Hello folks,
I am trying to configure wg(4) on netbsd-10 and -current.
The hub is "stardust" and is a VPS with a public IPv4 address
(51.15.113.87).
All the other nodes ("pinebookpro", "abacus", "boh") are hosts NATed
behind my home network.
Communication between a node and "stardust" works, i.e. I can ping
them from "stardust" and from a node I can ping "stardust".
However, I would also to communicate between all other hosts, for
example between "boh" and "abacus".
When I try to ping from "boh" (10.2.0.4) to "abacus" (10.2.0.3) I have:
boh$ ping -c3 10.2.0.3
PING 10.2.0.3 (10.2.0.3): 56 data bytes
36 bytes from 10.2.0.1: Redirect Host New router addr: 10.2.0.3 for icmp_seq=0
64 bytes from 10.2.0.3: icmp_seq=0 ttl=254 time=70.546813 ms
36 bytes from 10.2.0.1: Redirect Host New router addr: 10.2.0.3 for icmp_seq=1
64 bytes from 10.2.0.3: icmp_seq=1 ttl=254 time=69.449518 ms
36 bytes from 10.2.0.1: Redirect Host New router addr: 10.2.0.3 for icmp_seq=2
64 bytes from 10.2.0.3: icmp_seq=2 ttl=254 time=70.219366 ms
----10.2.0.3 PING Statistics----
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 69.449518/70.071899/70.546813/0.563315 ms
Corresponding `tcpdump` transcript on "stardust" (10.2.0.1) is:
stardust# tcpdump -n -i wg0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wg0, link-type NULL (BSD loopback), capture size 262144 bytes
09:24:03.076968 IP 10.2.0.4 > 10.2.0.3: ICMP echo request, id 61009, seq 0,
length 64
09:24:03.077049 IP 10.2.0.4 > 10.2.0.3: ICMP echo request, id 61009, seq 0,
length 64
09:24:03.077073 IP 10.2.0.1 > 10.2.0.4: ICMP redirect 10.2.0.3 to host
10.2.0.3, length 36
09:24:03.112569 IP 10.2.0.3 > 10.2.0.4: ICMP echo reply, id 61009, seq 0,
length 64
09:24:03.112626 IP 10.2.0.3 > 10.2.0.4: ICMP echo reply, id 61009, seq 0,
length 64
09:24:03.112658 IP 10.2.0.1 > 10.2.0.3: ICMP redirect 10.2.0.4 to host
10.2.0.4, length 36
09:24:04.077645 IP 10.2.0.4 > 10.2.0.3: ICMP echo request, id 61009, seq 1,
length 64
09:24:04.077674 IP 10.2.0.4 > 10.2.0.3: ICMP echo request, id 61009, seq 1,
length 64
09:24:04.077689 IP 10.2.0.1 > 10.2.0.4: ICMP redirect 10.2.0.3 to host
10.2.0.3, length 36
09:24:04.112789 IP 10.2.0.3 > 10.2.0.4: ICMP echo reply, id 61009, seq 1,
length 64
09:24:04.112811 IP 10.2.0.3 > 10.2.0.4: ICMP echo reply, id 61009, seq 1,
length 64
09:24:04.112821 IP 10.2.0.1 > 10.2.0.3: ICMP redirect 10.2.0.4 to host
10.2.0.4, length 36
09:24:05.077565 IP 10.2.0.4 > 10.2.0.3: ICMP echo request, id 61009, seq 2,
length 64
09:24:05.077612 IP 10.2.0.4 > 10.2.0.3: ICMP echo request, id 61009, seq 2,
length 64
09:24:05.077637 IP 10.2.0.1 > 10.2.0.4: ICMP redirect 10.2.0.3 to host
10.2.0.3, length 36
09:24:05.113528 IP 10.2.0.3 > 10.2.0.4: ICMP echo reply, id 61009, seq 2,
length 64
09:24:05.113573 IP 10.2.0.3 > 10.2.0.4: ICMP echo reply, id 61009, seq 2,
length 64
09:24:05.113600 IP 10.2.0.1 > 10.2.0.3: ICMP redirect 10.2.0.4 to host
10.2.0.4, length 36
Here the configuration on each host.
On "stardust" (10.2.0.1):
stardust# cat /etc/ifconfig.wg0
inet 10.2.0.1/24
!wgconfig ${int} set private-key /etc/wg/wg0
!wgconfig ${int} set listen-port 51820
!wgconfig ${int} add peer pinebookpro
'K+cYC58Jtbs9mbmGxnyMpcedsqMsEOkP8VJi5NKngSU=' --allowed-ips=10.2.0.2/32
!wgconfig ${int} add peer abacus
'fBmBCJfmj1soiNOqftwFfB4gA1M175wVbvOfiTtLvkM=' --allowed-ips=10.2.0.3/32
!wgconfig ${int} add peer boh 'Fc1IKLsUYYiKDj8cNJ2f/9FUPHsxzk3puD/TsC33Zyo='
--allowed-ips=10.2.0.4/32
up
And I have also enabled IP forwarding:
stardust# sysctl net.inet.ip.forwarding
net.inet.ip.forwarding = 1
On "abacus" (10.2.0.3):
ifconfig wg0 create
ifconfig wg0 inet 10.2.0.3/24
wgconfig wg0 set private-key /etc/wg/wg0
wgconfig wg0 set listen-port 51820
wgconfig wg0 add peer stardust '3K6NFmjOM3i3m8coLYeaXN/XJ6pgpBFUh4xPtwggQQQ='
--allowed-ips=10.2.0.0/24 --endpoint=51.15.113.87:51820
ifconfig wg0 up
On "boh" (10.2.0.4):
ifconfig wg0 create
ifconfig wg0 inet 10.2.0.4/24
wgconfig wg0 set private-key /etc/wg/wg0
wgconfig wg0 set listen-port 51820
wgconfig wg0 add peer stardust '3K6NFmjOM3i3m8coLYeaXN/XJ6pgpBFUh4xPtwggQQQ='
--allowed-ips=10.2.0.0/24 --endpoint=51.15.113.87:51820
ifconfig wg0 up
Route on "stardust" is:
stardust# route -n show
Routing tables
Internet:
Destination Gateway Flags Refs Use Mtu Interface
default 62.210.0.1 UG - - - vioif0
10.2.0/24 10.2.0.1 U - - - wg0
10.2.0.1 wg0 UHl - - - wg0
51.15.113.87 link#1 UHl - - - lo0
51.15.113.87/32 link#1 UC - - - vioif0
62.210.0.1 link#1 UHC - - - vioif0
127/8 127.0.0.1 UGRS - - 33624 lo0
127.0.0.1 lo0 UHl - - 33624 lo0
62.210.0.1 de:00:00:3a:d7:b2 UHL - - - vioif0
[...]
How can I permit "stardust" to route the traffic and so all the nodes
in the Wireguard 10.2.0.0/24 network can communicate with each other?
Thanks!
