[alanplum]

Sent…

[alanplum]

Ok, I’ve done some serious testing here on my work laptop and discovered interesting things….

I have to say…in all the configurations below, the official WG windows client works as expected, just as a base mark.

So what I have discovered is this….These are all tests solely with WireSock..

If you disable IPv6 in the NIC, WireSock works perfectly. All traffic tunnelled and verified by checking WAN IP.

If you have IPv6 enabled, and use *only* an IPv4 DNS on the LAN, then WireSock tunnels all IPv4 traffic as expected, using my internal DNS for lookups.  However…if you browse to an IPv6 site…it is not tunnelled…it escapes the tunnel (proved by what’s my ip)

If you have IPv6 enabled and use an IPv6 DNS (e.g. iPhone hotspot) then no traffic goes via the tunnel. Disabling IPv6, sends all traffic via the tunnel.

It looks like WireSock is *leaking* IPv6?

As you see in my config above, I have allowedIp to cover ::1, 8000::1 but is it being ignored by WireSock because I don’t have an IPv6 in my config?

Happy to help with any logs…

[alanplum]

Thanks….I’ll be sure to do that.

[alanplum]

I wasn’t aware that DNS requests were sent to both. An IPv4 DNS server can still return AAAA records, and an IPv6 can conversely return an A record, so would seem a bit pointless sending the query to both, but I’ll do research

I can’t test it until tomorrow, but I’m pretty sure it wasn’t working…as in, we could not connect to any of our internal server websites, but could ping them. What I should have tried was browsing to Google, and checking what IP I was coming from, as that would suggest it was using public DNS rather than my internal DNS.

Another test I could do is add an internal IP on an A record on our external DNS server just to see if nslookup resolves it then.

I will try a few more tests tomorrow.

[alanplum]

My internal *work* network is IPv4 only, this is the network on the WireGuard Server end…DNS servers are internal only, but has forwarding enabled for internet resolution. So you can’t query them from the internet.

Laptop…on hotspot…is on a dual stack network, so has both a public ipv6, and a private IPv4, which ultimately will NAT to WAN IPv4.
Both IPv6 DNS and IPv4 DNS servers are pushed via SLAAC/DHCP.

With no tunnel active, the laptop defaults to the lookups via the IPv6 DNS, even to return IPv4 addresses..as IPv6 DNS can still return an A as well as AAAA.

With WireGuard tunnel active, nslookup always uses *my* IPv4 DNS specified in the WireGuard config file.

With WireSock tunnel active, nslookup continues to use IPv6 DNS, even though IPv4 is available…

Hopefully that makes more sense?

[alanplum]

Sorry, but the laptop does have both 4 and 6 DNS servers listed, but it is using the V6 DNS for lookups by default. Maybe I’m misunderstanding.

When no tunnel is active, the laptop is using the V6 DNS server, I presume because it has a valid IPv6 address.

When WG client tunnel is active it uses my DNS server (IPv4)

When WireSock is active, it still uses the default IPv6 DNS, not the IPv4.

[alanplum]

Yes I see. In which case, it won’t work for us currently…sadly.

We use WireGuard for Remote Working, but all traffic (except local) is tunnelled, and must use our internal DNS server specified in the config. Unfortunately I can’t control the end users internet, so if they are dual stack, and their router pushes an IPv6 DNS server via SLAAC which will overrule an IPv4 DNS pushed by DHCP, then that’s the issue.

It seems the WG client somehow changes whatever DNS you have on your LAN, to what is specified in the config.

I’d be very interested in WireSock if it *could* mimic the official WG client with regards DNS, and then I think we could use it.

[alanplum]

So I’ve just tested this using my iPhone hotspot.

When connecting to my iPhone hotspot using Wifi, it seems the laptop definitely gets both an IPv6 (public)and an IPv4 (albeit private). Its a 172.20.x.x address so they must be doing 464XLAT or something…but anyway….*without* WG connected, it does indeed nslookup to the IPv6 link-local, (like wiresock when it is connected to the tunnel) but as soon as I activate WG, then NSLOOKUP resumes to 172.16.0.1.  This is what I was expecting WireSock to do, but it didn’t appear to be doing it.

Hope that helps a bit?

[alanplum]

Just to be clear….none of our *wireguard client configs* use IPv6, but the *laptops themselves* may on the local network..  If it helps, when I nslookup using the WG client, i get this…(This is dual stack on my LAN at home)

nslookup someserver

SERVER: mydnsserver.mydomain.com

ADDRESS: 172.16.0.1

SO definitely going to the correct IPv4 server. (I dont have an IPv6 DNS server)

When using your software it returns some arbitrary link local V6 DNS server.  I mean I could disable IPv6 on the laptop and test again, but wouldn’t want that as a solution.

Please see below for a sample client config with secrets removed:

[Interface]
Address = 10.172.16.10/24
ListenPort = 51800
PrivateKey = *MASKED*
DNS = 172.16.0.1,172.16.0.6

[Peer]
PublicKey = *MASKED*
PresharedKey = *MASKED*
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1, ::/1, 8000::/1
Endpoint = MYIPV4:51800
PersistentKeepalive = 25

You can see in the AllowedIPs, I *do* shove IPv6 traffic down the tunnel but there is nothing at the other end to deal with it…It was to future proof.

Thanks for taking the time…..

[Author]

Posts