On 6/2/20 2:28 PM, Tom Eastep wrote: > For route (such as these) in the main routing table, I prefer the system > networking config files.
easily enough done in wireguard conf, @remote /etc/wireguard/wg0.conf [Interface] ... + PostUp = ip -6 route del fd80:16:7::/116 dev wg0 + PostUp = ip -6 route add fd80:16:7::/116 dev wg0 via fd10:254:254::2 + PostDown = ip -6 route del fd80:16:7::/116 dev wg0 ... systemctl restart wg-quick@wg0.service ip -6 route | egrep "fd|default" fd10:254:254::/116 dev wg0 proto kernel metric 256 pref medium fd80:16:7::/116 via fd10:254:254::2 dev wg0 metric 1024 pref medium fd80:16:8::/116 dev dummy0 proto kernel metric 256 pref medium default via fe80::1 dev eth0 proto ra metric 1024 mtu 1500 pref medium @local /etc/wireguard/wg0.conf [Interface] ... + PostUp = ip -6 route add default dev wg0 via fd10:254:254::1 + PostDown = ip -6 route del default dev wg0 ... systemctl restart wg-quick@wg0.service ip -6 route | egrep "fd|default" fd10:254:254::/116 dev wg0 proto kernel metric 256 pref medium fd80:16:7::/116 dev enp3s0 proto kernel metric 256 pref medium fd80:16:7::a000/116 dev enp3s0 proto kernel metric 256 pref medium fd80:16:8::/116 dev wg0 metric 1024 pref medium default via fd10:254:254::1 dev wg0 metric 1024 pref medium still, from @local, out to the 'net FAILs ping6 -c1 google.com PING google.com(2607:f8b0:4005:809::200e (2607:f8b0:4005:809::200e)) 56 data bytes From fd10:254:254::2 (fd10:254:254::2) icmp_seq=1 Destination unreachable: Address unreachable ping6: sendmsg: Required key not available --- google.com ping statistics --- 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms i notice the 'from' IPv6 on this @local->'net ping is From fd10:254:254::2 which is the IP of the local end of the wg tunnel. that doesn't seem right @ first glance. do I need SNAT, etc on either end in shorewall? or, is this still best dealt with all outside of shorewall? _______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users