4 ms·

Wireguard will keep contacting the remote server. You'd have to delete the wg0 interface or delete the default route for packets to go out via ens0. Wireguard o

by megous 5y ago

Wireguard will keep contacting the remote server. You'd have to delete the wg0 interface or delete the default route for packets to go out via ens0. Wireguard only has "connection" in a sense that it caches some runtime information about the peer's endpoint, but endpoint configuration is static. I guess, too much magic automation on top of this is not the best thing for opsec, including having some daemon that can disable your wireguard interface or reconfigure the network if it doesn't like something. You want your network configuration to be static and predictable, regardless of some temporary failures. Basic wireguard kernel primitives will give you that.

mynameisvlad 5y ago
> You'd have to delete the wg0 interface or delete the default route for packets to go out via ens0 So... You'd have to do work to properly blackhole traffic when wg0 goes down. However long it takes to reconnect, you still will automatically fall back down to ens0 while it's down unless you do something to stop that.
- midasuni 5y ago
  How does wg0 go down?
- megous 5y ago
  wg0 doesn't go down by itself. Packets are always delivered to wg interface as long as it is marked as 'UP' (or 'enabled', if 'UP' sounds to you like having anything to do with some kind of "connection") when your routing table directs them there. When they hit the wg interface when the other endpoint is unreachable for whatever reason, they are either dropped, or queued, or get ICMP unreachable response generated for them, depending on situation. This is done internally by wireguard.
- tertius 5y ago
  You have a route to stop that. You route 0.0.0.0/0 through wg0 and it doesn't matter if no traffic returns, it'll keep trying because that's the route that's been defined for wg0. If you wanted to not go through wg0 (whether it can reach the other wireguard peer or not) you'd have to remove the routes first.

by megous 5y ago

mynameisvlad 5y ago

> You'd have to delete the wg0 interface or delete the default route for packets to go out via ens0 So... You'd have to do work to properly blackhole traffic when wg0 goes down. However long it takes to reconnect, you still will automatically fall back down to ens0 while it's down unless you do something to stop that.

midasuni 5y ago
How does wg0 go down?
megous 5y ago
wg0 doesn't go down by itself. Packets are always delivered to wg interface as long as it is marked as 'UP' (or 'enabled', if 'UP' sounds to you like having anything to do with some kind of "connection") when your routing table directs them there. When they hit the wg interface when the other endpoint is unreachable for whatever reason, they are either dropped, or queued, or get ICMP unreachable response generated for them, depending on situation. This is done internally by wireguard.
tertius 5y ago
You have a route to stop that. You route 0.0.0.0/0 through wg0 and it doesn't matter if no traffic returns, it'll keep trying because that's the route that's been defined for wg0. If you wanted to not go through wg0 (whether it can reach the other wireguard peer or not) you'd have to remove the routes first.