Re: FreeBSD if_wg POINTTOPOINT and MULTICAST behaviour

2021-04-14 Thread Jason A. Donenfeld
Hey Toke, Regarding POINTTOPOINT flag in Linux vs FreeBSD -- apparently FreeBSD routes everything differently simply by virtue of the interface having that flag, whereas on Linux, PTP routing mode is only switched on if you actually add an address with a dest peer. So for FreeBSD, the different

Re: FreeBSD if_wg POINTTOPOINT and MULTICAST behaviour

2021-04-14 Thread Stefan Haller
Hi Jason, Thanks for your clarification. I understand that setting this flag would be a false promise to userspace, because generally Wireguard is point-to-multipoint and doesn't copy messages to multiple peers (which is not exactly necessary in my case, where only a single peer is configured on

FreeBSD if_wg POINTTOPOINT and MULTICAST behaviour

2021-04-14 Thread Stefan Haller
Hello everyone! Today I tried switching to the if_wg kernel module. I observed that the behaviour of the tunnel interface was changed to drop the POINTTOPOINT and MULTICAST flags (8801509656e9). For some reason the bird2 routing daemon is not picking up my interface if there is only a /32

Re: Problems with Windows client over PulseSecure VPN

2021-04-14 Thread Christopher Ng
not sure why this happens on my machine, but changing the command to PostUp = powershell -Command "& {Start-Process -FilePath \"c:\program files\wireguard\wg.exe\" -ArgumentList \"set my-tunnel listen-port 0\"}" works for me and doesn't hang the Wireguard UI On Tue, 23 Mar 2021 at 11:01,

freebsd - cpu consumption?

2021-04-14 Thread Osku Sneits
Dear all, has anyone else noticed the CPU consumption on FreeBSD kernel Wireguard? For my test link, there is a net speed of 200 Mbit/s. On esxi based host, transferring inside Wireguard tunnel, full speed takes about 90% of xeon d-1541 host. Doing this on CentOS 7, takes less than 20% of the

Re: Problems with Windows client over PulseSecure VPN

2021-04-14 Thread Jason A. Donenfeld
Sounds like you probably have an older version of wg.exe somewhere with higher precedence in your PATH. Perhaps C:\windows\system32?

Re: freebsd - cpu consumption?

2021-04-14 Thread Jason A. Donenfeld
Hi Osku, We'll switch to using FreeBSD's opencrypto at some point, at which point the performance will improve. Right now we're using boring unoptimized reference implementations. See https://lists.freebsd.org/pipermail/freebsd-hackers/2021-March/057076.html for more info. So far nobody has

Re: FreeBSD if_wg POINTTOPOINT and MULTICAST behaviour

2021-04-14 Thread Jason A. Donenfeld
Hi Stefan, WireGuard does not do multicast, so we probably won't set that flag. You'll want to use babble over unicast anyway. As far as the `ifconfig wg0 link1` trick I added yesterday goes... I'm not totally convinced I'll keep that yet for the next snapshot. Does bird completely ignore

Re: Problems with Windows client over PulseSecure VPN

2021-04-14 Thread Christopher Ng
ah good call, there was an old version there! now works fine with the vanilla PostUp you suggested. On Wed, 14 Apr 2021 at 21:19, Jason A. Donenfeld wrote: > > Sounds like you probably have an older version of wg.exe somewhere > with higher precedence in your PATH. Perhaps C:\windows\system32?

Re: FreeBSD if_wg POINTTOPOINT and MULTICAST behaviour

2021-04-14 Thread Toke Høiland-Jørgensen
Stefan Haller writes: > Hi Jason, > > Thanks for your clarification. I understand that setting this flag would > be a false promise to userspace, because generally Wireguard is > point-to-multipoint and doesn't copy messages to multiple peers (which > is not exactly necessary in my case, where