Windows tunnel configured as only IPv6 gets an IPv4 APIPA address

Chris Francy zoredache at gmail.com
Tue Dec 21 07:51:55 UTC 2021


I really wish that the IPv4 binding would be completely disabled when an
interface has no IPv4 addresses.

Consider a simple configuration like this

    # wg_zoredache.conf
    [Interface]
    PrivateKey = ...
    Address = 2001:db8:0:0:24ae:ebff:fef0:97e6/128

When that tunnel is started on Windows you will get an 169.254.0.0/16
address. But I didn't really expect or want that.

I am sure some will tell me this doesn't really hurt much since a person
configuring an IPv6 only tunnel, would not have AllowedIPs set that would
allow this address to actually communicate with anything, so the tunnel
will not accept or transmit these packets. But it is still kinda annoying,
since having that IPv4 address will result in IPv4 broadcast traffic
happening on the interface. I noticed this when I was trying to do a
wireshark capture for something else, and was surprised how much IPv4
broadcasts I was seeing on an interface that I intended to be IPv6 only.

So next I am sure people will suggest adding a `PreUp' or 'PostUp` command
that runs a powershell command to disable the interface. I know with
powershell you can disable the IPv4 binding with a command like
`Disable-NetAdapterBinding -ifAlias wg_zoredache -ComponentID ms_tcpip`.
But PreUp/Postup is blocked by default on Windows. Also some security
software on block Powershell executing as a form of anti-malware
protection. Also, simply running the command once isn't useful, since the
Interface seems to get recreated each time the tunnel or computer restarts.

I have more output of what I currently get, and what I am hoping for
in this gist.

- https://gist.github.com/zoredache/995bb5bea01f6fd8dced0fda708c97c8

Anyway, I am just posting this as a bit of a wishlist request. Please
consider adjusting the client to disable the IPv4 binding on the interface
it creates if no IPv4 addresses are in the tunnel configuration. Or perhaps
provide some other method to have a true IPv6 only wireguard interface on
Windows.

Thanks,

Zoredache


More information about the WireGuard mailing list