==== ifconfig ==== openssl rand -base64 32 -out 50.key rm -f 50.pub.tmp doas -n ifconfig wg50 create || true doas -n ifconfig wg50 wgkey "`cat 50.key`" doas -n ifconfig wg50 | awk '/wgpubkey/{print $2}' >50.pub.tmp mv 50.pub.tmp 50.pub openssl rand -base64 32 -out 51.key rm -f 51.pub.tmp doas -n ifconfig wg51 create || true doas -n ifconfig wg51 wgkey "`cat 51.key`" doas -n ifconfig wg51 | awk '/wgpubkey/{print $2}' >51.pub.tmp mv 51.pub.tmp 51.pub openssl rand -base64 32 -out 52.key rm -f 52.pub.tmp doas -n ifconfig wg52 create || true doas -n ifconfig wg52 wgkey "`cat 52.key`" doas -n ifconfig wg52 | awk '/wgpubkey/{print $2}' >52.pub.tmp mv 52.pub.tmp 52.pub openssl rand -base64 32 -out 53.key rm -f 53.pub.tmp doas -n ifconfig wg53 create || true doas -n ifconfig wg53 wgkey "`cat 53.key`" doas -n ifconfig wg53 | awk '/wgpubkey/{print $2}' >53.pub.tmp mv 53.pub.tmp 53.pub # destroy WireGuard and routing domain loopback interfaces doas -n ifconfig wg50 destroy doas -n ifconfig lo50 destroy ifconfig: lo50: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg51 destroy doas -n ifconfig lo51 destroy ifconfig: lo51: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg52 destroy doas -n ifconfig lo52 destroy ifconfig: lo52: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg53 destroy doas -n ifconfig lo53 destroy ifconfig: lo53: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) # create and configure WireGuard interfaces doas -n ifconfig wg50 create wgport 250 wgkey "`cat 50.key`" rdomain 50 doas -n ifconfig wg51 create wgport 251 wgkey "`cat 51.key`" rdomain 51 doas -n ifconfig wg52 create wgport 252 wgkey "`cat 52.key`" rdomain 52 doas -n ifconfig wg53 create wgport 253 wgkey "`cat 53.key`" rdomain 53 # local SRC, foreign DST, tunnel 4 doas -n ifconfig wg50 wgpeer "`cat 51.pub`" wgendpoint 127.0.0.1 251 wgaip 10.188.44.2/32 wgaip fdd7:e83e:66bc:46::2/128 # local SRC, foreign DST, tunnel 6 doas -n ifconfig wg52 wgpeer "`cat 53.pub`" wgendpoint ::1 253 wgaip 10.188.64.2/32 wgaip fdd7:e83e:66bc:66::2/128 # local SRC, foreign DST, tunnel 4 doas -n ifconfig wg50 inet 10.188.44.1/24 alias doas -n ifconfig wg50 inet6 fdd7:e83e:66bc:46::1/64 alias # local SRC, foreign DST, tunnel 6 doas -n ifconfig wg52 inet 10.188.64.1/24 alias doas -n ifconfig wg52 inet6 fdd7:e83e:66bc:66::1/64 alias # local DST, foreign SRC, tunnel 4 doas -n ifconfig wg51 wgpeer "`cat 50.pub`" wgendpoint 127.0.0.1 250 wgaip 10.188.44.1/32 wgaip fdd7:e83e:66bc:46::1/128 # local DST, foreign SRC, tunnel 6 doas -n ifconfig wg53 wgpeer "`cat 52.pub`" wgendpoint ::1 252 wgaip 10.188.64.1/32 wgaip fdd7:e83e:66bc:66::1/128 # local DST, foreign SRC, tunnel 4 doas -n ifconfig wg51 inet 10.188.44.2/24 alias doas -n ifconfig wg51 inet6 fdd7:e83e:66bc:46::2/64 alias # local DST, foreign SRC, tunnel 6 doas -n ifconfig wg53 inet 10.188.64.2/24 alias doas -n ifconfig wg53 inet6 fdd7:e83e:66bc:66::2/64 alias sleep 1 # Wait until DAD for inet6 tunnel addresses has finished. ==== run-route-tunnel4-addr4-src-dst ==== # Get route to local address. /sbin/route -n -T 50 get 10.188.44.1 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get 10.188.44.1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 50 get 10.188.44.2 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get 10.188.44.2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr4-src-dst ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=8.294 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 8.294/8.294/8.294/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=24.840 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 24.840/24.840/24.840/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 5 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:06:53.787635 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 96 to 0x4d499389 nonce 0 03:06:53.796434 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 96 to 0xdb7f5dc6 nonce 1 ==== run-badkey-tunnel4-addr4-src-dst ==== openssl rand -base64 32 -out bad.key # Ping foreign address with bad key. doas -n ifconfig wg50 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes --- 10.188.44.2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg50 wgkey "`cat 50.key`" /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=11.575 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 11.575/11.575/11.575/0.000 ms ==== run-route-tunnel4-addr4-dst-src ==== # Get route to local address. /sbin/route -n -T 51 get 10.188.44.2 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get 10.188.44.2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 51 get 10.188.44.1 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get 10.188.44.1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr4-dst-src ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=0.553 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.553/0.553/0.553/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=9.465 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 9.465/9.465/9.465/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:06:58.270943 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 96 to 0xe5a36299 nonce 3 03:06:58.276026 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 96 to 0x44cde79a nonce 2 ==== run-badkey-tunnel4-addr4-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg51 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes --- 10.188.44.1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg51 wgkey "`cat 51.key`" /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=7.058 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 7.058/7.058/7.058/0.000 ms ==== run-route-tunnel4-addr6-src-dst ==== # Get route to local address. /sbin/route -n -T 50 get fdd7:e83e:66bc:46::1 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get fdd7:e83e:66bc:46::1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 50 get fdd7:e83e:66bc:46::2 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get fdd7:e83e:66bc:46::2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr6-src-dst ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=0.538 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.538/0.538/0.538/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=0.660 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.660/0.660/0.660/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:02.766532 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 112 to 0xac2aabd9 nonce 3 03:07:02.766731 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 112 to 0xbfeff314 nonce 2 ==== run-badkey-tunnel4-addr6-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg50 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg50 wgkey "`cat 50.key`" /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=6.293 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 6.293/6.293/6.293/0.000 ms ==== run-route-tunnel4-addr6-dst-src ==== # Get route to local address. /sbin/route -n -T 51 get fdd7:e83e:66bc:46::2 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get fdd7:e83e:66bc:46::2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 51 get fdd7:e83e:66bc:46::1 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get fdd7:e83e:66bc:46::1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr6-dst-src ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=0.611 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.611/0.611/0.611/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=0.681 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.681/0.681/0.681/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:07.272448 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 112 to 0x1d410ee3 nonce 3 03:07:07.272857 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 112 to 0x2ada4c0f nonce 2 ==== run-badkey-tunnel4-addr6-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg51 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg51 wgkey "`cat 51.key`" /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=10.664 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 10.664/10.664/10.664/0.000 ms ==== run-route-tunnel6-addr4-src-dst ==== # Get route to local address. /sbin/route -n -T 52 get 10.188.64.1 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get 10.188.64.1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 52 get 10.188.64.2 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get 10.188.64.2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr4-src-dst ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=0.632 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.632/0.632/0.632/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=11.781 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 11.781/11.781/11.781/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 5 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:11.748737 ::1.252 > ::1.253: [wg] data length 96 to 0xbdc4742d nonce 0 03:07:11.753160 ::1.253 > ::1.252: [wg] data length 96 to 0x3cefd3d6 nonce 1 ==== run-badkey-tunnel6-addr4-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg52 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes --- 10.188.64.2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg52 wgkey "`cat 52.key`" /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=7.018 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 7.018/7.018/7.018/0.000 ms ==== run-route-tunnel6-addr4-dst-src ==== # Get route to local address. /sbin/route -n -T 53 get 10.188.64.2 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get 10.188.64.2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 53 get 10.188.64.1 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get 10.188.64.1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr4-dst-src ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=2.915 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 2.915/2.915/2.915/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=5.297 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 5.297/5.297/5.297/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:16.225371 ::1.253 > ::1.252: [wg] data length 96 to 0xbe3c1979 nonce 3 03:07:16.227418 ::1.252 > ::1.253: [wg] data length 96 to 0x8bef9ba5 nonce 2 ==== run-badkey-tunnel6-addr4-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg53 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes --- 10.188.64.1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg53 wgkey "`cat 53.key`" /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=10.215 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 10.215/10.215/10.215/0.000 ms ==== run-route-tunnel6-addr6-src-dst ==== # Get route to local address. /sbin/route -n -T 52 get fdd7:e83e:66bc:66::1 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get fdd7:e83e:66bc:66::1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 52 get fdd7:e83e:66bc:66::2 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get fdd7:e83e:66bc:66::2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr6-src-dst ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=0.523 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.523/0.523/0.523/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=1.671 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 1.671/1.671/1.671/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 3 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:20.747829 ::1.252 > ::1.253: [wg] data length 112 to 0xac1b6913 nonce 3 03:07:20.748795 ::1.253 > ::1.252: [wg] data length 112 to 0x7f1562a7 nonce 2 ==== run-badkey-tunnel6-addr6-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg52 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg52 wgkey "`cat 52.key`" /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=5.722 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 5.722/5.722/5.722/0.000 ms ==== run-route-tunnel6-addr6-dst-src ==== # Get route to local address. /sbin/route -n -T 53 get fdd7:e83e:66bc:66::2 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get fdd7:e83e:66bc:66::2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 53 get fdd7:e83e:66bc:66::1 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get fdd7:e83e:66bc:66::1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr6-dst-src ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=0.207 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.207/0.207/0.207/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=0.370 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.370/0.370/0.370/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:25.225015 ::1.253 > ::1.252: [wg] data length 112 to 0x860018f1 nonce 3 03:07:25.225165 ::1.252 > ::1.253: [wg] data length 112 to 0x2fc23569 nonce 2 ==== run-badkey-tunnel6-addr6-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg53 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg53 wgkey "`cat 53.key`" /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=5.940 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 5.940/5.940/5.940/0.000 ms ==== unconfig ==== # destroy WireGuard and routing domain loopback interfaces doas -n ifconfig wg50 destroy doas -n ifconfig lo50 destroy doas -n ifconfig wg51 destroy doas -n ifconfig lo51 destroy doas -n ifconfig wg52 destroy doas -n ifconfig lo52 destroy doas -n ifconfig wg53 destroy doas -n ifconfig lo53 destroy