I upgraded my wireguard client from v1.0.12 to v1.0.13 on my MacBook and when I connect using multiple tunnels to different sites, it no longer works correctly. I am not entirely sure if this is a problem with routing on the client side or if there is a bug preventing additional tunnels from connecting to other sites. It seems that the first tunnel I connect to will work, but any subsequent tunnels will not. So for example, if I connect to SiteA and then SiteB, SiteA will work and SiteB will not. If I connect to SiteB and then SiteA, SiteB will work but SiteA will not. This is tested by pinging the VPN's gateway address after establishing each connection. Here is a redacted copy of my tunnel configs:
### Site A Config ### [Interface] PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= Address = 10.1.1.100/24 DNS = 10.1.1.1, example.com [Peer] PublicKey = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy= AllowedIPs = 10.1.1.0/16, aa.aaa.aaa.aa/25 #Public IP space for Site-A DMZ Endpoint = site-a.example.com:32123 ### Site B Config ### [Interface] PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= Address = 10.2.1.100/24 DNS = 10.2.1.1, example.com [Peer] PublicKey = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy= AllowedIPs = 10.2.1.0/16, bb.bbb.bbb.bb/25 #Public IP space for Site-B DMZ Endpoint = site-b.example.com:32123 It is worth noting that this has been tested using both the “On-Demand” function as well as the MacOS built-in Network management tool. The version history says “Jun 17, 2021 - 1.0.13 - This version includes internal fixes and API changes for newer iOS versions”, so the actual changes are a little opaque. I ran a TCPdump on Site-B (or the second site) to see if traffic is even getting to the VPN endpoint and it is not seeing anything. I also ran a packet capture on the border firewalls and did not see any traffic attempting to hit that location. The client does not show any handshake activity, so I believe the issue is specifically in the client or maybe how it is trying route the second connection? A temporary fix is to downgrade back to v1.0.12, but due to limitations of the Apple Appstore, it is only feasible if you happen to have a backup copy of the client. I just happened to have a backup copy, so I was able to test with both clients. Has anyone else ran into this issue or has any suggestions? I can provide more information on the topology if you think it would be helpful. Thanks, Dan Dan West Systems Administrator Galois Inc. http://corp.galois.com
