<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
Jason, that sounds like an amazing feature, but would it be possible with the current Go/Android VPN implementation?</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
In my (limited) experience, entering 2 or more comma-separated IP ranges does not work.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
I get "Error bringing up tunnel: Bad Address" if I try to set Allowed IP's to "10.5.0.1/24,192.168.1.0/13" but it works with "0.0.0.0/0".</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
The Android VPN subsystem only seems to allow a single subnet in that parameter.</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
I'm running Wireguard for Android v0.0.20180625.</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> WireGuard <wireguard-bounces@lists.zx2c4.com> on behalf of Jason A. Donenfeld <Jason@zx2c4.com><br>
<b>Sent:</b> Thursday, July 5, 2018 10:46 AM<br>
<b>To:</b> Eric Kuck<br>
<b>Cc:</b> WireGuard mailing list<br>
<b>Subject:</b> "Exclude Private IPs" in Android App</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hey Eric,<br>
<br>
While you're iterating on the "Excluded Applications" feature, what<br>
would you think of also taking a stab at the "Exclude Private IPs"<br>
feature? It's kind of in the same ballpark and works over the same<br>
code you're currently playing with.<br>
<br>
First some background: Some people don't want packets intended for<br>
their local network to go through a tunnel. On desktop linux's<br>
wg-quick(8), this is the default with some very clever use of<br>
ip-rule(8)'s suppress_prefixlength parameter. It works perfectly 100%<br>
of the time, without any need for heuristics. I've written to the<br>
folks I know working on Android's networking stack to allow for the<br>
same kind of clever thing, but if that happens, it'd of course be<br>
quite a ways off. So in the meantime, rather than introducing a switch<br>
called "exclude local networks", which would have all sorts of races<br>
with detecting local networks and making decisions about network types<br>
and such, plus the need to toggle VpnService in a racy way, etc, I<br>
have a much cleaner idea: "Exclude Private IPs".<br>
<br>
"Exclude Private IPs" works in the most dumb and straightforward way<br>
possible, that is guaranteed to not fail. We add a checkbox underneath<br>
"AllowedIPs". The checkbox is visible if "0.0.0.0/0" or ${MAGICRANGE}<br>
is included in the AllowedIPs; otherwise it is hidden. When the<br>
checkbox is checked, it replaces 0.0.0.0/0 with ${MAGICRANGE}. When<br>
the checkbox is unchecked, it replaces (after sorting) ${MAGICRANGE}<br>
with "0.0.0.0/0". ${MAGICRANGE} is defined to be 0.0.0.0/0 modulo<br>
RFC1918:<br>
"0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4"<br>
<br>
I think this approach will be simple and consistent, and implementing<br>
this as a static modification of AllowedIPs rather than runtime set<br>
subtraction makes it more obvious what's going on.<br>
<br>
What do you think of that idea?<br>
<br>
Jason<br>
_______________________________________________<br>
WireGuard mailing list<br>
WireGuard@lists.zx2c4.com<br>
<a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.zx2c4.com%2Fmailman%2Flistinfo%2Fwireguard&data=02%7C01%7C%7Cf70032b86fee46134b9c08d5e29f5941%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636664096373456109&sdata=OuSYdUZQEB1%2BZ4Wf9%2FEv%2BeHLgTFWIjwMCk1xXJOzOWg%3D&reserved=0">https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.zx2c4.com%2Fmailman%2Flistinfo%2Fwireguard&data=02%7C01%7C%7Cf70032b86fee46134b9c08d5e29f5941%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636664096373456109&sdata=OuSYdUZQEB1%2BZ4Wf9%2FEv%2BeHLgTFWIjwMCk1xXJOzOWg%3D&reserved=0</a><br>
</div>
</span></font></div>
</body>
</html>