==== ifconfig ==== openssl rand -base64 32 -out 50.key rm -f 50.pub.tmp doas -n ifconfig wg50 create || true doas -n ifconfig wg50 wgkey "`cat 50.key`" doas -n ifconfig wg50 | awk '/wgpubkey/{print $2}' >50.pub.tmp mv 50.pub.tmp 50.pub openssl rand -base64 32 -out 51.key rm -f 51.pub.tmp doas -n ifconfig wg51 create || true doas -n ifconfig wg51 wgkey "`cat 51.key`" doas -n ifconfig wg51 | awk '/wgpubkey/{print $2}' >51.pub.tmp mv 51.pub.tmp 51.pub openssl rand -base64 32 -out 52.key rm -f 52.pub.tmp doas -n ifconfig wg52 create || true doas -n ifconfig wg52 wgkey "`cat 52.key`" doas -n ifconfig wg52 | awk '/wgpubkey/{print $2}' >52.pub.tmp mv 52.pub.tmp 52.pub openssl rand -base64 32 -out 53.key rm -f 53.pub.tmp doas -n ifconfig wg53 create || true doas -n ifconfig wg53 wgkey "`cat 53.key`" doas -n ifconfig wg53 | awk '/wgpubkey/{print $2}' >53.pub.tmp mv 53.pub.tmp 53.pub # destroy WireGuard and routing domain loopback interfaces doas -n ifconfig wg50 destroy doas -n ifconfig lo50 destroy ifconfig: lo50: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg51 destroy doas -n ifconfig lo51 destroy ifconfig: lo51: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg52 destroy doas -n ifconfig lo52 destroy ifconfig: lo52: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg53 destroy doas -n ifconfig lo53 destroy ifconfig: lo53: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) # create and configure WireGuard interfaces doas -n ifconfig wg50 create wgport 250 wgkey "`cat 50.key`" rdomain 50 doas -n ifconfig wg51 create wgport 251 wgkey "`cat 51.key`" rdomain 51 doas -n ifconfig wg52 create wgport 252 wgkey "`cat 52.key`" rdomain 52 doas -n ifconfig wg53 create wgport 253 wgkey "`cat 53.key`" rdomain 53 # local SRC, foreign DST, tunnel 4 doas -n ifconfig wg50 wgpeer "`cat 51.pub`" wgendpoint 127.0.0.1 251 wgaip 10.188.44.2/32 wgaip fdd7:e83e:66bc:46::2/128 # local SRC, foreign DST, tunnel 6 doas -n ifconfig wg52 wgpeer "`cat 53.pub`" wgendpoint ::1 253 wgaip 10.188.64.2/32 wgaip fdd7:e83e:66bc:66::2/128 # local SRC, foreign DST, tunnel 4 doas -n ifconfig wg50 inet 10.188.44.1/24 alias doas -n ifconfig wg50 inet6 fdd7:e83e:66bc:46::1/64 alias # local SRC, foreign DST, tunnel 6 doas -n ifconfig wg52 inet 10.188.64.1/24 alias doas -n ifconfig wg52 inet6 fdd7:e83e:66bc:66::1/64 alias # local DST, foreign SRC, tunnel 4 doas -n ifconfig wg51 wgpeer "`cat 50.pub`" wgendpoint 127.0.0.1 250 wgaip 10.188.44.1/32 wgaip fdd7:e83e:66bc:46::1/128 # local DST, foreign SRC, tunnel 6 doas -n ifconfig wg53 wgpeer "`cat 52.pub`" wgendpoint ::1 252 wgaip 10.188.64.1/32 wgaip fdd7:e83e:66bc:66::1/128 # local DST, foreign SRC, tunnel 4 doas -n ifconfig wg51 inet 10.188.44.2/24 alias doas -n ifconfig wg51 inet6 fdd7:e83e:66bc:46::2/64 alias # local DST, foreign SRC, tunnel 6 doas -n ifconfig wg53 inet 10.188.64.2/24 alias doas -n ifconfig wg53 inet6 fdd7:e83e:66bc:66::2/64 alias sleep 1 # Wait until DAD for inet6 tunnel addresses has finished. ==== run-route-tunnel4-addr4-src-dst ==== # Get route to local address. /sbin/route -n -T 50 get 10.188.44.1 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get 10.188.44.1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 50 get 10.188.44.2 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get 10.188.44.2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr4-src-dst ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=4.541 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 4.541/4.541/4.541/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=19.680 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 19.680/19.680/19.680/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 5 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:06:50.721047 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 96 to 0x2a4e7032 nonce 0 03:06:50.724897 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 96 to 0x1aac546b nonce 1 ==== run-badkey-tunnel4-addr4-src-dst ==== openssl rand -base64 32 -out bad.key # Ping foreign address with bad key. doas -n ifconfig wg50 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes --- 10.188.44.2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg50 wgkey "`cat 50.key`" /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=27.349 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 27.349/27.349/27.349/0.000 ms ==== run-route-tunnel4-addr4-dst-src ==== # Get route to local address. /sbin/route -n -T 51 get 10.188.44.2 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get 10.188.44.2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 51 get 10.188.44.1 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get 10.188.44.1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr4-dst-src ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=11.118 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 11.118/11.118/11.118/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=11.298 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 11.298/11.298/11.298/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:06:55.256073 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 96 to 0xce9ba5f2 nonce 3 03:06:55.260283 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 96 to 0xc8c47eef nonce 2 ==== run-badkey-tunnel4-addr4-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg51 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes --- 10.188.44.1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg51 wgkey "`cat 51.key`" /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=6.051 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 6.051/6.051/6.051/0.000 ms ==== run-route-tunnel4-addr6-src-dst ==== # Get route to local address. /sbin/route -n -T 50 get fdd7:e83e:66bc:46::1 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get fdd7:e83e:66bc:46::1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 50 get fdd7:e83e:66bc:46::2 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get fdd7:e83e:66bc:46::2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr6-src-dst ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=0.395 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.395/0.395/0.395/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=0.669 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.669/0.669/0.669/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:06:59.720130 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 112 to 0x35e0b1e9 nonce 3 03:06:59.720565 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 112 to 0x2a268e8a nonce 2 ==== run-badkey-tunnel4-addr6-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg50 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg50 wgkey "`cat 50.key`" /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=6.445 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 6.445/6.445/6.445/0.000 ms ==== run-route-tunnel4-addr6-dst-src ==== # Get route to local address. /sbin/route -n -T 51 get fdd7:e83e:66bc:46::2 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get fdd7:e83e:66bc:46::2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 51 get fdd7:e83e:66bc:46::1 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get fdd7:e83e:66bc:46::1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr6-dst-src ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=0.457 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.457/0.457/0.457/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=1.378 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 1.378/1.378/1.378/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:04.211191 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 112 to 0xd9fe3094 nonce 3 03:07:04.211802 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 112 to 0x7fcc3b3d nonce 2 ==== run-badkey-tunnel4-addr6-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg51 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg51 wgkey "`cat 51.key`" /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=6.775 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 6.775/6.775/6.775/0.000 ms ==== run-route-tunnel6-addr4-src-dst ==== # Get route to local address. /sbin/route -n -T 52 get 10.188.64.1 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get 10.188.64.1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 52 get 10.188.64.2 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get 10.188.64.2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr4-src-dst ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=0.250 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.250/0.250/0.250/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=5.779 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 5.779/5.779/5.779/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 5 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:08.706231 ::1.252 > ::1.253: [wg] data length 96 to 0xb4126f01 nonce 0 03:07:08.706592 ::1.253 > ::1.252: [wg] data length 96 to 0x35a2e826 nonce 1 ==== run-badkey-tunnel6-addr4-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg52 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes --- 10.188.64.2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg52 wgkey "`cat 52.key`" /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=27.845 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 27.845/27.845/27.845/0.000 ms ==== run-route-tunnel6-addr4-dst-src ==== # Get route to local address. /sbin/route -n -T 53 get 10.188.64.2 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get 10.188.64.2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 53 get 10.188.64.1 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get 10.188.64.1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr4-dst-src ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=10.457 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 10.457/10.457/10.457/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=16.796 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 16.796/16.796/16.796/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:13.243261 ::1.253 > ::1.252: [wg] data length 96 to 0xbac0488d nonce 3 03:07:13.251890 ::1.252 > ::1.253: [wg] data length 96 to 0x0872c0d4 nonce 2 ==== run-badkey-tunnel6-addr4-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg53 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes --- 10.188.64.1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg53 wgkey "`cat 53.key`" /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=10.531 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 10.531/10.531/10.531/0.000 ms ==== run-route-tunnel6-addr6-src-dst ==== # Get route to local address. /sbin/route -n -T 52 get fdd7:e83e:66bc:66::1 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get fdd7:e83e:66bc:66::1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 52 get fdd7:e83e:66bc:66::2 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get fdd7:e83e:66bc:66::2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr6-src-dst ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=3.622 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 3.622/3.622/3.622/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=14.821 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 14.821/14.821/14.821/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 3 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:17.748388 ::1.252 > ::1.253: [wg] data length 112 to 0x63feded3 nonce 3 03:07:17.756692 ::1.253 > ::1.252: [wg] data length 112 to 0x0df43a8c nonce 2 ==== run-badkey-tunnel6-addr6-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg52 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg52 wgkey "`cat 52.key`" /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=17.901 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 17.901/17.901/17.901/0.000 ms ==== run-route-tunnel6-addr6-dst-src ==== # Get route to local address. /sbin/route -n -T 53 get fdd7:e83e:66bc:66::2 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get fdd7:e83e:66bc:66::2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 53 get fdd7:e83e:66bc:66::1 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get fdd7:e83e:66bc:66::1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr6-dst-src ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=2.863 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 2.863/2.863/2.863/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=3.156 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 3.156/3.156/3.156/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:22.345355 ::1.253 > ::1.252: [wg] data length 112 to 0xdacbde6d nonce 3 03:07:22.347284 ::1.252 > ::1.253: [wg] data length 112 to 0x9637048d nonce 2 ==== run-badkey-tunnel6-addr6-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg53 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg53 wgkey "`cat 53.key`" /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=4.752 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 4.752/4.752/4.752/0.000 ms ==== unconfig ==== # destroy WireGuard and routing domain loopback interfaces doas -n ifconfig wg50 destroy doas -n ifconfig lo50 destroy doas -n ifconfig wg51 destroy doas -n ifconfig lo51 destroy doas -n ifconfig wg52 destroy doas -n ifconfig lo52 destroy doas -n ifconfig wg53 destroy doas -n ifconfig lo53 destroy