2

From the docs,

WireGuard associates tunnel IP addresses with public keys and remote endpoints. When the interface sends a packet to a peer, it does the following:

  1. This packet is meant for 192.168.30.8. Which peer is that? Let me look... Okay, it's for peer ABCDEFGH. (Or if it's not for any configured peer, drop the packet.)
  2. Encrypt entire IP packet using peer ABCDEFGH's public key.
  3. What is the remote endpoint of peer ABCDEFGH? Let me look... Okay, the endpoint is UDP port 53133 on host 216.58.211.110.
  4. Send encrypted bytes from step 2 over the Internet to 216.58.211.110:53133 using UDP.

When the interface receives a packet, this happens:

  1. I just got a packet from UDP port 7361 on host 98.139.183.24. Let's decrypt it!
  2. It decrypted and authenticated properly for peer LMNOPQRS. Okay, let's remember that peer LMNOPQRS's most recent Internet endpoint is 98.139.183.24:7361 using UDP.
  3. Once decrypted, the plain-text packet is from 192.168.43.89. Is peer LMNOPQRS allowed to be sending us packets as 192.168.43.89?
  4. If so, accept the packet on the interface. If not, drop it.

To me, statements 1, 3, and 4 from the first part seem contradictory.

  1. This packet is meant for 192.168.30.8. Which peer is that? Let me look... Okay, it's for peer ABCDEFGH. (Or if it's not for any configured peer, drop the packet.)

This seems to imply that the packet is supposed to go to 192.168.30.8 However, statement 3 and 4

  1. What is the remote endpoint of peer ABCDEFGH? Let me look... Okay, the endpoint is UDP port 53133 on host 216.58.211.110.
  2. Send encrypted bytes from step 2 over the Internet to 216.58.211.110:53133 using UDP.

seem to suggest that the packet goes to 216.58.211.110

So where does the packet go to?

1

I think you do not actually understand a tunnel. A tunnel wraps the original packets inside outer packets that get delivered to the other end of the tunnel, where the outer packets are stripped, and the original packets are normally routed from there.

What you seem to be confusing is the destination of the original packet with the destination of the outer tunnel packet.

  1. This packet is meant for 192.168.30.8. Which peer is that? Let me look... Okay, it's for peer ABCDEFGH. (Or if it's not for any configured peer, drop the packet.)

The original packet is destined to 192.168.30.8 and the other endpoint of the tunnel is ABCDEFGH (apparently, the DNS name).

  1. Encrypt entire IP packet using peer ABCDEFGH's public key.

This encrypts the original packet inside a tunnel packet (the tunnel header is not encrypted, and it cannot be).

  1. What is the remote endpoint of peer ABCDEFGH? Let me look... Okay, the endpoint is UDP port 53133 on host 216.58.211.110.

This looks up the address of the DNS name for the other endpoint of the tunnel, then places the destination address on the outer tunnel packet header.

  1. Send encrypted bytes from step 2 over the Internet to 216.58.211.110:53133 using UDP.

Send the outer tunnel packet containing the original (encrypted) packet to the other tunnel endpoint, where the tunnel packet will be stripped, and the original packet is unencrypted and routed normally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.