Issues with excluding private IPs

[Derrick Lyndon Pallas]

Doesn't a routing rule solve this issue?

~Derrick • iPhone

> On Aug 14, 2019, at 6:36 PM, Oliver Benning <obenning at fieldeffect.com> wrote:
> 
> My setup (may be unrelated):
> 
> I have a public endpoint hosted on Digital Ocean, which I connect to simply through its external IP address as the endpoint. It was setup using Streisand.
> 
> The endpoint itself acts as a DNS resolver within the tunnel for ad blocking purposes, so the WireGuard profile uses the endpoint's internal IP address in the DNS field. This setup has been documented online.
> 
> The issue (on both Mac and iPhone clients):
> I would like to exclude private IPs from the tunnel to connect to internal resources. Connection works fine with AllowedIPs=0.0.0.0/0, it does not work when using the "Exclude private IPs option".
> 
> Log just shows:
> [NET] peer(5m6B…jmno) - Sending handshake initiation
> [NET] peer(5m6B…jmno) - Failed to send handshake initiation write udp4 0.0.0.0:63865->[EXTERNAL-IP]:51820: sendto: network is unreachable
> 
> I also have tried using a set of CDR blocks such that the droplet's external ip is excluded from the range and that did not work either. If I have a misconception about the configuration or there is something I should try please let me know.
> 
> Recommendation
> This may have a been recommended below but I would highly suggest a list of IPs to subtract from the tunnel. My ideal scenario would be:
> 
> AllowedIPs = 0.0.0.0/0
> ExceptedIPs = 192.168.1.0/24
> 
> Cheers,
> Oliver
> 
> _______________________________________________
> WireGuard mailing list
> WireGuard at lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20190825/c13ad05e/attachment-0001.html>