 1</div><div><br></div><div># post up (ens3 of switch) and (eth0 of router) run \
(wg-quick up wg0)</div><div><br></div><div>####isc-dhcp-server (on switch \
ens3):</div><div>option domain-name "pcr";</div><div>option \
domain-name-servers 8.8.8.8, 8.8.4.4;</div><div><br></div><div>default-lease-time \
600;</div><div>max-lease-time 7200;</div><div><br></div><div>ddns-update-style \
none;</div><div><br></div><div>authoritative;</div><div><br></div><div>subnet \
172.16.0.0 netmask 255.255.0.0 {</div><div> range 172.16.1.2 \
172.16.255.253;</div><div> option routers \
172.16.0.1;</div><div>}</div><div><br></div><div>############### lan vm \
/etc/wireguard/wg0.conf</div><div>[Interface]</div><div>PrivateKey = \
*************</div><div>ListenPort = 12345</div><div>Address = <a \
href="http://172.16.0.2/30" target="_blank">172.16.0.2/30</a></div><div>PostUp = ip \
route add <a href="http://172.16.0.1/32" target="_blank">172.16.0.1/32</a> via \
172.16.0.2 dev wg0 ; route del default gw 192.168.2.254 ; ip route add 192.168.2.254 \
dev ens2 ; route add default gw 172.16.0.1 dev wg0 ; ip route add 35.224.54.65 via \
192.168.2.254 ; iptables -A FORWARD -i ens3 -o wg0 -j ACCEPT ; iptables -A FORWARD -i \
wg0 -o ens3 -j ACCEPT</div><div><br></div><div>[Peer]</div><div>PublicKey = \
*************</div><div>Endpoint = <a href="http://35.224.54.65:12345" \
target="_blank">35.224.54.65:12345</a></div><div>AllowedIPs = <a \
href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a></div><div>PersistentKeepalive = \
1</div><div><br></div><div><br></div><div>############### google vm \
/etc/wireguard/wg0.conf</div><div>[Interface]</div><div>PrivateKey = \
*************</div><div>ListenPort = 12345</div><div>Address = <a \
href="http://172.16.0.1/30" target="_blank">172.16.0.1/30</a></div><div>PostUp = ip \
route add <a href="http://172.16.0.2/32" target="_blank">172.16.0.2/32</a> via \
172.16.0.1 dev wg0 ; ip route add <a href="http://172.16.0.0/16" \
target="_blank">172.16.0.0/16</a> via 172.16.0.2 dev wg0 ; iptables -A INPUT -i eth0 \
-p tcp -m tcp --dport 22 -j ACCEPT ; iptables -t nat -A POSTROUTING -o eth0 -j \
MASQUERADE ; iptables -A FORWARD -i wg0 -j \
ACCEPT</div><div><br></div><div>[Peer]</div><div>PublicKey = \
*************</div><div>AllowedIPs = <a href="http://0.0.0.0/0" \
target="_blank">0.0.0.0/0</a></div></div><div><br></div><div><end></div><div><br></div><div>Now \
the problem I face: whenever I run 'wg-quick up wg0' on a Google Cloud Engine \
VM, I can't SSH to it anymore from the WAN side, but the weird thing is, from the \
'switch' I can ping the router just fine, they have a connection, I can even \
SSH (sometimes not).</div><div><br></div><div>Now what's weird is, when I do all \
configuration steps with commands (ip .. wg set .. blabla), and make it with those \
commands just like the config, everything works fine. so I have a script that just \
does the commands.. but wg-quick should work, everything is the same. Yet this \
happens.. anything I can do to debug this behaviour?</div></div><div \
class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div \
class="gmail_quote">On 25 January 2018 at 12:08, Jason A. Donenfeld <span \
dir="ltr"><<a href="mailto:Jason@zx2c4.com" \
target="_blank">Jason@zx2c4.com</a>></span> wrote:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex">WireGuard is layer 3, not layer 2, so bridging is not what \
you want.<br> <br>
Instead, do ordinary IP routing between different subnets. As you<br>
appear to already have different subnets, this shouldn't be a problem.<br>
<br>
If you'd like to overlap within the same subnet, there's always proxy<br>
arp, but I'd caution against that approach.<br>
<br>
Lots of people run into this confusion about layer 2 vs layer 3. We<br>
can probably walk you through getting things rolling for your<br>
particular setup in #wireguard on Freenode, if you have IRC.<br>
<span class="m_3536533898149672631HOEnZb"><font color="#888888"><br>
Jason<br>
</font></span></blockquote></div><br></div>
</div></div></div><br></div>
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic