4 ms·
Anyone else having the issue of how to distinguish traffic from specific peers, and how did you solve it? Other than having an interface per peer of course.
by rudasn 2y ago
Anyone else having the issue of how to distinguish traffic from specific peers, and how did you solve it?
Other than having an interface per peer of course.
- djbusby 2y agoDoesn't the peer have a VPN-IP that you know? Eg: my SQL server has one WG and I've got N clients. They are each connecting with their key and assigned IP. So firewall rules will do it.
- rudasn 2y agoWell, yes, but then you are relying on IP address based auth of some sort. It's just more stuff to keep around, share, and make sure its correct. If routing was possible with just the public key, after wg has verified the packets, I would assume it'd be easier to maintain (and more flexible). For example, I could run a "public" wg peer where peers could just join me without me messing with cidrs and whatnot. I wouldn't care what their vpn ip is, as I may not be their only peer and they could be using any number of internal addressess.
- ta1243 2y agoI assume you're looking at encrypted traffic on the wire? You can see the endpoint it's going to, and "sudo wg" will show those endpoint IP/port, each of which will be unique. Obviously inside the tunnel that's what the source IP is for.