<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 27 Feb 2020, at 16:46, Sean Baildon <<a href="mailto:sean@baildon.co" class="">sean@baildon.co</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hey,<br class=""><br class="">Recently purchased and upgraded a new MBP to Catalina.<br class=""><br class="">Requests to https enabled sites over the VPN no longer work, even<br class="">using my old configuration. Requests to insecure sites—ex.<br class=""><a href="http://example.xn--comwork-416c" class="">http://example.com—work</a> just fine.<br class=""><br class="">My iOS devices work as expected. I've tried using the iOS<br class="">configurations on the laptop, but it's the same behaviour; hanging.<br class=""><br class="">I'm using the Mac App Store version of wireguard on a vanilla install<br class="">of macOS Catalina. Are there any known issues? Happy to provide any<br class="">useful debug<br class=""></div></div></blockquote><div><br class=""></div><div>I like to use curl to find out the details of what is breaking.</div><div><br class=""></div><div>This is the result of my testing using wireguard on macOS 10.15.3.</div><div>I connect wireguard via mobile data to my home router 172.16.4.1.</div><div>I change the Allowed IPs to include the IP of <a href="http://example.com" class="">example.com</a>:</div><div><br class=""></div><div>Allowed IPS: 93.184.216.34/32, 172.16.2.0/24, 172.16.4.0/24</div><div><br class=""></div><div>And used trace route to see if <a href="http://example.com" class="">example.com</a> was routed via</div><div>wireguard.</div><div><br class=""></div><div><br class=""></div><div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><div><b class="">$ traceroute <a href="http://example.com" class="">example.com</a></b></div><div><b class="">traceroute to <a href="http://example.com" class="">example.com</a> (93.184.216.34), 64 hops max, 52 byte packets</b></div><div><b class=""> 1 172.16.4.1 (172.16.4.1) 108.362 ms 69.420 ms 61.568 ms</b></div><div class=""><b class=""><br class=""></b></div></div></div><div><b class="">$ curl --verbose <a href="https://example.com" class="">https://example.com</a></b></div><div><div><b class="">* Rebuilt URL to: <a href="https://example.com/" class="">https://example.com/</a></b></div><div><b class="">* Trying 93.184.216.34...</b></div><div><b class="">* TCP_NODELAY set</b></div><div><b class="">* Connected to <a href="http://example.com" class="">example.com</a> (93.184.216.34) port 443 (#0)</b></div><div><b class="">* ALPN, offering http/1.1</b></div><div><b class="">* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH</b></div><div><b class="">* successfully set certificate verify locations:</b></div><div><b class="">* CAfile: /opt/local/share/curl/curl-ca-bundle.crt</b></div><div><b class=""> CApath: none</b></div><div><b class="">* TLSv1.2 (OUT), TLS header, Certificate Status (22):</b></div><div><b class="">* TLSv1.2 (OUT), TLS handshake, Client hello (1):</b></div><div><b class="">* TLSv1.2 (IN), TLS handshake, Server hello (2):</b></div><div><b class="">* TLSv1.2 (IN), TLS handshake, Certificate (11):</b></div><div><b class="">* TLSv1.2 (IN), TLS handshake, Server key exchange (12):</b></div><div><b class="">* TLSv1.2 (IN), TLS handshake, Server finished (14):</b></div><div><b class="">* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):</b></div><div><b class="">* TLSv1.2 (OUT), TLS change cipher, Client hello (1):</b></div><div><b class="">* TLSv1.2 (OUT), TLS handshake, Finished (20):</b></div><div><b class="">* TLSv1.2 (IN), TLS change cipher, Client hello (1):</b></div><div><b class="">* TLSv1.2 (IN), TLS handshake, Finished (20):</b></div><div><b class="">* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256</b></div><div><b class="">* ALPN, server accepted to use http/1.1</b></div><div><b class="">* Server certificate:</b></div><div><b class="">* subject: C=US; ST=California; L=Los Angeles; O=Internet Corporation for Assigned Names and Numbers; OU=Technology; CN=<a href="http://www.example.org" class="">www.example.org</a></b></div><div><b class="">* start date: Nov 28 00:00:00 2018 GMT</b></div><div><b class="">* expire date: Dec 2 12:00:00 2020 GMT</b></div><div><b class="">* subjectAltName: host "<a href="http://example.com" class="">example.com</a>" matched cert's "<a href="http://example.com" class="">example.com</a>"</b></div><div><b class="">* issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA</b></div><div><b class="">* SSL certificate verify ok.</b></div><div><b class="">> GET / HTTP/1.1</b></div><div><b class="">> Host: <a href="http://example.com" class="">example.com</a></b></div><div><b class="">> User-Agent: curl/7.60.0</b></div><div><b class="">> Accept: */*</b></div><div><b class="">></b></div><div><b class="">< HTTP/1.1 200 OK</b></div><div><b class="">< Accept-Ranges: bytes</b></div><div><b class="">< Age: 485981</b></div><div><b class="">< Cache-Control: max-age=604800</b></div><div><b class="">< Content-Type: text/html; charset=UTF-8</b></div><div><b class="">< Date: Sun, 01 Mar 2020 08:36:35 GMT</b></div><div><b class="">< Etag: "3147526947"</b></div><div><b class="">< Expires: Sun, 08 Mar 2020 08:36:35 GMT</b></div><div><b class="">< Last-Modified: Thu, 17 Oct 2019 07:18:26 GMT</b></div><div><b class="">< Server: ECS (nyb/1D1E)</b></div><div><b class="">< Vary: Accept-Encoding</b></div><div><b class="">< X-Cache: HIT</b></div><div><b class="">< Content-Length: 1256</b></div><div><b class=""><</b></div><div><b class=""><!doctype html></b></div><div><b class=""><html></b></div><div><b class=""><head></b></div><div><b class=""> <title>Example Domain</title></b></div><div><b class=""><br class=""></b></div><div><b class=""> <meta charset="utf-8" /></b></div><div><b class=""> <meta http-equiv="Content-type" content="text/html; charset=utf-8" /></b></div><div><b class=""> <meta name="viewport" content="width=device-width, initial-scale=1" /></b></div><div><b class=""> <style type="text/css"></b></div><div><b class=""> body {</b></div><div><b class=""> background-color: #f0f0f2;</b></div><div><b class=""> margin: 0;</b></div><div><b class=""> padding: 0;</b></div><div><b class=""> font-family: -apple-system, system-ui, BlinkMacSystemFont, "Segoe UI", "Open Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;</b></div><div><b class=""><br class=""></b></div><div><b class=""> }</b></div><div><b class=""> div {</b></div><div><b class=""> width: 600px;</b></div><div><b class=""> margin: 5em auto;</b></div><div><b class=""> padding: 2em;</b></div><div><b class=""> background-color: #fdfdff;</b></div><div><b class=""> border-radius: 0.5em;</b></div><div><b class=""> box-shadow: 2px 3px 7px 2px rgba(0,0,0,0.02);</b></div><div><b class=""> }</b></div><div><b class=""> a:link, a:visited {</b></div><div><b class=""> color: #38488f;</b></div><div><b class=""> text-decoration: none;</b></div><div><b class=""> }</b></div><div><b class=""> @media (max-width: 700px) {</b></div><div><b class=""> div {</b></div><div><b class=""> margin: 0 auto;</b></div><div><b class=""> width: auto;</b></div><div><b class=""> }</b></div><div><b class=""> }</b></div><div><b class=""> </style></b></div><div><b class=""></head></b></div><div><b class=""><br class=""></b></div><div><b class=""><body></b></div><div><b class=""><div></b></div><div><b class=""> <h1>Example Domain</h1></b></div><div><b class=""> <p>This domain is for use in illustrative examples in documents. You may use this</b></div><div><b class=""> domain in literature without prior coordination or asking for permission.</p></b></div><div><b class=""> <p><a href="<a href="https://www.iana.org/domains/example" class="">https://www.iana.org/domains/example</a>">More information...</a></p></b></div><div><b class=""></div></b></div><div><b class=""></body></b></div><div><b class=""></html></b></div><div><b class="">* Connection #0 to host <a href="http://example.com" class="">example.com</a> left intact</b></div><div><b class=""><br class=""></b></div><div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Barry</div><div class=""><br class=""></div></div><div><br class=""></div></div></div></body></html>