Reconciling "cryptokey-based" and regular routing
Hello,
I need to have multiple gateways on my WG network that can provide access to the entire IPv4 (or IPv6) Internet, for redundancy and load-balancing purposes.
In WG terms this means I need to set AllowedIPs to 0.0.0.0/0 on more than one peer. Then I would add routes into the regular routing table for various destinations,
ip -4 route add 8.8.8.8 via 10.0.0.1
ip -4 route add 8.8.4.4 via 10.0.0.2
or
ip -4 route add default \
nexthop via 10.0.0.1 weight 1 \
nexthop via 10.0.0.2 weight 1
or whatever.
But as documentation and some testing show, this can't really work in WG's "cryptokey-routing" system. If multiple hosts have 0.0.0.0/0 as allowed IPs, WG just sends everything to a random one of them (the first one?), disregarding all of the routing table settings from the examples above.
Is there any possibility to still use multiple routers like that?
If not, then could you add an option to not use AllowedIPs for routing? Or at least to not enforce filtering on incoming packets -- then perhaps I could have only 10.0.0.1 and 10.0.0.2 in AllowedIPs for those hosts, and outgoing routing would work properly, with replies from Internet hosts not getting filtered out?
(Apologies for multiple posts per day, I'm just deploying WireGuard for the first time today, and it's quite unusual compared to what I used before. I will stop soon :)
Signature · 2 lines
With respect, Roman
You need to create multiple wireguard interfaces and assign a single peer to each.
Quoted 45 lines · Roman Mamedov
Hello,
I need to have multiple gateways on my WG network that can provide access to the entire IPv4 (or IPv6) Internet, for redundancy and load-balancing purposes.
In WG terms this means I need to set AllowedIPs to 0.0.0.0/0 on more than one peer. Then I would add routes into the regular routing table for various destinations,
ip -4 route add 8.8.8.8 via 10.0.0.1
ip -4 route add 8.8.4.4 via 10.0.0.2or
ip -4 route add default \
nexthop via 10.0.0.1 weight 1 \
nexthop via 10.0.0.2 weight 1or whatever.
But as documentation and some testing show, this can't really work in WG's "cryptokey-routing" system. If multiple hosts have 0.0.0.0/0 as allowed IPs, WG just sends everything to a random one of them (the first one?), disregarding all of the routing table settings from the examples above.
Is there any possibility to still use multiple routers like that?
If not, then could you add an option to not use AllowedIPs for routing? Or at least to not enforce filtering on incoming packets -- then perhaps I could have only 10.0.0.1 and 10.0.0.2 in AllowedIPs for those hosts, and outgoing routing would work properly, with replies from Internet hosts not getting filtered out?
(Apologies for multiple posts per day, I'm just deploying WireGuard for the first time today, and it's quite unusual compared to what I used before. I will stop soon :)
--
With respect,
Roman
_______________________________________________
WireGuard mailing list
[email protected]
https://lists.zx2c4.com/mailman/listinfo/wireguard
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Quoted 13 lines · Roman Mamedov
Hello,
I need to have multiple gateways on my WG network that can provide access to the entire IPv4 (or IPv6) Internet, for redundancy and load-balancing purposes.
In WG terms this means I need to set AllowedIPs to 0.0.0.0/0 on more than one peer. Then I would add routes into the regular routing table for various destinations,
ip -4 route add 8.8.8.8 via 10.0.0.1 ip -4 route add 8.8.4.4 via 10.0.0.2
Quoted 6 lines
or
ip -4 route add default \ nexthop via 10.0.0.1 weight 1 \ nexthop via 10.0.0.2 weight 1
or whatever.
WireGuard is a layer 3 interface; there is no ARP/NDP or other layer 2 semantics. This means "via foo" doesn't mean anything and is pointless.
Quoted 5 lines
But as documentation and some testing show, this can't really work in WG's "cryptokey-routing" system. If multiple hosts have 0.0.0.0/0 as allowed IPs, WG just sends everything to a random one of them (the first one?), disregarding all of the routing table settings from the examples above.
If you add a duplicate AllowedIPs to a peer, it will remove it from the previous peer, so the "order" is "most recently-configured".
Quoted 1 line
Is there any possibility to still use multiple routers like that?
Use multiple WireGuard interfaces.
- --
Aaron Jones
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJarABUAAoJEIrwc3SIqzAS3K0P/j3RSFF1ba+1r+hi5TEGc5aJ RdbMHptnuyMseNZ2YluipgMMxapQ5dv0jd90zWvqAnL+Sg5rWjl7J3IrMByOmW+1 SJsKUiqTbrscQmJKYHgElxDEmDO294DR51GXJdh3+RvUbXy/dqGwkRbm2WH1qc7c URH5/Pz734fLyFJ/ISDPzHRYhxqj9d8+W9sylR9QW6y4Lo4s31H6K42qplNdoQIL gRvyTDCFzRhetOeolRb1Rq0wc/BF/OpoqijS4U+hkwB+o0cXZqFL4iGoGM8ePStQ zGT3nBQfLENAlCP2JJ0Jfu2Lbo9efO1lY1dDDR/y7HsukkwSKEE6hTQPhei9S1J8 pI8r0C225hrr/1G3acpBKZ5TRrFyatlwbyXPvFx49ntW5w+1wbiKe9HEKRBNFmSz 37VT7s5ahwT3GaWOFuLrWGfqlz7Z2FnDXq9zLaKWF/IcdXuuMAfcpUvt8UIeNJi7 Vfe9tgwIz4RdIkd/tv9vKY9O5FEV3ui99P8naZQk3aHnbcerQ9KXsNyUvBZeAIzk NQL8xbL8fKx8f+r7jUZTPrQp/6m6uB+YvXwmZnB9aWCgBqNMuAmgU6PwKHUyYc86 4SRUtm3lsJRuSATJZJAM48AnMEeGdR0cdiLnY5Q+EqTHY/vAxFspC9P8YZtHA5ZC cr0oFDndYvwyRtarOsQq
=V9Ys
-----END PGP SIGNATURE-----