Source IP incorrect on multi homed systems

Nico Schottelius nico.schottelius at
Sat Feb 18 20:14:46 UTC 2023

Dear group,

I was wondering how wireguard [Linux kernel] or wireguard-go [FreeBSD]
are supposed to decide which IP address to use for replying?

I have seen both on FreeBSD and Linux that wireguard seems to use the IP
address of the outgoing interface, i.e. the one with the route returning
to the sender. However in multi homed situations, this can be wrong,
let's take this example:

      19:57:24.607526 net1  In  IP > UDP, length 148
      19:57:24.608358 net2  Out IP > UDP, length 92

The initiator sends from to the receiver
Wireguard then replies with the source IP of instead of

As the node is multi homed, the packet might leave through any of its
uplinks and thus return with a random (unexpected) IP address and will
not pass NAT rules on firewalls and finally be dropped. F.i. in above
example the firewall drops the packet from, because there
is no session entry for that.

I have observed this behaviour both on Linux 6.1.11 as well as
wireguard-go 0.0.20220316_8,1 on FreeBSD and in both cases the
connection will break depending on which active interface is taken as

I would argue that wireguard should by default invert the IP
addresses, i.e. switch dst=src, src=dst and then reply with that,
instead of adapting an interface specific address, or is there a good
reason for the current behaviour?

Best regards,


Sustainable and modern Infrastructures by

More information about the WireGuard mailing list