TCP traffic in ipip tunnel inside wireguard connection

Ivan Leonardo ivan.leonardo at
Mon May 29 22:57:12 CEST 2017


Recently i have been experimenting with wireguard, and in fact the 
performance in wg is better than the ipsec tunnels i have. In my ipsec 
implementation i'm using vti interfaces(SAs and i can select 
the traffic flow with static/dynamic routing.

Knowing that wg doesn't allow multiple tunnels with allowedip=, 
  i tried to create a ipip tunnel using the wg endpoint tunnel ips. I 
don't have problems with UDP/ICMP traffic, but with TCP when a 
host( in lan1 tries to communicate with the ip of the ipip 
tunnel in server2, the returning tcp traffic has bad tcp checksum and 
the packets are discarded. If i try to send tcp packets with the source 
ip of the ipip tunnel of server2 to host( in lan1 , in 
tcpdump in server2 i see the tcp packets, but in the tcpdump in server1 
i dont see the packets.

Resuming, in this topology i only have problems with tcp traffic, udp 
and icmp works fine.

I have search the web for this use case, but didn't find anyone using 
it, in this topic 
, they managed to get a gre/gretap tunnel functioning with wg.

Does anyone have any ideia if its possible to use this topology?

Server2  <----------------------> Server1   <----> lan1 (
           ipip0( = wireguard tunnel 

Servers specs:

Server1/2 Ubuntu 16.04.02 (Kernel 4.4.0-78-generic)
WG version: 0.0.20170517-wg2~xenial

Best regards.

More information about the WireGuard mailing list