Show Posts
1
20.7 Legacy Series / Re: Wireguard Broken after Successful Upgrade
« on: August 17, 2020, 11:50:14 pm »Thanks this seems to have fixed it for me also. Removed all entries and then put the actual wg ip address with a /32 on the end; lastly bounced wg. Although now I can't ping other subnets.
Two things to check:
First, make sure that your firewall allows for traffic from WG to your other subnets. Second, on the client side, make sure that your allowed subnets includes the ones you want to access.
I think the default wg firewall entry is "all inclusive" (Any).
Anyway, previously I would have had entries like this "10.10.0.0/24, 192.168.2.0/24" in the Allowed IPs. To me, these are ranges of IP addresses.
Under the new version, I have to change these to "10.10.0.2/32,192.168.2.1/24". Now first is a very specific IP (no range) which is the only end of the tunnel in a VPS. It's fine.
The second is actually the IP address of an LXC bridge on a VPS where the wg client lives. But because /24 is a range, it includes other IP addresses on the 2.x subnet. Which is also fine.
So things work better, and I can do what I used to do before I think. I don't understand why - which is worrying for me (a newbie).
That field doesn't do what you think it does. The only thing that should be in the "Allowed IP" is the /32. If you put the /24 in there, what you think you are doing is allowing that IP range to be accessed by the client when they connect. What's actually happening is that the IP range you put there is being assigned to the wg0 interface as a static route. When you do this, all traffic that is destined to the 192.168.2.1/24 interface range will be directed through the wg0 interface, on the VPN or off it. Your network connections will work, but you'll have a performance issue and likely even a firewall bypass issue.
Personally, I think this is a bug in how that is setup. What I'm doing to provide network segmentation like how I had it previously is I'm using the firewall to allow the certain subnets.