Hi
Le 30/08/2021 à 19:59, Roman Mamedov a écrit :
On Mon, 30 Aug 2021 19:44:21 +0200
Daniel <t...@tootai.net> wrote:
Do you get WG working at all, between some other two hosts (not involving this
particular server for now)?
Yes. Clients are shown on both sides as connected, trafic seems to go
out on each side but other one as received near to nothing.
I mean not just "shown as connected", but have you got actual traffic working
between any two hosts. Even just forgetting this server for a while. So that
you can rule out some general issue and concentrate on just the particular
machine setup.
I went a step further. Server has a /64 on eth0, his address being .1/64
Interface I gave to wireguard is called wigserver and get .a2/64 as
address when up. Now I start the client which is a .24/64 while tcpdump
-ni any udp and port 38194 is running on the server. Output is
19:28:45.790295 eth0 In IP6 2001:db8:16e:10::24.50012 >
2001:db8:c2c:7c50::a2.38194: UDP, length 148
19:28:45.790629 eth0 Out IP6 2001:db8:c2c:7c50::a2.38194 >
2001:db8:16e:10::24.50012: UDP, length 92
19:29:06.572059 eth0 Out IP6 2001:db8:c2c:7c50::1.38194 >
2001:db8:16e:10::24.50012: UDP, length 148
19:29:11.947969 eth0 Out IP6 2001:db8:c2c:7c50::1.38194 >
2001:db8:16e:10::24.50012: UDP, length 148
19:29:17.324065 eth0 Out IP6 2001:db8:c2c:7c50::1.38194 >
2001:db8:16e:10::24.50012: UDP, length 148
As you can see, the original request is going to the right IP which
respond with the right source IP (line 1 and 2) From here, all packets
are going out with the IP of eth0 not the one from wigserver which is
.a2/64. The client has "allowed ips = 10.99.98.0/27, ::/0"
Remember, no FW involved. Before this test I bring up interfaces without
wireguard configuration and did server/client test like nc -lu IP PORT
on the server while on the client I used nc -u IP PORT Everything worked
well. I also started the client while server was not running and got the
ICMP6 respons "unreachable port" sended to the client. I also tried to
tell to the client to connect to the .1/64 insteed of the .a2/64, didn't
work
If someone had an idea on what's going on here, would be helpful ;)
--
Daniel
