AW: best way for redundancy?
I probably should share some more details about my use case and also why I am hesitating to use OpenBSD/OpnSense etc. All my VPN-routers are actually virtual machines. One is a virtual private server from a hoster that provides an external static IPv4 address, the others are Ubuntu VMs running on Hyper-V 2019. When I check support of OpenBSD/OpnSense on Hyper-V it looks like this is not really granted, basically works, but... and CARP apparently requires special configuration and cooperation of network drivers. And then I haven´t found good documentation on how to configure CARP with wireguard. Thus I tried something else... Until this week, the router of one network was on a mobile machine, which occasionally was really on the road - and the connectivity was of course broken then. There is another host available in the same network that can host a VM, but that host is not running 7*24 for power and noise reasons. That actually suggested a fail over scenario to me. What I configured right now is the following: I "partitioned" that network logically into two groups of VPN-clients. One group is the host and all VMs on the power-saving-host, the other group is the rest. Via DHCP or static routes, each group now uses different routers (part of the respective group) for their respective wireguard tunnel to the other networks. On the other side of the tunnel, network ranges in AllowedIPs are used to address the respective peer (I didn´t dare to have these overlap so far). That is not really a general high-availability scenario, as essentially I optimized for the expected outages. I am still wondering whether wireguard can support a more general approach without the complexity introduced by CARP. My gut feeling is that the roaming capabilities of wireguard should actually support that very well. Thanks, Joachim -Ursprüngliche Nachricht- Von: WireGuard Im Auftrag von Nicolai Gesendet: Tuesday, 2 March 2021 18:10 An: wireguard@lists.zx2c4.com Betreff: Re: best way for redundancy? On Thu, Feb 25, 2021 at 10:17:06PM +0100, Joachim Lindenberg wrote: > I do have a wireguard VPN that connects multiple sites. Unfortunately > some routers are not available all the time, causing network disruption. > I'd like to improve connectivity via redundancy, i.e. add multiple > routers that connect the networks. > What are the options to do that using wireguard? Can I have multiple > peers with different keys and endpoint but same Allowed IPs? Will > wireguard select the one available? In the future I want a similar setup: multiple routers for each network each seamlessly handling WireGuard when necessary. I haven't put any effort into this yet, but my general plan is to use CARP on OpenBSD, with WireGuard sharing keys. (I know you want distinct keys, so I waited to respond until others had a chance.) Anyway the routers in City1 would share City1Keys, routers in City2 would share City2Keys, etc. When City1Router1 is unavailable, City1Router2 would grab the IP address and be able to immediately speak WireGuard to the other locations without anyone noticing. https://www.openbsd.org/faq/pf/carp.html Nicolai
best way for redundancy?
Hello I do have a wireguard VPN that connects multiple sites. Unfortunately some routers are not available all the time, causing network disruption. I´d like to improve connectivity via redundancy, i.e. add multiple routers that connect the networks. What are the options to do that using wireguard? Can I have multiple peers with different keys and endpoint but same Allowed IPs? Will wireguard select the one available? Any suggestions? Thanks, Joachim
AW: Using WireGuard on Windows as non-admin - proper solution?
On Windows home you can almost safely assume the local user is member of Administrators, thus testing for membership in S-1-5-32-556 (for Pro and up) or S-1-5-32-544 might do the trick. Regards, Joachim -Ursprüngliche Nachricht- Von: WireGuard Im Auftrag von Riccardo Paolo Bestetti Gesendet: Wednesday, 25 November 2020 00:43 An: Jason A. Donenfeld Cc: WireGuard mailing list Betreff: Re: Using WireGuard on Windows as non-admin - proper solution? On Sat Nov 21, 2020 at 11:05 AM CET, Jason A. Donenfeld wrote: > Hi, > > Check out the recent changes in git master, still under development, > but functional at this point: > > https://git.zx2c4.com/wireguard-windows/about/adminregistry.md Please note that unfortunately the S-1-5-32-556 group doesn't exist in all Windows editions. For example, it does not exist in Windows 10 Home. The general idea is fine, and that group could very well be the default one; however it might be useful to also have a registry key to pick a different SID. Riccardo P. Bestetti
AW: Wireguard on Ubuntu 18.04.4 (LTS)?
Would be great to have the truth at https://www.wireguard.com/install/. With the addition of bionic-proposed wireguard installs, but wg-quick fails because of "/usr/bin/wg-quick: line 32: resolvconf: command not found". Looks like a dependency is not set. Which of openresolv or resolvconf is the recommended path? Thanks, Joachim -Ursprüngliche Nachricht- Von: Jason A. Donenfeld Gesendet: Monday, 20 July 2020 17:22 An: Joachim Lindenberg Cc: WireGuard mailing list ; Andy Whitcroft Betreff: Re: Wireguard on Ubuntu 18.04.4 (LTS)? Looks like at the moment (July 20, 2020; ignore this email if you're reading this >1 month from now) wireguard is still stuck in -proposed on Bionic. echo 'deb http://us.archive.ubuntu.com/ubuntu bionic-proposed main restricted universe multiverse' >> /etc/apt/sources.list apt update apt install wireguard That's annoying and odd. I'm CCing Canonical's Andy Whitcroft who can fix this inside of Ubuntu.
AW: two client connections -> crash?
Good observation. I never really understood what IPs I should put there and also didn´t find a good documentation on that. And obviously with one connection it wasn´t that important to get it right. What IP addresses or network should AllowedIPs refer to? Client? Server? Tunnel? Thanks, Joachim -Ursprüngliche Nachricht- Von: M. Dietrich Gesendet: Tuesday, 14 July 2020 12:11 An: wiregu...@lindenberg.one; 'WireGuard mailing list' Betreff: Re: two client connections -> crash? Quotation from wiregu...@lindenberg.one at Juli 13, 2020 20:53: > I am trying to configure one client system (Ubuntu 18.04.4 LTS > (GNU/Linux 5.3.0-62-generic x86_64)) against two servers. The > configuration is very similar: > > root@Mailcow:/home/joachim# cat /etc/wireguard/wg0-client.conf > [Interface] Address = 10.200.200.2/24 PrivateKey = *** DNS = 8.8.8.8 > #10.200.200.1 > > [Peer] > PublicKey = qn6CTz578gbrYpzYkvV2okoqkIFHKye+mRj4i/I8Sz8= > Endpoint = fire.lindenberg.one:51820 > AllowedIPs = 0.0.0.0/0 > PersistentKeepalive = 21 > > root@Mailcow:/home/joachim# cat /etc/wireguard/wg1-client.conf > [Interface] Address = 10.200.201.2/24 PrivateKey = *** DNS = 8.8.8.8 > #10.200.200.1 > > [Peer] > PublicKey = QAJANxtuAvdT+HR3fP1I2DXq0Azl0T3jF5s+cW7foSA= > Endpoint = nc.lindenberg.one:51820 > AllowedIPs = 0.0.0.0/0 > PersistentKeepalive = 21 > > Wg-quick up wg0-client ist at system startup. Now unfortunately when I > do wg-quick up wg1-client the network stack kind of crashes. The > command does not terminate, and connectivity on all interfaces is > broken. > Is this a configuration issue? Should I change ports to be different? > Is there some other issue? The ports are fine because the IPs are different. You use the same AllowedIPs for both. And they cover the whole network. This cannot work. What is the intention of that config? > Do I have to define two interfaces or could I have just one with > multiple peers? But how could I then specify which tunnel to use? Depends on what you want to achieve. Sure you can use multiple peers for one interface.
AW: Re: Ubuntu 18.04 kernel 4.15.0-106-generic breaks wireguard-1.0.20200520
I was hit by that issue as well. Going for HWE kernel as proposed at https://www.reddit.com/r/WireGuard/comments/h0tkzt/up_to_date_ubuntu_18044_cannot_compile_wireguard/ solved it for me (for now). Regards, Joachim -Ursprüngliche Nachricht- Von: WireGuard Im Auftrag von Martin Jurasik Gesendet: Friday, June 12, 2020 8:22 PM An: wireguard@lists.zx2c4.com Betreff: Aw: Re: Ubuntu 18.04 kernel 4.15.0-106-generic breaks wireguard-1.0.20200520 I haven't seen any update of the wireguard package yet. Is it still missing? I have only seen an update of wireguard-linux-compat but this isn't used under Ubuntu 18.04, right? Thanks & Regards, Martin Gesendet: Donnerstag, 11. Juni 2020 um 14:11 Uhr Von: "Martin Jurasik" An: wireguard@lists.zx2c4.com Betreff: Re: Ubuntu 18.04 kernel 4.15.0-106-generic breaks wireguard-1.0.20200520 Hi Jason, still no luck with the updated version. make still fails. # wireguard/bionic,bionic,now 1.0.20200513-1~18.04 all [installed,automatic] wireguard-dkms/bionic,bionic,now 1.0.20200611-0ppa1~18.04 all [installed] wireguard-tools/bionic,now 1.0.20200513-1~18.04 amd64 [installed] deploy@xxx:~$ sudo dpkg-reconfigure wireguard-dkms -- Deleting module version: 1.0.20200611 completely from the DKMS tree. -- Done. Loading new wireguard-1.0.20200611 DKMS files... Building for 4.15.0-101-generic 4.15.0-106-generic Building initial module for 4.15.0-101-generic ERROR: Cannot create report: [Errno 17] File exists: '/var/crash/wireguard-dkms.0.crash' Error! Bad return status for module build on kernel: 4.15.0-101-generic (x86_64) Consult /var/lib/dkms/wireguard/1.0.20200611/build/make.log for more information. deploy@xxx:~$ cat /var/lib/dkms/wireguard/1.0.20200611/build/make.log DKMS make.log for wireguard-1.0.20200611 for kernel 4.15.0-101-generic (x86_64) Thu 11 Jun 14:07:36 CEST 2020 make: Entering directory '/usr/src/linux-headers-4.15.0-101-generic' CC [M] /var/lib/dkms/wireguard/1.0.20200611/build/main.o CC [M] /var/lib/dkms/wireguard/1.0.20200611/build/noise.o CC [M] /var/lib/dkms/wireguard/1.0.20200611/build/device.o CC [M] /var/lib/dkms/wireguard/1.0.20200611/build/peer.o CC [M] /var/lib/dkms/wireguard/1.0.20200611/build/timers.o CC [M] /var/lib/dkms/wireguard/1.0.20200611/build/queueing.o CC [M] /var/lib/dkms/wireguard/1.0.20200611/build/send.o CC [M] /var/lib/dkms/wireguard/1.0.20200611/build/receive.o CC [M] /var/lib/dkms/wireguard/1.0.20200611/build/socket.o CC [M] /var/lib/dkms/wireguard/1.0.20200611/build/peerlookup.o /var/lib/dkms/wireguard/1.0.20200611/build/socket.c: In function ‘send6’: /var/lib/dkms/wireguard/1.0.20200611/build/socket.c:139:20: error: ‘const struct ipv6_stub’ has no member named ‘ipv6_dst_lookup_flow’; did you mean ‘ipv6_dst_lookup’? dst = ipv6_stub->ipv6_dst_lookup_flow(sock_net(sock), sock, , ^~~~ ipv6_dst_lookup scripts/Makefile.build:330: recipe for target '/var/lib/dkms/wireguard/1.0.20200611/build/socket.o' failed make[1]: *** [/var/lib/dkms/wireguard/1.0.20200611/build/socket.o] Error 1 make[1]: *** Waiting for unfinished jobs Makefile:1577: recipe for target '_module_/var/lib/dkms/wireguard/1.0.20200611/build' failed make: *** [_module_/var/lib/dkms/wireguard/1.0.20200611/build] Error 2 make: Leaving directory '/usr/src/linux-headers-4.15.0-101-generic‘ ## Regards, Martin
AW: error messages on Hyper-V..
Hi Jason, not sure I can. I installed .26 and configured an empty tunnel (uninstall of .22 deleted the previous configuration). After 24 hours I haven´t seen the error again. Keeping Wireguard installed for now... Regards, Joachim > -Ursprüngliche Nachricht- > Von: Jason A. Donenfeld > Gesendet: Samstag, 14. September 2019 19:22 > An: Joachim Lindenberg > Betreff: Re: error messages on Hyper-V.. > > Hi Joachim, > > Could you confirm that 0.0.26 fixes the issue? > > Thanks, > Jason ___ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard
error messages on Hyper-V..
With .22 installed on Hyper-V I now get the following error message - repeatedly and very annoying. Regards, Joachim ___ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard
AW: Hyper-V 2019: unable to create wintun device: no interfaces found
Hello Jason, all, my experiments were actually roughly three weeks ago with versions .18 and .19, and that mail was somehow stuck.. Just retried with .22, and the good news is that I was able to set up a tunnel between a Hyper-V as a server and a windows client. The old error on wintun is gone. I didn´t have the opportunity to check with two Hyper-Vs yet, and I am also unsure whether I actually want to change the workaround (using an Ubuntu vm on either side as routers) now with the windows version in that early stage, in particular as I also had to trick wireguard to work around the dynamic IP issue most Germans face. With the Ubuntu vms I can ping the server from the client, and if it is unreachable I am pulling down the interface and then up again. This can probably also be done with the application on Windows by activating and deactivating the interface, but I definitely need this to be automated somehow, be it a script or preferably wireguard supporting dynamic ip addresses out of the box. Thanks, Joachim -Ursprüngliche Nachricht- Von: Jason A. Donenfeld Gesendet: Sunday, 25 August 2019 17:54 An: Joachim Lindenberg ; Simon Rozman Cc: WireGuard mailing list Betreff: Re: Hyper-V 2019: unable to create wintun device: no interfaces found On Sun, Aug 25, 2019 at 9:34 AM Joachim Lindenberg wrote: > > Hello, > > I am using Wireguard for quite some time on Ubuntu, and am now trying to use > it on Hyper-V 2019 as well. My goal is to set up a VPN between two Hyper-V > systems and allow connections between the virtual machines hosted (including > Samba AD DCs). > > I downloaded and installed Wireguard for Windows, and created a tunnel > configuration on server and client. However when I try to activate any of > these, I get the message “Unable to create Wintun device: no interfaces > found” on both sides. > > To me it doesn´t look like an issue with the configuration but more likely > WinTun is missing (tried to download separately, but as it is a .msm I assume > that is included in wireguard installation) or does not work with Hyper-V > 2019. > > Any suggestion? > > Thanks, Joachim Interesting. We just reworked the Wintun installation process, to hopefully make it more reliable. Could you try again, and perhaps provide a bit of logging too? Try running this: msiexec /log send-to-jason-please.txt /i https://download.wireguard.com/windows-client/wireguard-amd64-0.0.22.msi ___ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard
Hyper-V 2019: unable to create wintun device: no interfaces found
Hello, I am using Wireguard for quite some time on Ubuntu, and am now trying to use it on Hyper-V 2019 as well. My goal is to set up a VPN between two Hyper-V systems and allow connections between the virtual machines hosted (including Samba AD DCs). I downloaded and installed Wireguard for Windows, and created a tunnel configuration on server and client. However when I try to activate any of these, I get the message Unable to create Wintun device: no interfaces found on both sides. To me it doesn´t look like an issue with the configuration but more likely WinTun is missing (tried to download separately, but as it is a .msm I assume that is included in wireguard installation) or does not work with Hyper-V 2019. Any suggestion? Thanks, Joachim ___ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard
