Some potential bug in wg-quick re. fwmark and default route
saeidscorp at yahoo.com
Mon Mar 12 15:17:10 CET 2018
Straight to the point :)
Suppose the following scenario:
On a client system I have 2 interfaces:
wg0 -> which has allowedips of 0.0.0.0; so it gets special treatment by wg-
quick -> so `ip rule add not fwmark 51820 table 51820`
wg1 -> which has a restrictive allowedips of 192.168.255.10/32 (not important)
also each one have a FwMark set in their config file:
wg0 -> 51800
wg1 -> 51820
Then: `wg-quick up wg0` and `wg-quick up wg1`
Now the problem is, when I do `wg-quick down wg1` it also deletes the default
rules for wg0, as its fwmark is 51820 which belongs to table of wg0. I see
that this might seem a little bit weird to do, but why rely on hard-coded
numbers if we can use the ones provided by the user...
So wouldn't be better if `add_default()` function first checks if fwmark is
present on device (thus config file) and use that as fwmark and table-id?
Like what `del_if()` does, borrowing its code:
fwmark="$(wg show "$INTERFACE" fwmark)"
[[ $fwmark != off ]] && DEFAULT_TABLE=$(( fwmark )) # borrowed
if [[ -z $DEFAULT_TABLE ]]; then
while [[ -n $(ip -4 route show table $DEFAULT_TABLE) || -n $(ip -6 route
show table $DEFAULT_TABLE) ]]; do
This way, default interface (the one having allowedips of 0.0.0.0) would
register its own fwmark, and bringing down other interfaces, doesn't delete
+ But another issue, `del_if()` seems to assume that the interface is used as
default route when a fwmark is present on it. This causes deletion of "from
all lookup main suppress_prefixlength 0" when bringing down a non-default
interface (in this scenario, wg1).
More information about the WireGuard