==== ifconfig ==== openssl rand -base64 32 -out 50.key rm -f 50.pub.tmp doas -n ifconfig wg50 create || true doas -n ifconfig wg50 wgkey "`cat 50.key`" doas -n ifconfig wg50 | awk '/wgpubkey/{print $2}' >50.pub.tmp mv 50.pub.tmp 50.pub openssl rand -base64 32 -out 51.key rm -f 51.pub.tmp doas -n ifconfig wg51 create || true doas -n ifconfig wg51 wgkey "`cat 51.key`" doas -n ifconfig wg51 | awk '/wgpubkey/{print $2}' >51.pub.tmp mv 51.pub.tmp 51.pub openssl rand -base64 32 -out 52.key rm -f 52.pub.tmp doas -n ifconfig wg52 create || true doas -n ifconfig wg52 wgkey "`cat 52.key`" doas -n ifconfig wg52 | awk '/wgpubkey/{print $2}' >52.pub.tmp mv 52.pub.tmp 52.pub openssl rand -base64 32 -out 53.key rm -f 53.pub.tmp doas -n ifconfig wg53 create || true doas -n ifconfig wg53 wgkey "`cat 53.key`" doas -n ifconfig wg53 | awk '/wgpubkey/{print $2}' >53.pub.tmp mv 53.pub.tmp 53.pub # destroy WireGuard and routing domain loopback interfaces doas -n ifconfig wg50 destroy doas -n ifconfig lo50 destroy ifconfig: lo50: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg51 destroy doas -n ifconfig lo51 destroy ifconfig: lo51: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg52 destroy doas -n ifconfig lo52 destroy ifconfig: lo52: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) doas -n ifconfig wg53 destroy doas -n ifconfig lo53 destroy ifconfig: lo53: SIOCIFDESTROY: Device not configured *** Error 1 in target 'unconfig' (ignored) # create and configure WireGuard interfaces doas -n ifconfig wg50 create wgport 250 wgkey "`cat 50.key`" rdomain 50 doas -n ifconfig wg51 create wgport 251 wgkey "`cat 51.key`" rdomain 51 doas -n ifconfig wg52 create wgport 252 wgkey "`cat 52.key`" rdomain 52 doas -n ifconfig wg53 create wgport 253 wgkey "`cat 53.key`" rdomain 53 # local SRC, foreign DST, tunnel 4 doas -n ifconfig wg50 wgpeer "`cat 51.pub`" wgendpoint 127.0.0.1 251 wgaip 10.188.44.2/32 wgaip fdd7:e83e:66bc:46::2/128 # local SRC, foreign DST, tunnel 6 doas -n ifconfig wg52 wgpeer "`cat 53.pub`" wgendpoint ::1 253 wgaip 10.188.64.2/32 wgaip fdd7:e83e:66bc:66::2/128 # local SRC, foreign DST, tunnel 4 doas -n ifconfig wg50 inet 10.188.44.1/24 alias doas -n ifconfig wg50 inet6 fdd7:e83e:66bc:46::1/64 alias # local SRC, foreign DST, tunnel 6 doas -n ifconfig wg52 inet 10.188.64.1/24 alias doas -n ifconfig wg52 inet6 fdd7:e83e:66bc:66::1/64 alias # local DST, foreign SRC, tunnel 4 doas -n ifconfig wg51 wgpeer "`cat 50.pub`" wgendpoint 127.0.0.1 250 wgaip 10.188.44.1/32 wgaip fdd7:e83e:66bc:46::1/128 # local DST, foreign SRC, tunnel 6 doas -n ifconfig wg53 wgpeer "`cat 52.pub`" wgendpoint ::1 252 wgaip 10.188.64.1/32 wgaip fdd7:e83e:66bc:66::1/128 # local DST, foreign SRC, tunnel 4 doas -n ifconfig wg51 inet 10.188.44.2/24 alias doas -n ifconfig wg51 inet6 fdd7:e83e:66bc:46::2/64 alias # local DST, foreign SRC, tunnel 6 doas -n ifconfig wg53 inet 10.188.64.2/24 alias doas -n ifconfig wg53 inet6 fdd7:e83e:66bc:66::2/64 alias sleep 1 # Wait until DAD for inet6 tunnel addresses has finished. ==== run-route-tunnel4-addr4-src-dst ==== # Get route to local address. /sbin/route -n -T 50 get 10.188.44.1 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get 10.188.44.1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 50 get 10.188.44.2 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get 10.188.44.2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr4-src-dst ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=0.114 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.114/0.114/0.114/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=11.705 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 11.705/11.705/11.705/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 5 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:17.034386 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 96 to 0x4e0d3ed2 nonce 0 03:07:17.038246 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 96 to 0x0296c21a nonce 1 ==== run-badkey-tunnel4-addr4-src-dst ==== openssl rand -base64 32 -out bad.key # Ping foreign address with bad key. doas -n ifconfig wg50 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes --- 10.188.44.2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg50 wgkey "`cat 50.key`" /sbin/ping -n -w 1 -c 1 -V 50 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=13.924 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 13.924/13.924/13.924/0.000 ms ==== run-route-tunnel4-addr4-dst-src ==== # Get route to local address. /sbin/route -n -T 51 get 10.188.44.2 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get 10.188.44.2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 51 get 10.188.44.1 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get 10.188.44.1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr4-dst-src ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.2 PING 10.188.44.2 (10.188.44.2): 56 data bytes 64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=26.215 ms --- 10.188.44.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 26.215/26.215/26.215/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=10.480 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 10.480/10.480/10.480/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:21.562567 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 96 to 0x80f12468 nonce 3 03:07:21.567212 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 96 to 0x6d7c0aa9 nonce 2 ==== run-badkey-tunnel4-addr4-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg51 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes --- 10.188.44.1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg51 wgkey "`cat 51.key`" /sbin/ping -n -w 1 -c 1 -V 51 10.188.44.1 PING 10.188.44.1 (10.188.44.1): 56 data bytes 64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=6.435 ms --- 10.188.44.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 6.435/6.435/6.435/0.000 ms ==== run-route-tunnel4-addr6-src-dst ==== # Get route to local address. /sbin/route -n -T 50 get fdd7:e83e:66bc:46::1 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get fdd7:e83e:66bc:46::1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 50 get fdd7:e83e:66bc:46::2 | grep 'interface: wg50$' interface: wg50 /sbin/route -n -T 50 get fdd7:e83e:66bc:46::2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr6-src-dst ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=0.230 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.230/0.230/0.230/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=1.250 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 1.250/1.250/1.250/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:26.087107 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 112 to 0x98cf7fb5 nonce 3 03:07:26.087928 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 112 to 0xb4d6dd96 nonce 2 ==== run-badkey-tunnel4-addr6-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg50 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg50 wgkey "`cat 50.key`" /sbin/ping6 -n -w 1 -c 1 -V 50 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=6.747 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 6.747/6.747/6.747/0.000 ms ==== run-route-tunnel4-addr6-dst-src ==== # Get route to local address. /sbin/route -n -T 51 get fdd7:e83e:66bc:46::2 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get fdd7:e83e:66bc:46::2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 51 get fdd7:e83e:66bc:46::1 | grep 'interface: wg51$' interface: wg51 /sbin/route -n -T 51 get fdd7:e83e:66bc:46::1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel4-addr6-dst-src ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::2 PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=0.317 ms --- fdd7:e83e:66bc:46::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.317/0.317/0.317/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=1.071 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 1.071/1.071/1.071/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:30.612185 127.0.0.1.251 > 127.0.0.1.250: [wg] data length 112 to 0xfe3e02b7 nonce 3 03:07:30.612888 127.0.0.1.250 > 127.0.0.1.251: [wg] data length 112 to 0xa0601d1f nonce 2 ==== run-badkey-tunnel4-addr6-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg51 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg51 wgkey "`cat 51.key`" /sbin/ping6 -n -w 1 -c 1 -V 51 fdd7:e83e:66bc:46::1 PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=6.241 ms --- fdd7:e83e:66bc:46::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 6.241/6.241/6.241/0.000 ms ==== run-route-tunnel6-addr4-src-dst ==== # Get route to local address. /sbin/route -n -T 52 get 10.188.64.1 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get 10.188.64.1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 52 get 10.188.64.2 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get 10.188.64.2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr4-src-dst ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=0.443 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.443/0.443/0.443/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=3.688 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 3.688/3.688/3.688/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 5 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:35.079866 ::1.252 > ::1.253: [wg] data length 96 to 0xcb0de7a0 nonce 0 03:07:35.080012 ::1.253 > ::1.252: [wg] data length 96 to 0xcbaa0ce0 nonce 1 ==== run-badkey-tunnel6-addr4-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg52 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes --- 10.188.64.2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg52 wgkey "`cat 52.key`" /sbin/ping -n -w 1 -c 1 -V 52 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=24.496 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 24.496/24.496/24.496/0.000 ms ==== run-route-tunnel6-addr4-dst-src ==== # Get route to local address. /sbin/route -n -T 53 get 10.188.64.2 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get 10.188.64.2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 53 get 10.188.64.1 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get 10.188.64.1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr4-dst-src ==== # Ping local address. /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.2 PING 10.188.64.2 (10.188.64.2): 56 data bytes 64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=15.272 ms --- 10.188.64.2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 15.272/15.272/15.272/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=11.410 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 11.410/11.410/11.410/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:39.604448 ::1.253 > ::1.252: [wg] data length 96 to 0x405f5ff9 nonce 3 03:07:39.607867 ::1.252 > ::1.253: [wg] data length 96 to 0x2c9188c3 nonce 2 ==== run-badkey-tunnel6-addr4-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg53 wgkey "`cat bad.key`" ! /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes --- 10.188.64.1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg53 wgkey "`cat 53.key`" /sbin/ping -n -w 1 -c 1 -V 53 10.188.64.1 PING 10.188.64.1 (10.188.64.1): 56 data bytes 64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=15.876 ms --- 10.188.64.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 15.876/15.876/15.876/0.000 ms ==== run-route-tunnel6-addr6-src-dst ==== # Get route to local address. /sbin/route -n -T 52 get fdd7:e83e:66bc:66::1 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get fdd7:e83e:66bc:66::1 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 52 get fdd7:e83e:66bc:66::2 | grep 'interface: wg52$' interface: wg52 /sbin/route -n -T 52 get fdd7:e83e:66bc:66::2 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr6-src-dst ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=8.587 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 8.587/8.587/8.587/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=0.328 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.328/0.328/0.328/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 3 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:44.122543 ::1.252 > ::1.253: [wg] data length 112 to 0x1526c2af nonce 3 03:07:44.122679 ::1.253 > ::1.252: [wg] data length 112 to 0x454f4f9b nonce 2 ==== run-badkey-tunnel6-addr6-src-dst ==== # Ping foreign address with bad key. doas -n ifconfig wg52 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg52 wgkey "`cat 52.key`" /sbin/ping6 -n -w 1 -c 1 -V 52 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=13.987 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 13.987/13.987/13.987/0.000 ms ==== run-route-tunnel6-addr6-dst-src ==== # Get route to local address. /sbin/route -n -T 53 get fdd7:e83e:66bc:66::2 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get fdd7:e83e:66bc:66::2 | grep 'flags: .*,LOCAL' flags: # Get route to foreign address. /sbin/route -n -T 53 get fdd7:e83e:66bc:66::1 | grep 'interface: wg53$' interface: wg53 /sbin/route -n -T 53 get fdd7:e83e:66bc:66::1 | grep 'flags: .*,CLON' flags: ==== run-ping-tunnel6-addr6-dst-src ==== # Ping local address. /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::2 PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=0.113 ms --- fdd7:e83e:66bc:66::2 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.113/0.113/0.113/0.000 ms # Ping foreign address. doas -n tcpdump -ni lo0 -w wg.pcap ip6 and udp port 250 or 251 or 252 or 253 or 0 & sleep 1 # Wait until tcpdump is up. tcpdump: listening on lo0, link-type LOOP /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=0.379 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.379/0.379/0.379/0.000 ms sleep 1 # Wait until tcpdump has captured traffic. doas -n pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*' 2 packets received by filter 0 packets dropped by kernel # Check WireGuard encrypted traffic /usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data ' 03:07:48.643006 ::1.253 > ::1.252: [wg] data length 112 to 0x66c0bad6 nonce 3 03:07:48.643162 ::1.252 > ::1.253: [wg] data length 112 to 0x552ac527 nonce 2 ==== run-badkey-tunnel6-addr6-dst-src ==== # Ping foreign address with bad key. doas -n ifconfig wg53 wgkey "`cat bad.key`" ! /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 0 packets received, 100.0% packet loss # Restore key and test it. doas -n ifconfig wg53 wgkey "`cat 53.key`" /sbin/ping6 -n -w 1 -c 1 -V 53 fdd7:e83e:66bc:66::1 PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes 64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=5.718 ms --- fdd7:e83e:66bc:66::1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 5.718/5.718/5.718/0.000 ms ==== unconfig ==== # destroy WireGuard and routing domain loopback interfaces doas -n ifconfig wg50 destroy doas -n ifconfig lo50 destroy doas -n ifconfig wg51 destroy doas -n ifconfig lo51 destroy doas -n ifconfig wg52 destroy doas -n ifconfig lo52 destroy doas -n ifconfig wg53 destroy doas -n ifconfig lo53 destroy