1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
---
title: "WireGuard"
date: 2022-09-28T20:05:20-05:00
aliases:
- "/posts/wireguard"
draft: false
---
I am throwing in the towel.
For years I have *somewhat maintained* a VPN powered by WireGuard.
At first it was a simple configuration following the Arch wiki's section
on point-to-site.
That worked well enough, but didn't accomplish much.
Honestly, all I got from that setup was using a custom nameserver on
my carrier-locked phone.
Then I decided to set up a split tunnel that would forward WAN traffic
through a commercially-available VPN,
but forward LAN traffic into the WireGuard interface.
That naturally required a centralized bounce server that could forward packets.
That was ultimately an unsuccessful project.
The sticking point was my phone.
Every PC and laptop worked perfectly.
But the moment I stepped outside, my phone's DNS queries went into a black
hole.
Successful handshake;
I could ping the bounce server;
*absolutely nothing else worked*.
I'm 90% certain it had something to do with my carrier's IPv6 exchange messing
with the NATing I tried do within my VPN.
Which is difficult enough to research because entering "ipv6" and "nat" into
a Google search will *not* return anything helpful.
Amazingly, the closest I ever came to a functioning configuration was when I
setup a *second* bounce server in the cloud.
My phone could actually connect to AWS reliably
(*more cause to think it's IPv6? AWS certainly has working IPv6 routing...*)
and my WAN traffic was *definitely* going through the commercial VPN.
And *sometimes* I could even ping my other WireGuard clients.
But the times when it would fail were inexplicable, at least for me.
So I guess what I learned at the end of the day is *I don't understand
networks*.
I do *not* understand how IPv4 and IPv6 interact, or
how packets are forwarded between hosts, or
how to make the wheel-and-spoke VPN model work.
I have thrown in the towel;
my WireGuard network is now purely peer-to-peer connections.
It works well.