Open dirtycache opened 5 years ago
It's not just this version, I can confirm it goes back to at least 20190123.
Also relevant, vyatta-tinc
does the same thing (though I've no samples, as I've just finished tearing this down)
admin@ubnt-XXX:~$ show ip route
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
> - selected route, * - FIB route, p - stale info
IP Route Table for VRF "default"
K *> 0.0.0.0/0 [0/0] via pppoe0
C *> 0.0.0.0/24 is directly connected, wg0
B *> 10.10.1.0/24 [20/0] via 10.10.99.1, wg0, 00:38:28
C *> 10.10.2.0/24 is directly connected, switch0
C *> 10.10.99.0/24 is directly connected, wg0
C *> 127.0.0.0/8 is directly connected, lo
C *> [removed] is directly connected, pppoe0
C *> [removed] is directly connected, pppoe0
admin@ubnt-XXX:~$ dpkg -l wireguard
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
+++-===========================-==================-==================-===========================================================
||/ Name Version Architecture Description
ii wireguard 0.0.20190123-1 mipsel fast, modern, secure kernel VPN tunnel
Not sure when we first saw this behavior, it's been there as far as I can remember. There's also #95 describing the same thing.
I've seen the same thing with OpenVPN tunnels on the EdgeRouters, so I've put it down to some weird Ubiquiti thing and not bothered to investigate further. There's also people that seen the same issue with GRE tunnels.
Hello,
It appears that this version injects a route for 0.0.0.0 with the interface netmask. It doesn't appear this route is ever used - which is good because it's more specific than 0.0.0.0/0 - but I submit it is unwanted behavior and might cause problems with routing protocol redistribution.
It seems to leak the route regardless of whether route-allowed-ips is true or false.
On an E50:
Interface configs:
On a different router, this time an e200:
e200 interface configs:
Worth noting is that wireguard running as part of a VyOS 1.2.2 instance doesn't exhibit the same behavior. It has routes for only the connected /30s assigned to the wgX interfaces, which is, I believe, correct.
Thanks!