RE: Multiple Clients behind NAT
Thanks for all who responded. The setup is hard to debug, since the clients behind NAT are on the other side of the globe and I am configuring and debugging via Layer 8 ;-). Meanwhile I created the client configurations and configured the Mikrotik server from scratch again, it now provides a seperate wireguard interface for each client; each client now uses a different target port on the server. I have some doubts if this really addresses the source of the problem, and it is certainly not very elegant, but it does the trick for now. The Mikrotik implementation is still a beta, so you cannot expect a stable server. Best, Joachim. -Original Message- From: Riccardo Paolo Bestetti [mailto:p...@bestov.io] Sent: Friday, 15 January, 2021 16:22 To: Maarten de Vries; Posegga, Joachim; wireguard@lists.zx2c4.com Subject: Re: Multiple Clients behind NAT On Fri Jan 15, 2021 at 3:21 PM CET, Maarten de Vries wrote: > WireGuard doesn't have to use the same local port for all clients. In > fact, if you don't give a ListenPort explicitly, an ephemeral port is > assigned. This could theoretically still conflict between clients on This is correct. I mistakenly thought that, by default, WireGuard used the target port as a source port as well (when available). Ephemeral makes more sense & is also what really happens. So yes, Joachim should both fix the NAT and drop ListenPort from his clients. Riccardo
Re: Multiple Clients behind NAT
On Fri Jan 15, 2021 at 3:21 PM CET, Maarten de Vries wrote: > WireGuard doesn't have to use the same local port for all clients. In > fact, if you don't give a ListenPort explicitly, an ephemeral port is > assigned. This could theoretically still conflict between clients on This is correct. I mistakenly thought that, by default, WireGuard used the target port as a source port as well (when available). Ephemeral makes more sense & is also what really happens. So yes, Joachim should both fix the NAT and drop ListenPort from his clients. Riccardo
Re: Multiple Clients behind NAT
On 14-01-2021 18:09, Riccardo Paolo Bestetti wrote: On Wed Jan 13, 2021 at 9:14 PM CET, Posegga, Joachim wrote: I am trying to connect multiple wireguard clients behind the same NAT-Gateway to a Mikrotik server with a public IP. I am not yet sure where exactly the problem is, but it seems that only one client at a time can establish a tunnel. I don't know much about Mikrotik, but my guess is that it's not randomizing source ports for packets egressing the NAT. If that's the case, since WireGuard uses the same port for both source and destination, and since your clients are all connecting to the same server (and thus port), then your NAT can't demux incoming packets, and it just sends them all to the same client. (It probably picks the first one that sends egress packets, until it hits some inactivity time-out). WireGuard doesn't have to use the same local port for all clients. In fact, if you don't give a ListenPort explicitly, an ephemeral port is assigned. This could theoretically still conflict between clients on different machines, but it is unlikely to happen in practice. If NAT is broken, it should be fixed anyway, but letting WireGuard use ephemeral ports would also likely solve the problem in practice. Kind regards, Maarten
Re: Multiple Clients behind NAT
On Wed Jan 13, 2021 at 9:14 PM CET, Posegga, Joachim wrote: > I am trying to connect multiple wireguard clients behind the same > NAT-Gateway to a Mikrotik server with a public IP. I am not yet sure > where exactly the problem is, but it seems that only one client at a > time can establish a tunnel. I don't know much about Mikrotik, but my guess is that it's not randomizing source ports for packets egressing the NAT. If that's the case, since WireGuard uses the same port for both source and destination, and since your clients are all connecting to the same server (and thus port), then your NAT can't demux incoming packets, and it just sends them all to the same client. (It probably picks the first one that sends egress packets, until it hits some inactivity time-out). You should look into your Mikrotik configuration, looking for a flag to enable source address randomization in NAT (it's sometimes called "masquerading"). Riccardo
Re: Multiple Clients behind NAT
On Wed, 13 Jan 2021 20:14:46 + "Posegga, Joachim" wrote: > Dear all, > > I am trying to connect multiple wireguard clients behind the same NAT-Gateway > to a Mikrotik server with a public IP. I am not yet sure where exactly the > problem is, but it seems that only one client at a time can establish a > tunnel. > > Is this a known problem due to the UDP transport, or should multiple clients > behind a NAT work in principle? > > I understand from the documentation that the server looks at the public key > of the incoming packet and identifies the client. The response sent back from > the server then arrives at the NAT gateway, and it should map the target port > to the correct client and forward it. However, I am not very familiar with > UDP over NAT, so I am wondering if this usually works without problems. If > this is the case, I would know that the problem is most likely on the side of > the Mikrotik server. The NAT router will rewrite outgoing UDP port of your clients' packets when they try to connect to other peers; for two clients on the LAN-side trying to send from the same port, it should change that to two separate UDP ports. Therefore remote peers will see your two clients as being on the same global IP, but using two different ports -- and that should work normally. Check with tcpdump on your NAT's WAN interface what actual UDP packets it sends out. The ports also might be very different from what you specified in WG's config, so account for that in firewalling or routing rules on remote sides. -- With respect, Roman
