Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Identity management for WireGuard

lwn.net

Post reply on HN
Print view View original

11–20 of 107 posts

Re: Identity management for WireGuard

#11

Post by candiddevmike »

matthewaveryusa wrote: post #8
candiddevmike wrote: post #5

Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to period…

wrt the IP not being enforced, do you mean different endpoints can require different IPs, or a client can connect to an endpoint with a different IP configured and it's all good? Last time I tested, if you set one IP per user in your wireguard config, that user must connect with that IP.

I believe you're referring to AllowedIPs, which is more around the IPs allowed over the tunnel. I'm talking about the non tunnel source IP of the peer. If you can copy a peers key and use the right AllowedIPs, nothing stops you from impersonating a peer. Being able to lock down peers to a source IP would fix this.

Re: Identity management for WireGuard

#12

Post by lifty »

snoopy_telex wrote: post #6

I'm currently running Tailscale at home, but will switch to Headscale once they get iOS support sorted out. It's magical. It's well on the way towards being a critical piece of infrastructure in my mind.

is there any chance they will be able to fix it? as far as I know the iOS client does not support setting a custom control server.

Re: Identity management for WireGuard

#13

Post by matthewaveryusa »

candiddevmike wrote: post #11
matthewaveryusa wrote: post #8

Earlier quoted context omitted.

wrt the IP not being enforced, do you mean different endpoints can require different IPs, or a client can connect to an endpoint with a different IP configured and it's all good? Last time I tested, if you set one IP per user in your wireguard config, that user must connect with that IP.

I believe you're referring to AllowedIPs, which is more around the IPs allowed over the tunnel. I'm talking about the non tunnel source IP of the peer. If you can copy a peers key and use the right AllowedIPs, nothing stops you from impersonating a peer. Being able to lock down peers to a source IP would fix this.

I think that goes against the tenant of wireguard working well while roaming. In general the concept of an identifying ip (outside of wireguard) will only lead to problems: devices can have multiple ips, and also share ips in the case of NAT/CGNAT. In my experience it's never been worth the trouble (again excluding wireguard)

Re: Identity management for WireGuard

#14

Post by linsomniac »

Xylakant wrote: post #3
jumperabg wrote: post #2

What about Pritunl - https://pritunl.com/sso , it's a pretty good solution as well.

Last time I worked with pritunl, it was based on openvpn. So unless that changed, it doesn’t fit the “for WireGuard networks” category.

It can use OpenVPN or Wireguard now. https://docs.pritunl.com/docs/wireguard

Re: Identity management for WireGuard

#15

Post by dinosaurdynasty »

candiddevmike wrote: post #10
ericpauley wrote: post #7

Earlier quoted context omitted.

> I want WireGuard to periodically refresh the endpoint IP when I change networks, for instance. Out of curiosity, why do you want this?

Split DNS, where WireGuard may resolve an endpoint differently on a LAN vs internet. Also for IPv4/IPv6 roaming--if WireGuard resolves an IPv6 address but moves to a non IPv6 network, the peer will never connect as far as I know.

It's not (and shouldn't be) possible to do it in the kernel module, but it's not too hard to write a cronjob/daemon if you really need it.

It'd definitely be nice if wg-quick and the official apps supported it, though.

Re: Identity management for WireGuard

#16

Post by couchand »

candiddevmike wrote: post #5

Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to period…

> As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect.

Yes WireGuard roams, which is the right behavior usually. What's your use case where an otherwise valid encrypted packet should be rejected based on source ip? Could you use ufw?

Re: Identity management for WireGuard

#17

Post by candiddevmike »

matthewaveryusa wrote: post #13
candiddevmike wrote: post #11

Earlier quoted context omitted.

I believe you're referring to AllowedIPs, which is more around the IPs allowed over the tunnel. I'm talking about the non tunnel source IP of the peer. If you can copy a peers key and use the right AllowedIPs, nothing stops you from impersonating a peer. Being able to lock down peers to a source IP would fix this.

I think that goes against the tenant of wireguard working well while roaming. In general the concept of an identifying ip (outside of wireguard) will only lead to problems: devices can have multiple ips, and also share ips in the case of NAT/CGNAT. In my experience it's never been worth the trouble (again excluding wireguard)

Your EC2 instance probably shouldn't be roaming to Russia though, right?

Re: Identity management for WireGuard

#18

Post by candiddevmike »

couchand wrote: post #16
candiddevmike wrote: post #5

Things I wish WireGuard supported out of the box: - Logging of peer IPs when they initially connect or change (yes, you can do this with module flags, but it should come out of the box). - Tieing WireGuard private keys to a source IP. As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. - More control over DNS resolution for endpoints. I want WireGuard to period…

> As far as I know the endpoint flag does not enforce an IP, a peer can use a different one and still connect. Yes WireGuard roams, which is the right behavior usually. What's your use case where an otherwise valid encrypted packet should be rejected based on source ip? Could you use ufw?

Mostly laziness. If I'm already giving WireGuard an IP via Endpoint, why not have it locked down to that by default? Isn't that what an end user would expect? Otherwise I have to put that IP in multiple places (WireGuard, nftables, etc).

Re: Identity management for WireGuard

#19

Post by guu »

lifty wrote: post #12
snoopy_telex wrote: post #6

I'm currently running Tailscale at home, but will switch to Headscale once they get iOS support sorted out. It's magical. It's well on the way towards being a critical piece of infrastructure in my mind.

is there any chance they will be able to fix it? as far as I know the iOS client does not support setting a custom control server.

That’s correct. The open issue is here: https://github.com/tailscale/tailscale/issues/1572

Re: Identity management for WireGuard

#20

Post by mr337 »

lifty wrote: post #12
snoopy_telex wrote: post #6

I'm currently running Tailscale at home, but will switch to Headscale once they get iOS support sorted out. It's magical. It's well on the way towards being a critical piece of infrastructure in my mind.

is there any chance they will be able to fix it? as far as I know the iOS client does not support setting a custom control server.

So far doesn't look like it unless you go the MDM route, which I guess is aimed mainly at enterprise users.

https://github.com/tailscale/tailscale/issues/5431

Post reply on HN