Category Archives: Linux networking

wireguard 2 interfaces not workig

vim /etc/wireguard/wg0.conf

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = WG0_SERVER_PRIVATE_KEY
SaveConfig = false

[Peer]
# client1
PublicKey = PUBKEY_FROM_CLIENT_ONE
AllowedIPs = 10.0.0.2/32

vim /etc/wireguard/wg1.conf

[Interface]
Address = 10.0.1.1/24
ListenPort = 51821
PrivateKey = WG1_SERVER_PRIVATE_KEY
SaveConfig = false

[Peer]
# client2
PublicKey = PUBKEY_FROM_CLIENT_TWO
AllowedIPs = 10.0.1.2/32

systemctl start [email protected]
systemctl start [email protected]

wireguard setup

add-apt-repository ppa:wireguard/wireguard
apt-get update
apt install wireguard

MacOS
brew install wireguard-tools

wg genkey | tee privatekey | wg pubkey > publickey

Server side:
/etc/wireguard/wg0.conf

[Interface]
Address = 10.0.0.1/24
DNS = 1.1.1.1
PrivateKey = [ServerPrivateKey]
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp9s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp9s0 -j MASQUERADE

[Peer]
#Peer #1
PublicKey = [Peer#1PublicKey]
AllowedIPs = 10.0.0.3/32

[Peer]
#Peer #2
PublicKey = [Peer#2PublicKey]
AllowedIPs = 10.0.0.10/32

[Peer]
#Peer #3
PublicKey = [Peer#3PublicKey]
AllowedIPs = 10.0.0.2/32

[Peer]
#Peer #4
PublicKey = [Peer#4PublicKey]
AllowedIPs = 10.0.0.11/32

Client side:
/etc/wireguard/wg0.conf

[Interface]
Address = 10.0.0.3/24
PrivateKey = [PrivateKeyPeer#1]

[Peer]
PublicKey = [ServerPublicKey]
Endpoint = some.domain.com:51820
AllowedIPs = 0.0.0.0/0

# This is for if you're behind a NAT and
# want the connection to be kept alive.
PersistentKeepalive = 25

Start/stop interface
wg-quick up wg0
wg-quick down wg0

Start/stop service
$ sudo systemctl stop [email protected]
$ sudo systemctl start [email protected]

Instead of having to modify the file for every client you want to add to the
server you could also use the wg tool instead:

# add peer
wg set wg0 peer allowed-ips 10.0.0.x/32

# verify connection
wg

# save to config
wg-quick save wg0

The Portmapper service runs on port 111 tcp/udp

ss -lntp | grep 111

LISTEN 0 128 *:111 *:* users:(("rpcbind",pid=816,fd=8))
LISTEN 0 128 [::]:111 [::]:* users:(("rpcbind",pid=816,fd=11))

pcinfo -p
program vers proto port service
100000 4 tcp 111 portmapper
100000 3 tcp 111 portmapper
100000 2 tcp 111 portmapper
100000 4 udp 111 portmapper
100000 3 udp 111 portmapper
100000 2 udp 111 portmapper

systemctl stop rpcbind.socket
rpcinfo -p
rpcinfo: can't contact portmapper: RPC: Remote system error - Connection refused

systemctl disable rpcbind

veth with kernel namespaces


ip netns add netns0
ip netns list
netns0

ip netns exec netns0 ip link set lo up
ip link add veth-default type veth peer name veth-netns0
ip link set veth-netns0 netns netns0

ip a | grep veth
6: [email protected]: mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 56:78:d4:a5:8f:55 brd ff:ff:ff:ff:ff:ff link-netns netns0

ip addr add 10.0.3.1/24 dev veth-default
ip link set veth-default up

ip a | grep veth
6: [email protected]: mtu 1500 qdisc noqueue state LOWERLAYERDOWN group default qlen 1000
link/ether 56:78:d4:a5:8f:55 brd ff:ff:ff:ff:ff:ff link-netns netns0
inet 10.0.3.1/24 scope global veth-default
valid_lft forever preferred_lft forever

ip netns exec netns0 ip link set veth-netns0 up
ip netns exec netns0 ip addr add 10.0.3.2/24 dev veth-netns0

ping 10.0.3.2
PING 10.0.3.2 (10.0.3.2) 56(84) bytes of data.
64 bytes from 10.0.3.2: icmp_seq=1 ttl=64 time=0.102 ms
64 bytes from 10.0.3.2: icmp_seq=2 ttl=64 time=0.062 ms
64 bytes from 10.0.3.2: icmp_seq=3 ttl=64 time=0.062 ms
^C
--- 10.0.3.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2082ms

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A FORWARD -o eno0 -i veth-default -j ACCEPT
iptables -A FORWARD -i eno0 -o veth-default -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.3.2/24 -o eno0 -j MASQUERADE

ip netns exec netns0 route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.0.3.0 0.0.0.0 255.255.255.0 U 0 0 0 veth-netns0

ip netns exec netns0 ip route add default via 10.0.3.1
ip netns exec netns0 ping srv24x7.com
PING srv24x7.com (93.115.28.151) 56(84) bytes of data.
64 bytes from pagirnis.cloudlix.com (93.115.28.151): icmp_seq=1 ttl=58 time=1.19 ms
64 bytes from pagirnis.cloudlix.com (93.115.28.151): icmp_seq=2 ttl=58 time=1.47 ms
64 bytes from pagirnis.cloudlix.com (93.115.28.151): icmp_seq=3 ttl=58 time=1.65 ms
^C
--- srv24x7.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 1.190/1.437/1.649/0.189 ms

ip netns list
netns0 (id: 0)