==== ifconfig ==== openssl rand -base64 32 -out 50.key rm -f 50.pub.tmp doas -n ifconfig wg50 create || true doas -n ifconfig wg50 wgkey "`cat 50.key`" doas -n ifconfig wg50 | awk '/wgpubkey/{print $2}' >50.pub.tmp mv 50.pub.tmp 50.pub openssl rand -base64 32 -out 51.key rm -f 51.pub.tmp doas -n ifconfig wg51 create || true doas -n ifconfig wg51 wgkey "`cat 51.key`" doas -n ifconfig wg51 | awk '/wgpubkey/{print $2}' >51.pub.tmp mv 51.pub.tmp 51.pub openssl rand -base64 32 -out 52.key rm -f 52.pub.tmp doas -n ifconfig wg52 create || true doas -n ifconfig wg52 wgkey "`cat 52.key`" doas -n ifconfig wg52 | awk '/wgpubkey/{print $2}' >52.pub.tmp mv 52.pub.tmp 52.pub openssl rand -base64 32 -out 53.key rm -f 53.pub.tmp doas -n ifconfig wg53 create || true doas -n ifconfig wg53 wgkey "`cat 53.key`" doas -n ifconfig wg53 | awk '/wgpubkey/{print $2}' >53.pub.tmp mv 53.pub.tmp 53.pub # destroy WireGuard and routing domain loopback interfaces doas -n ifconfig wg50 destroy doas -n ifconfig lo50 destroy ifconfig: lo50: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg51 destroy doas -n ifconfig lo51 destroy ifconfig: lo51: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg52 destroy doas -n ifconfig lo52 destroy ifconfig: lo52: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg53 destroy doas -n ifconfig lo53 destroy ifconfig: lo53: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) # create and configure WireGuard interfaces doas -n ifconfig wg50 create wgport 250 wgkey "`cat 50.key`" rdomain 50 doas -n ifconfig wg51 create wgport 251 wgkey "`cat 51.key`" rdomain 51 doas -n ifconfig wg52 create wgport 252 wgkey "`cat 52.key`" rdomain 52 doas -n ifconfig wg53 create wgport 253 wgkey "`cat 53.key`" rdomain 53 # local SRC, foreign DST, tunnel 4 doas -n ifconfig wg50 wgpeer "`cat 51.pub`" wgendpoint 127.0.0.1 251 wgaip 10.188.44.2/32 wgaip fdd7:e83e:66bc:46::2/128 # local SRC, foreign DST, tunnel 6 doas -n ifconfig wg52 wgpeer "`cat 53.pub`" wgendpoint ::1 253 wgaip 10.188.64.2/32 wgaip fdd7:e83e:66bc:66::2/128 # local SRC, foreign DST, tunnel 4 doas -n ifconfig wg50 inet 10.188.44.1/24 alias doas -n ifconfig wg50 inet6 fdd7:e83e:66bc:46::1/64 alias # local SRC, foreign DST, tunnel 6 doas -n ifconfig wg52 inet 10.188.64.1/24 alias doas -n ifconfig wg52 inet6 fdd7:e83e:66bc:66::1/64 alias # local DST, foreign SRC, tunnel 4 doas -n ifconfig wg51 wgpeer "`cat 50.pub`" wgendpoint 127.0.0.1 250 wgaip 10.188.44.1/32 wgaip fdd7:e83e:66bc:46::1/128 # local DST, foreign SRC, tunnel 6 doas -n ifconfig wg53 wgpeer "`cat 52.pub`" wgendpoint ::1 252 wgaip 10.188.64.1/32 wgaip fdd7:e83e:66bc:66::1/128 # local DST, foreign SRC, tunnel 4 doas -n ifconfig wg51 inet 10.188.44.2/24 alias doas -n ifconfig wg51 inet6 fdd7:e83e:66bc:46::2/64 alias # local DST, foreign SRC, tunnel 6 doas -n ifconfig wg53 inet 10.188.64.2/24 alias doas -n ifconfig wg53 inet6 fdd7:e83e:66bc:66::2/64 alias sleep 1 # Wait until DAD for inet6 tunnel addresses has finished. ==== run-route-tunnel4-addr4-src-dst ==== # Get route to local address. /sbin/route -n -T 50 get 10.188.44.1 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get 10.188.44.1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 50 get 10.188.44.2 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get 10.188.44.2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr4-src-dst ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=7.424 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 7.424/7.424/7.424/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=10.975 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 10.975/10.975/10.975/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 5 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:08:19.207170 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 96 to 0xc3771fc7 nonce 0 03:08:19.209076 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 96 to 0x2c166c60 nonce 1 ==== run-badkey-tunnel4-addr4-src-dst ==== openssl rand -base64 32 -out bad.key # Ping foreign address with bad key. doas -n ifconfig wg50 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes --- 10.188.44.2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg50 wgkey "`cat 50.key`" /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=5.752 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 5.752/5.752/5.752/0.000 ms ==== run-route-tunnel4-addr4-dst-src ==== # Get route to local address. /sbin/route -n -T 51 get 10.188.44.2 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get 10.188.44.2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 51 get 10.188.44.1 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get 10.188.44.1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr4-dst-src ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=0.321 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.321/0.321/0.321/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=0.669 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.669/0.669/0.669/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:08:23.678033 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 96 to 0xa18d86d1 nonce 3 03:08:23.678209 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 96 to 0xe1195da4 nonce 2 ==== run-badkey-tunnel4-addr4-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg51 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes --- 10.188.44.1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg51 wgkey "`cat 51.key`" /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=3.638 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 3.638/3.638/3.638/0.000 ms ==== run-route-tunnel4-addr6-src-dst ==== # Get route to local address. /sbin/route -n -T 50 get fdd7:e83e:66bc:46::1 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get fdd7:e83e:66bc:46::1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 50 get fdd7:e83e:66bc:46::2 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get fdd7:e83e:66bc:46::2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr6-src-dst ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=0.389 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.389/0.389/0.389/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=3.281 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 3.281/3.281/3.281/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:08:28.163100 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 112 to 0x9444f1dd nonce 3 03:08:28.165269 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 112 to 0x5c311a95 nonce 2 ==== run-badkey-tunnel4-addr6-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg50 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg50 wgkey "`cat 50.key`" /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=9.997 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 9.997/9.997/9.997/0.000 ms ==== run-route-tunnel4-addr6-dst-src ==== # Get route to local address. /sbin/route -n -T 51 get fdd7:e83e:66bc:46::2 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get fdd7:e83e:66bc:46::2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 51 get fdd7:e83e:66bc:46::1 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get fdd7:e83e:66bc:46::1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr6-dst-src ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=1.854 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 1.854/1.854/1.854/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=6.645 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 6.645/6.645/6.645/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:08:32.667603 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 112 to 0xfcc5c126 nonce 3 03:08:32.670478 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 112 to 0xb21ab143 nonce 2 ==== run-badkey-tunnel4-addr6-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg51 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg51 wgkey "`cat 51.key`" /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=6.965 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 6.965/6.965/6.965/0.000 ms ==== run-route-tunnel6-addr4-src-dst ==== # Get route to local address. /sbin/route -n -T 52 get 10.188.64.1 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get 10.188.64.1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 52 get 10.188.64.2 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get 10.188.64.2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr4-src-dst ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=1.175 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 1.175/1.175/1.175/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=21.910 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 21.910/21.910/21.910/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 5 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:08:37.185356 ::1.252 > ::1.253: [wg] data length 96 to 0x73da29f6 nonce 0 03:08:37.196616 ::1.253 > ::1.252: [wg] data length 96 to 0x335571e1 nonce 1 ==== run-badkey-tunnel6-addr4-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg52 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes --- 10.188.64.2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg52 wgkey "`cat 52.key`" /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=7.515 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 7.515/7.515/7.515/0.000 ms ==== run-route-tunnel6-addr4-dst-src ==== # Get route to local address. /sbin/route -n -T 53 get 10.188.64.2 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get 10.188.64.2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 53 get 10.188.64.1 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get 10.188.64.1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr4-dst-src ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=3.133 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 3.133/3.133/3.133/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=7.502 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 7.502/7.502/7.502/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:08:41.660560 ::1.253 > ::1.252: [wg] data length 96 to 0x86badf73 nonce 3 03:08:41.664107 ::1.252 > ::1.253: [wg] data length 96 to 0x2897793a nonce 2 ==== run-badkey-tunnel6-addr4-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg53 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes --- 10.188.64.1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg53 wgkey "`cat 53.key`" /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=12.302 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 12.302/12.302/12.302/0.000 ms ==== run-route-tunnel6-addr6-src-dst ==== # Get route to local address. /sbin/route -n -T 52 get fdd7:e83e:66bc:66::1 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get fdd7:e83e:66bc:66::1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 52 get fdd7:e83e:66bc:66::2 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get fdd7:e83e:66bc:66::2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr6-src-dst ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=8.217 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 8.217/8.217/8.217/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=0.348 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.348/0.348/0.348/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 3 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:08:46.179161 ::1.252 > ::1.253: [wg] data length 112 to 0x28af3e19 nonce 3 03:08:46.179294 ::1.253 > ::1.252: [wg] data length 112 to 0x2700fa96 nonce 2 ==== run-badkey-tunnel6-addr6-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg52 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg52 wgkey "`cat 52.key`" /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=5.922 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 5.922/5.922/5.922/0.000 ms ==== run-route-tunnel6-addr6-dst-src ==== # Get route to local address. /sbin/route -n -T 53 get fdd7:e83e:66bc:66::2 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get fdd7:e83e:66bc:66::2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 53 get fdd7:e83e:66bc:66::1 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get fdd7:e83e:66bc:66::1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr6-dst-src ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=0.174 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.174/0.174/0.174/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=0.496 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.496/0.496/0.496/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:08:50.651815 ::1.253 > ::1.252: [wg] data length 112 to 0xa1f10702 nonce 3 03:08:50.652069 ::1.252 > ::1.253: [wg] data length 112 to 0x8d28cecd nonce 2 ==== run-badkey-tunnel6-addr6-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg53 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg53 wgkey "`cat 53.key`" /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=5.899 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 5.899/5.899/5.899/0.000 ms ==== unconfig ==== # destroy WireGuard and routing domain loopback interfaces doas -n ifconfig wg50 destroy doas -n ifconfig lo50 destroy doas -n ifconfig wg51 destroy doas -n ifconfig lo51 destroy doas -n ifconfig wg52 destroy doas -n ifconfig lo52 destroy doas -n ifconfig wg53 destroy doas -n ifconfig lo53 destroy