2 2
drscheme

Is WireGuard broken on Armbian?

Recommended Posts

Hi,

 

I run a wireguard server in my home. I have a Mac and a couple of iOS devices that can successfully connect to the server, my internet traffic is routed via the home wireguard server and I can access devices in my home network using an address like 192.168.178.200. No problem.

 

Now I want to connect my cubitruck running Armbian Ubuntu 18.04 to my home network. I created a similar configuration as for all of the other devices, wireguard connects after I say `wg-quick up $configname`, with `ip a` I can see a new interface with an IP that corresponds to my configuration, there is a route set (Dst 10.9.0.0 -> Iface $configuration_wg0) BUT

 

  • when I try to ping the IP of the WG server (in my case 10.9.0.1): no response
  • when I try to ping a device in the home network (192.168.178.*): no response
  • when I try to access the Internet: nope.

 

Interestingly, on server side, when I say `wg show`, I notice that there is no sign that the client is/was connected.

 

Here's my client conf:

[Interface]

PrivateKey = xx

Address = 10.9.0.7/24

DNS = 1.1.1.1,1.0.0.1

[Peer]

PublicKey = yy

AllowedIPs = 0.0.0.0/0, ::/0

Endpoint = foo.bar.baz:10815

PersistentKeepalive = 25

 

And here the server.conf:
 

[Interface]

Address = 10.9.0.1/24

ListenPort = 10815

PrivateKey = aa

SaveConfig = false

# iphone

[Peer]

PublicKey = bb

AllowedIPs = 10.9.0.4/32

# ipad

[Peer]

PublicKey = cc

AllowedIPs = 10.9.0.5/32

# macpro

[Peer]

PublicKey = dd

AllowedIPs = 10.9.0.6/32

# backuptruck

[Peer]

PublicKey = ee

AllowedIPs = 10.9.0.7/32

I am actually pretty confident, that the configuration is correct. So I tested what happens when I run the same configuration on a Ubuntu notebook and here the configuration works.

 

So my conclusion is that there might be something broken/incompatible/ with wireguard on Armbian.

Share this post


Link to post
Share on other sites
6 minutes ago, drscheme said:

So my conclusion is that there might be something broken/incompatible/ with wireguard on Armbian.


I might give you some hints if you show me logs and WG module version. But you can just try to switch to nightly repository (current kernel). That includes up to date driver.

Share this post


Link to post
Share on other sites

Hello!

 

I'm investigating a similar issue and found this thread. I'm trying to run wireguard on my banana pi pro. 

I have the following setup (as simple as possible for debugging the problem, left in the keys on purpose):

Quote

#Banana pi running armbian on 192.168.0.11

[Interface]
Address = 10.200.200.1/24
SaveConfig = true
ListenPort = 51822
PrivateKey = qAQNv75Hbfa6Spoe6lx0Y71h509ftMmqcnWhf2EDY2U=

[Peer]
PublicKey = Z2fGG/610nuIg58X0MGBXTwGR9bgqdvjQsUvfqrPhic=
AllowedIPs = 10.200.200.2/32
#Endpoint = 192.168.0.101:51822
 

#My notebook running Ununtu on 192.168.0.101

[Interface]
Address = 10.200.200.2/24
PrivateKey = YJOifAYRt0WojFAFvideTCVSr5OE4PtQCxMri0s4mHY=
ListenPort = 51822

[Peer]
PublicKey = tAotXUDO1HLLjDN1Ovq3R16DG/JgmNN71YvfBrPYFFQ=
Endpoint = 192.168.0.11:15822
AllowedIPs = 10.200.200.0/24
 

 

 

I found that bpi is having problem accepting connections, I can see the packets received in tcpdump but there is no wg handshake.

If I uncomment the Endpoint line in BPI config wireguard can establish connection with my desktop, even if I remove the endpoint address from my notebooks configuration.

 

The situation is same with 4.19.62-sunxi #5.92,  5.4.28-sunxi #20.02.7 and 5.5.13-sunxi #trunk.088.

 

Quotemodinfo wireguard
filename:       /lib/modules/5.5.13-sunxi/kernel/drivers/net/wireguard/wireguard.ko
alias:          net-pf-16-proto-16-family-wireguard
alias:          rtnl-link-wireguard
version:        1.0.0
author:         Jason A. Donenfeld <Jason@zx2c4.com>
description:    WireGuard secure network tunnel
license:        GPL v2
srcversion:     00F219E9700C1A81A851666
depends:        libcurve25519,libblake2s,udp_tunnel,libchacha20poly1305,curve25519-neon,ip6_udp_tunnel
intree:         Y
name:           wireguard
vermagic:       5.5.13-sunxi SMP mod_unload ARMv7 thumb2 p2v8 

 

I didn't find any related error message in the logs.

 

Please let me know if you have some idea debugging this issue.

 

Thanks,
Peter

 

Share this post


Link to post
Share on other sites
3 hours ago, Peter P said:

I didn't find any related error message in the logs.

 

Please let me know if you have some idea debugging this issue.

 

Below Linux kernel 5.5.y is a legacy out of the tree version, this: https://git.zx2c4.com/wireguard-linux-compat Starting from 5.6.y WG is a part of the mainline kernel. Reports those errors / problems directly to WG authors and when they fix this, apt update and upgrade will solve it ...

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
2 2