what to do when the peers use different IPs to transmit and receive

Raffaele Spazzoli rspazzol at redhat.com
Sun Sep 16 20:56:04 CEST 2018

I'll try to make an example
cluster 1 node 1 has private IP1 and VIP1
cluster 2 node 2 has private IP2 and VIP2

each node uses it's private ip for outbound connections.
each node can receive inbound connection on its VIP.

so the wireguard config file for node1 is going to look like:

endpoint: VIP2:port

and for node 2:
endpoint: VIP1: port

the problem is that after the handshake, wireguard updates the config to
the following (for example for node2):
endpoint: IP1:port

but IP2 cannot route to IP1...

I think a well configured SNAT rule may work, although is not elegant
because it forces the cluster to exchange information about their private
This should not be needed and in the cloud private IPs are ephemeral....

anyway thanks for the advice, I am going to try to use it  in my prototype.

I still think there is need for a better technical approach for a long term


Raffaele Spazzoli
Senior Architect - OpenShift <https://www.openshift.com>, Containers
and PaaS Practice <https://www.redhat.com/en/services/consulting/paas>
Tel: +1 216-258-7717

On Sun, Sep 16, 2018 at 12:54 PM, Ivan Labáth <labawi-wg at matrix-dream.net>

> Hi,
> On Sun, Sep 16, 2018 at 08:21:02AM -0400, Raffaele Spazzoli wrote:
> > ... then the IP that a  node uses for its outbound
> > connection is not the same that its peer need to use for its inbound
> > connections.
> Who uses what for whose connection? You lost me here.
> Looks like a broken network to me. Does TCP even work?
> Anyway, SNAT/DNAT should be able to fix things up, if you want to go
> that route.
> Regards,
> Ivan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20180916/3bb9de38/attachment.html>

More information about the WireGuard mailing list