WireGuard / wgctrl-go

Package wgctrl enables control of WireGuard interfaces on multiple platforms.
https://godoc.org/golang.zx2c4.com/wireguard/wgctrl
MIT License
727 stars 85 forks source link

Removes allowed ips of all existing peers when new peer is added #88

Closed Aditya23456 closed 4 years ago

Aditya23456 commented 4 years ago

Hello, Thank you very much for the library. I am trying to change wireguard configuration on the server side to dynamically add peers. To accomplish this, I do this when a client gets connected:

conf:=wgtypes.Config{
            ReplacePeers: false,
            Peers: []wgtypes.PeerConfig{{
                PublicKey: CLIENT_PUBLIC_KEY,
                Remove:     false,
                UpdateOnly: false,
                Endpoint:nil,
                PersistentKeepaliveInterval: 20*time.Second,
                ReplaceAllowedIPs:           false,
                AllowedIPs: []net.IPNet{{
                    IP:   net.ParseIP("0.0.0.0"),
                    Mask: net.ParseIP("0.0.0.0"+"/24").DefaultMask(),
                }},
            }},
        }
Client.ConfigureDevice("wg0", conf)

I am relaxing AllowedIPs to allow any for now. Later I will be specific to the given client. This works fine for one client and I see communication fine but when second client connects, first client looses connection. When I looked at wg showconf wg0, I see old peer lost AllowedIPs settings. It shows like this:

wg showconf wg0
[Peer]
PublicKey = 6ssntOAN/Fr6at6ZH0sdjVssvYmVpaX60idhu8HBJXo=
PersistentKeepalive = 20

[Peer]
PublicKey = 63aWx7RpOlxMnXFt0unfBGUryafooPlsMn8d2rQeH2o=
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 20

When I again add another peer, the Peer with public key 63aWx7RpOlxMnXFt0unfBGUryafooPlsMn8d2rQeH2o= also looses AllowedIPs section. Is there any work around/ config parameter to retain old Allowed IPs?? I did play around with ReplaceAllowedIPs and other parameters but didn't help :(

Aditya23456 commented 4 years ago

Sorry for confusion, I figured out that I can't use same AllowedIPs for more than one peer. So I have to restrict subnet for each peer while adding it. Also, the right way to set AllowedIPs is:

 AllowedIPs: []net.IPNet{
                MustCIDR(ip+"/32"),
            },

where ip is peer/client IP. I am closing the issue!