Issues with excluding private IPs
Derrick Lyndon Pallas
derrick at pallas.us
Sun Aug 25 21:18:56 CEST 2019
Doesn't a routing rule solve this issue?
~Derrick • iPhone
> On Aug 14, 2019, at 6:36 PM, Oliver Benning <obenning at fieldeffect.com> wrote:
> My setup (may be unrelated):
> I have a public endpoint hosted on Digital Ocean, which I connect to simply through its external IP address as the endpoint. It was setup using Streisand.
> The endpoint itself acts as a DNS resolver within the tunnel for ad blocking purposes, so the WireGuard profile uses the endpoint's internal IP address in the DNS field. This setup has been documented online.
> The issue (on both Mac and iPhone clients):
> I would like to exclude private IPs from the tunnel to connect to internal resources. Connection works fine with AllowedIPs=0.0.0.0/0, it does not work when using the "Exclude private IPs option".
> Log just shows:
> [NET] peer(5m6B…jmno) - Sending handshake initiation
> [NET] peer(5m6B…jmno) - Failed to send handshake initiation write udp4 0.0.0.0:63865->[EXTERNAL-IP]:51820: sendto: network is unreachable
> I also have tried using a set of CDR blocks such that the droplet's external ip is excluded from the range and that did not work either. If I have a misconception about the configuration or there is something I should try please let me know.
> This may have a been recommended below but I would highly suggest a list of IPs to subtract from the tunnel. My ideal scenario would be:
> AllowedIPs = 0.0.0.0/0
> ExceptedIPs = 192.168.1.0/24
> WireGuard mailing list
> WireGuard at lists.zx2c4.com
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the WireGuard