FreeBSD wireguard wg-quick remote IP address assignment is incorrect

[Peter Libassi]

Ok, Well even if using another local IP in range 127.0.0.0/8 we can’t be certain we will clash with something else.

How about adding a directive for the remote interface address in wg.conf? Like this:

# cat /usr/local/etc/wireguard/wg0.conf
[Interface]
PrivateKey = <->
ListenPort = 7777
Address = 192.168.2.1/32
RemoteAddress = 192.168.2.2

[Peer]
PublicKey = <->
AllowedIPs = 192.168.2.0/24
Endpoint = 172.16.0.23:7777

# diff /usr/local/bin/wg-quick.org ./wg-quick
17a18
> REMOTE_ADDRESS=""
86a88
> 			RemoteAddress) REMOTEADDRESS="$value"; continue ;;
175c177,181
< 		cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias
---
> 	    if [[ -n $REMOTEADDRESS ]]; then
> 		cmd ifconfig "$INTERFACE" inet "$1" "$REMOTEADDRESS" alias
> 	    else
>                 cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias
> 	    fi

/Peter


> 23 feb. 2020 kl. 12:37 skrev Jason A. Donenfeld <Jason at zx2c4.com>:
> 
> We tried this already and it didn't work. See the below commit.
> Perhaps you can update that bug report you filed?
> 
> commit 2c6cabd73dfb23990c245250ef2e502bdb33d189
> Author: Jason A. Donenfeld <Jason at zx2c4.com>
> Date:   Thu Feb 28 19:03:11 2019 +0100
> 
>   wg-quick: freebsd: rebreak interface loopback, while fixing localhost
> 
>   The commit 7c833642 ("wg-quick: freebsd: allow loopback to work") was
>   supposed to make things better, but actually it just started sending
>   legitimate localhost traffic over the WireGuard interface, which is
>   really quite bad.
> 
>   This reverts commit 7c833642dfa342218602ab18e7091e86408d2982.
> 
>   Reported-by: Matt Smith <matt.xtaz at gmail.com>
>   Signed-off-by: Jason A. Donenfeld <Jason at zx2c4.com>
> 
> diff --git a/src/wg-quick/freebsd.bash b/src/wg-quick/freebsd.bash
> index 93f1a3b7..e83dbef0 100755
> --- a/src/wg-quick/freebsd.bash
> +++ b/src/wg-quick/freebsd.bash
> @@ -158,7 +158,7 @@ add_addr() {
>       if [[ $1 == *:* ]]; then
>               cmd ifconfig "$INTERFACE" inet6 "$1" alias
>       else
> -               cmd ifconfig "$INTERFACE" inet "$1" 127.0.0.1 alias
> +               cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias
>       fi
> }

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20200223/3dffe6bd/attachment.html>