Routing only to latest peer in the config list seems to work

Hi,

I have the problem with my wireguard server, that only the latest user "peer" from the server config can route/ping to the internal wireguard server IP or the clients in the network behind the wireguard server upon successful connection. All peers can connect to the server, but only the latest in the list last can ping other servers.
I can't locate the error in the configs... does anybody have an idea?

My wireguard server and client version is using 0.0.20180809-wg1~xenial with Ubuntu 18.04.1

wg0.conf
[Interface]
Address = 192.168.50.1/24
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820
PrivateKey = XXX

[Peer]
#User 1
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24

[Peer]
#User 2
PublicKey = XXX
PresharedKey = XXX
#AllowedIPs = 192.168.50.0/24

[Peer]
#User 3
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24

[Peer]
#User 4
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24

client.config
[Interface]
PrivateKey = XXX
DNS = 192.168.178.1
Address = 192.168.50.2/24

[Peer]
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24, 190.168.178.0/24
Endpoint = my.remote.server:51820
PersistentKeepalive = 25

My sysctl.conf includes
net.ipv4.conf.all.proxy_arp = 1
net.ipv4.ip_forward = 1

Does anybody have an idea?

Kind Regards,
Danny

You're using the same AllowedIPs for multiple peers.

Hi,

I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing.

Kind Regards,

Danny

Von: Ryan Whelan <[email protected]>
Gesendet: Donnerstag, 6. September 2018 19:14
An: [email protected]
Cc: WireGuard mailing list <[email protected]>
Betreff: Re: Routing only to latest peer in the config list seems to work

You're using the same AllowedIPs for multiple peers.

On Thu, Sep 6, 2018 at 12:15 PM <[email protected] <mailto:[email protected]> > wrote:

Hi,

I have the problem with my wireguard server, that only the latest user "peer" from the server config can route/ping to the internal wireguard server IP or the clients in the network behind the wireguard server upon successful connection. All peers can connect to the server, but only the latest in the list last can ping other servers.
I can't locate the error in the configs... does anybody have an idea?

My wireguard server and client version is using 0.0.20180809-wg1~xenial with Ubuntu 18.04.1

wg0.conf
[Interface]
Address = 192.168.50.1/24 <http://192.168.50.1/24>
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820
PrivateKey = XXX

[Peer]
#User 1
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24>

[Peer]
#User 2
PublicKey = XXX
PresharedKey = XXX
#AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24>

[Peer]
#User 3
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24>

[Peer]
#User 4
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24>

client.config
[Interface]
PrivateKey = XXX
DNS = 192.168.178.1
Address = 192.168.50.2/24 <http://192.168.50.2/24>

[Peer]
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 192.168.50.0/24 <http://192.168.50.0/24> , 190.168.178.0/24 <http://190.168.178.0/24>
Endpoint = my.remote.server:51820
PersistentKeepalive = 25

My sysctl.conf includes
net.ipv4.conf.all.proxy_arp = 1
net.ipv4.ip_forward = 1

Does anybody have an idea?

Kind Regards,
Danny

_______________________________________________
WireGuard mailing list
[email protected] <mailto:[email protected]>
https://lists.zx2c4.com/mailman/listinfo/wireguard

Hi Danny,

Have you also changed the mask for each of the peers on your central node to /32? If not you’ll need to do this, as leaving them as /24 still effectively makes them all the same route. Ie 192.168.50.1/24 and 192.168.50.2/24 are both the same still. The “AllowedIPs" on the central node to be 192.168.50.1/32, 192.168.50.2/32 etc in your example.

You can leave the “Address” IPs with a /24 mask.

Are you able to share an updated copy of your configs?

Cheers,
Steven

Hi,

your solution solved my problem: Chaning subnet to 32 instead of 24.

Thank you and kind regards,

Danny

Von: Steven Honson <[email protected]>
Gesendet: Samstag, 8. September 2018 12:22
An: [email protected]
Cc: [email protected]
Betreff: Re: Routing only to latest peer in the config list seems to work

Hi Danny,

Have you also changed the mask for each of the peers on your central node to /32? If not you’ll need to do this, as leaving them as /24 still effectively makes them all the same route. Ie 192.168.50.1/24 and 192.168.50.2/24 are both the same still. The “AllowedIPs" on the central node to be 192.168.50.1/32, 192.168.50.2/32 etc in your example.

You can leave the “Address” IPs with a /24 mask.

Are you able to share an updated copy of your configs?

Cheers,

Steven

On 8 Sep 2018, at 6:36 pm, [email protected] <mailto:[email protected]> wrote:

Hi,

I’ve changed the AllowedIPs so that everyone has it’s own dedicated IP. Still the same problem. No routing.

Kind Regards,

Danny

Von: Ryan Whelan <[email protected] <mailto:[email protected]> >
Gesendet: Donnerstag, 6. September 2018 19:14
An: [email protected] <mailto:[email protected]>
Cc: WireGuard mailing list <[email protected] <mailto:[email protected]> >
Betreff: Re: Routing only to latest peer in the config list seems to work

You're using the same AllowedIPs for multiple peers.

On Thu, Sep 6, 2018 at 12:15 PM < <mailto:[email protected]> [email protected]> wrote:

Hi,

I have the problem with my wireguard server, that only the latest user "peer" from the server config can route/ping to the internal wireguard server IP or the clients in the network behind the wireguard server upon successful connection. All peers can connect to the server, but only the latest in the list last can ping other servers.
I can't locate the error in the configs... does anybody have an idea?

My wireguard server and client version is using 0.0.20180809-wg1~xenial with Ubuntu 18.04.1

wg0.conf
[Interface]
Address = <http://192.168.50.1/24> 192.168.50.1/24 PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820
PrivateKey = XXX

[Peer]
#User 1
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = <http://192.168.50.0/24> 192.168.50.0/24

[Peer]
#User 2
PublicKey = XXX
PresharedKey = XXX
#AllowedIPs = <http://192.168.50.0/24> 192.168.50.0/24

[Peer]
#User 3
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = <http://192.168.50.0/24> 192.168.50.0/24

[Peer]
#User 4
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = <http://192.168.50.0/24> 192.168.50.0/24

client.config
[Interface]
PrivateKey = XXX
DNS = 192.168.178.1
Address = <http://192.168.50.2/24> 192.168.50.2/24

[Peer]
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = <http://192.168.50.0/24> 192.168.50.0/24, <http://190.168.178.0/24> 190.168.178.0/24 Endpoint = my.remote.server:51820
PersistentKeepalive = 25

My sysctl.conf includes
net.ipv4.conf.all.proxy_arp = 1
net.ipv4.ip_forward = 1

Does anybody have an idea?

Kind Regards,
Danny

_______________________________________________
WireGuard mailing list
<mailto:[email protected]> [email protected]
<https://lists.zx2c4.com/mailman/listinfo/wireguard> https://lists.zx2c4.com/mailman/listinfo/wireguard

_______________________________________________
WireGuard mailing list
[email protected] <mailto:[email protected]>
https://lists.zx2c4.com/mailman/listinfo/wireguard