Re: Setting up a Wireguard router (with FreeBSD)

On 2024-03-07 00:09, Kurt Hackenberg wrote:

>> I should habe known someone would be pedantic. :-)
>> My ISP does not give me _my own_ public IPv4 address. :-D
>> My ISP only provides a DS-Lite connection, which in my case means my 
>> router is assigned an IP within the
>> 100.64.0.0/10 realm.
> Not pedantic, confused, by a major lack of information about your 
> setup.

Sorry, no offense intended!

> I'd never heard of that shared address space or of DS-Lite.  Just
> looked them up, got the idea.
> [...]

This practice is so common in Germany and in other European countries, 
that I assumed my (rather brief) reference would be enough to let people 
know what I was going on about. I thought it was well known.

In Germany just about all ISPs use this method - some better than 
others. The only ISP who still gives out public IPv4 addresses (that I 
know of) to consumers is Deutsche Telekom - however, this knowledge 
isn't exactly current. If you get a cable connection with Vodafone, 
you're outa luck, unless you pay for a company line. On a Vodafone DSL 
it was possible, but I don't know if that is still the case. 1&1 still 
give you one, but you have to ask nicely. Just about anyone else will 
only give you a public IPv4 address if you are prepared to shell out 
some major cash. For example, I pay 60€ for my connection per month, a 
public IPv4 address is not an option. The prices for plans for firms who 
want one are not made public ATM, but a while back they were and I'd 
have had to shell out upwards of 240€ for one - with less bandwidth than 
I have now. There will be other differences (mainly in the area of 
reliability), but you get the idea.

Most people will not need a public IPv4 address or know what to do with 
one, so in most cases, noone cares. Considering this, I can get behind 
the approach of 1&1.

> All this is to squeeze the last drop out of IPv4 public addresses,
> which ran out in 2011.

Of course. IPv4 is still a way too important part of the net for it to 
be optional. My current ISP is one of the newer ones and as such only 
got a pretty small pool of IPv4 addresses. This is a way for them to 
function while plenty of bigger companies sit on there largely unused 
pools of addresses.

> So, I guess you're putting a tunnel inside an existing tunnel that
> goes to some faraway IPv4 NAT.  And I guess there's another NAT in
> your router, between your private IPv4 network and a single address on
> the other side of your router, within 100.64.0.0/10.  Is all that
> right?  Complicated.  Not surprising there's some trouble.

You are making it sound much more complicated than it is. :-)

The CGN and everything my ISP does is completely transparent to me. It 
works fine. Even the VPN-tunnel works fine: When I fire up the interface 
and do a traceroute (mtr), I can see that the route is completely 
different and begins in a different country. I can download things and 
everything. What now no longer works is using this little machine as a 
router. Once the wg0 interface is fired up, the Pi no longer passes on 
anything from a machine behind it. So the problem is more within the Pi 
itself. Put a little more graphically:

Case 1 (!Wireguard): Pi -> [genet0] -> inet
Case 2 (!Wireguard): comp -> [genet0] -> Pi -> [genet0] -> inet
Case 3  (Wireguard): Pi -> [wg0] -> inet
Case 4  (Wireguard): comp -> [genet0] -> Pi -> [wg0] -> inet

Cases 1-3 all work, only case 4 does not.

In cases 1 and 3, the traffic originates in the Pi, in the other two 
cases the traffic originates on a different computer. A Pi4 only has one 
ethernet connector (device genet0) and thus the traffic goes in and 
leaves via the same port. What it looks like to me is that no packets 
are moved between genet0 and the virtual device wg0. wg0 works in a 
different IP-space, so some NAT would clearly be required. But does this 
actually require a firewall config?

Best regards,
Chris