TCP traffic in ipip tunnel inside wireguard connection
ivan.leonardo at nickmaleao.stream
Mon May 29 22:57:12 CEST 2017
Recently i have been experimenting with wireguard, and in fact the
performance in wg is better than the ipsec tunnels i have. In my ipsec
implementation i'm using vti interfaces(SAs 0.0.0.0/0) and i can select
the traffic flow with static/dynamic routing.
Knowing that wg doesn't allow multiple tunnels with allowedip=0.0.0.0/0,
i tried to create a ipip tunnel using the wg endpoint tunnel ips. I
don't have problems with UDP/ICMP traffic, but with TCP when a
host(192.168.1.110) in lan1 tries to communicate with the ip of the ipip
tunnel in server2, the returning tcp traffic has bad tcp checksum and
the packets are discarded. If i try to send tcp packets with the source
ip of the ipip tunnel of server2 to host(192.168.1.110) in lan1 , in
tcpdump in server2 i see the tcp packets, but in the tcpdump in server1
i dont see the packets.
Resuming, in this topology i only have problems with tcp traffic, udp
and icmp works fine.
I have search the web for this use case, but didn't find anyone using
it, in this topic
, they managed to get a gre/gretap tunnel functioning with wg.
Does anyone have any ideia if its possible to use this topology?
Server2 <----------------------> Server1 <----> lan1 (192.168.1.0/24)
ipip0(172.18.0.0/30)(remote/local = wireguard tunnel
Server1/2 Ubuntu 16.04.02 (Kernel 4.4.0-78-generic)
WG version: 0.0.20170517-wg2~xenial
More information about the WireGuard