I originally wrote about this on my Armenian blog when ISPs started blocking DNS queries during and after the war. I was forces to use either 9.9.9.9, 1.1.1.1, 8.8.8.8 or any other major DNS resolver. For me this was a pain because I was not able to dig +trace, and I dig +trace a lot.
After some digging (as mentioned in the Armenian blog) I was able to figure out that this affects only the home users. Luckily, I also run servers at my home and the ISPs were not blocking anything on those “server” ranges, so I setup WireGuard.
This post is not about setting up WireGuard, there are plenty of posts and articles on the internet about that.
Over time my network became larger. I also started having servers outside of my network. One of the fast (and probably wrong) ways of restricting access to my servers was allowing traffic only from my own network.
I have a server that acts as WireGuard VPN Peer and does NAT-ing. That being said, the easiest way for me to start accessing my restricted servers is by doing route add restricted_server_addr -interface wg0.
Turns out I needed to write some code for that, which I love to do!
Anytime that I need to setup a WireGuard VPN client I go back to my Armenian post and read there, so now I’ll be blogging how to do dynamic routing with WireGuard so I read whenever I need to. I hope it becomes handy for you too!
Now, let’s assume you need to add a.b.c.d in your routes, usually you’d do route add a.b.c.d -interface wg0, but this would not work, since in your WireGuard configuration you have a line that says
[Peer]
AllowedIPs = w.x.y.z/24
Which means, even if you add the route, the WireGuard application/kernel module will not route those packets.
To achieve “dynamic” routing we could do
[Peer]
AllowedIPs = 0.0.0.0/0
This, however will route ALL your traffic via WireGuard, which is also something you don’t want, you want to add routes at runtime.
What we could do, however, is to ask WireGuard to NOT add the routes automatically. Here’s how.
[Interface]
PrivateKey = your_private_key
Address = w.x.y.z/32
Table = off
PostUp = /usr/local/etc/wireguard/add_routes.sh %i
DNS = w.z.y.1
[Peer]
PublicKey = their_public_key
PresharedKey = pre_shared_key
AllowedIPs = 0.0.0.0/0
Endpoint = your_server_addr:wg_port
The two key points here are Table = off which asks WireGuard to not add the routes automatically and PostUp = /usr/local/etc/wireguard/add_routes.sh %i which is a script that does add the routes, where %i is expanded to the WireGuard interface name; could be wg0, could be home0, depends in your configuration.
Now for add_routes.sh we write the following.
#!/bin/sh
interface=${1}
networks="""
w.x.y.0/24
restricted_server_addr/32
another_server/32
"""
for _n in ${networks};
do
route -q -n add ${_n} -interface ${interface}
done
And we can finally do wg-quick up server0.conf
If you need to add another route while WireGuard is running, you can do
route add another_restricted_server -interface wg0
Okay, what if you need to route everything while WireGuard is running? Well, that’s easy too!
First, find your default gateway.
% route -n get default | grep gateway
gateway: your_gateway
Next, add a route for your endpoint via your current default gateway.
route add you_server_addr your_gateway
Next, add TWO routes for WireGuard.
route add 0.0.0.0/1 -interface wg0
route add 128.0.0.0/1 -interface wg0
So it’s the two halves of the Internet π
That’s all folks!