Hi Daniel,

I have multiple peers defined in /etc/wireguard/wg0.conf
but setting AllowedIPs doesn't fully work for some of them
if I use `wg setconf`… and works perfectly fine if I do this
"manually" via `wg set wg0 peer my_public_key allowed-ips …`.

example peer setup in /etc/wireguard/wg0.conf:

 [Peer]
 PublicKey = my_public_key
 AllowedIPs = 10.8.1.2/32,10.1.0.0/20,10.0.0.0/20,192.168.6.0/24

and `wg setconf wg0 /etc/wireguard/wg0.conf && wg show wg0 allowed-ips | grep my_public_key`
outputs:

 my_public_key 192.168.6.0/24 10.8.1.2/32

(note missing 10.1.0.0/20,10.0.0.0/20)


Same thing happens if I use systemd-networkd to handle the interface
(/etc/systemd/network/wg0.netdev with "AllowedIPs = 10.8.1.2/32,10.1.0.0/20,192.168.6.0/24,10.0.0.0/20")


It works for most peers (with multiple IPs/ranges) and
doesn't for two. I have to add missing ranges "manually" via
`wg set wg0 peer my_public_key allowed-ips 192.168.6.0/24,10.8.1.2/24,10.1.0.0/20,10.0.0.0/20`
The other one that fails has one IP and one range in AllowedIPs so it's
not about more than 2 IPs/ranges.


FTR: I do not use wg-quick, I use either systemd-networkd or my own
startup script that basically does this:

 ip link add wg0 type wireguard
 ip addr add 10.8.1.1/24 dev wg0
 wg setconf wg0 /etc/wireguard/wg0.conf
 ip link set up dev wg0


PS thanks for maintaining WireGuard! I already replaced OpenVPN with it on all
   my machines :-)

Hi Piotr--

I tried to replicate this with exactly the kind of setup you've
described, but using version 0.0.20190905-1 on amd64 on a
debian/unstable system.  i saw the output was like:

my_public_key=	10.8.1.2/32 10.1.0.0/20 10.0.0.0/20 192.168.6.0/24

Can you still replicate the problem?

Hi Daniel,

yes, I can still replicate it with 0.0.20190905-1 but I do it on stable
(first Stretch now Buster) with packages from unstable (without
rebuilding them). Every time different peer (I have 11 of them) gets a
non complete AllowedIPs so I admit it's hard to reproduce…


PS I have another problem that I didn't report yet on one (and only one)
   of my peers which I don't think is related, but in case it is:
   from time to time (sometimes few days apart sometimes weeks)
   wireguard freezes (as in it doesn't accept any in/out connections).
   Restarting (ip l set dev wg0 down and up again) doesn't help. What
   helps is to change listening port to something else. This peer has a
   non-public and dynamic IP (but I have another client using the same
   provider on my OpenWRT router and it seems to work fine there)

Hi Piotr--

Thanks for testing again so promptly, and sorry for the delay on my
side.

This is a delicate situation because i want to try to reproduce the
problem you're seeing but i don't want to leak any secret information
from your system (or any of your peers' public metadata either, unless
you're ok with that).

If i can try to restate the problem, it sounds like "wg setconf" is not
reliably setting all the allowed-ips from a complex configuration file.

But "wg set" itself always works fine to adjust it, right?  That makes
it sound like a problem with the "wg setconf" subcommand itself.

So can you help me figure out how i can replicate the problem without
leaking your secret information?  For example, can you supply a
templated configuration file that fails sometimes (but with relevant
secrets and sensitive public metadata redacted)?  For example, is this
something you can replicate intermittently by running the configuration
steps in a tight loop, and testing for the failure after each time?

I've tried to do that briefly with some simple tests, but i still can't
seem to get it to happen, even from a debian buster installation (with
wireguard-dkms and wireguard-tools installed from unstable directly).

hm, this is likely to be a different thing, so if you want to discuss
it, please open it as a separate ticket.

Dear maintainer,

I tried to set up a wireguard connection on wg0 interface using
NetworkManager for testing purpose and then forgot about that. Let's say
I used 192.168.16.233/32 ip and several routes (ex 10.0.3.0/24 10.0.5.0/24).

Then, using wg-quick, I set up a connection on wg0 with different
settings, let's say 192.168.26.3/32 ip and the same route (10.0.3.0/24
10.0.5.0/24) I run into similar issues.

wg0 appeared with both 192.168.16.233/32 and 192.168.26.3/32 addresses
and routes where randomly applying (most of the time it wouldn't work).

Fixed my issue removing the NetworkManager config, maybe NetworkManager
also does not handle correctly wireguard connection yet.

Anyway it was clearly a mess but maybe this may help someone else.

Thanks for maintaining this package,

Fabrice


On Mon, 09 Sep 2019 18:56:33 -0400 Daniel Kahn Gillmor <dkg@fifthhorseman.net> wrote:
allowed-ips
--