• Жильцов Дмитрий Андреевич's avatar
    Wg: friend to friend, the Temple becomes the hub
    · 44beae92
    Two friends with keys to the Temple could not see each other.  The phone
    reached the Temple and the laptop reached the Temple, and between them
    lay the wall.  WgForward; takes it down, if you want it down.
    
    - A packet out of the tunnel for an address in another friend's allowed
      IPs is sealed again for him, ip_forward the way Linux does it.  TTL
      goes down by one, the header checksum is done again, a packet out of
      hops dies here.  Never back to the one who sent it.
    - Only between friends.  Nothing goes out to the internet, no NAT.
    - Off by default: a friend's key opens the Temple, not every other
      friend.  WgSave; keeps it, WgRep; counts it.
    - Each friend must route the whole tunnel to the Temple, AllowedIPs
      10.66.66.0/24 on his side.  The README says so.
    
    wg_interop.py G: a second Linux joins.  Without WgForward the two do not
    meet, with it they ping, ttl=63, and talk TCP through the Temple.  It
    puts back any ~/Wg.HC it finds, and the test begins with WgDown;
    because a Temple with ~/Wg.HC came up with its own tunnel and the first
    WgUp said already up.  That cost me an evening.  21 of 21.
    44beae92