3 ms·
My point is, you deny by default and only allow your static ips at the FW. You need a firewall rule anyway to let the wg traffic through. WG was built to hand
by bongobingo1 4y ago
My point is, you deny by default and only allow your static ips at the FW.
You need a firewall rule anyway to let the wg traffic through.
WG was built to handle roaming, and the FW can do a great job of filtering by address already, so it makes sense to not bloat wg with extra code to me.
- yardstick 4y agoBut the FW can’t filter by source IP and key, which is important to some people. There’s a gap in security coverage between WG and FW. This is commonly supported by IPsec implementations already. Remember your WG service could be terminating many tunnels from many different sources. Some yes roaming may be valid. Others not. There is no way in WG to selectively disable roaming for some keys but not others. This may be an intentional design decision in WG but I would argue it’s a poor one due to the above.
- bongobingo1 4y agoAh yes, great point.