Wireguard protocol understanding source of the received packet

Question

From the docs,

WireGuard associates tunnel IP addresses with public keys and remote endpoints. When the interface sends a packet to a peer, it does the following:

1. This packet is meant for 192.168.30.8. Which peer is that? Let me look... Okay, it's for peer ABCDEFGH. (Or if it's not for any configured peer, drop the packet.)
2. Encrypt entire IP packet using peer ABCDEFGH's public key.
3. What is the remote endpoint of peer ABCDEFGH? Let me look... Okay, the endpoint is UDP port 53133 on host 216.58.211.110.
4. Send encrypted bytes from step 2 over the Internet to 216.58.211.110:53133 using UDP.

When the interface receives a packet, this happens:

1. I just got a packet from UDP port 7361 on host 98.139.183.24. Let's decrypt it!
2. It decrypted and authenticated properly for peer LMNOPQRS. Okay, let's remember that peer LMNOPQRS's most recent Internet endpoint is 98.139.183.24:7361 using UDP.
3. Once decrypted, the plain-text packet is from 192.168.43.89. Is peer LMNOPQRS allowed to be sending us packets as 192.168.43.89?
4. If so, accept the packet on the interface. If not, drop it.

To me, statements 1 and 3 from the second part seem contradictory.

1. I just got a packet from UDP port 7361 on host 98.139.183.24. Let's decrypt it!

This seems to imply that the packet was received from 98.139.183.24 However, statement 3 says

Once decrypted, the plain-text packet is from 192.168.43.89.

which seems to suggest that the packet was received from 192.168.43.89

So where did the packet come from?

Answer 1

It's because "decrypt" is a somewhat oversimplified description of what's going on. You receive a packet from the peer's public IP, bearing an encrypted payload. That payload is actually an IP packet, with its own (private) source and destination IPs.

So step 1 is basically about identifying the peer (through its public IP) and retrieving the associated key. Then in step 3 you use that key to decrypt the payload, which gives you the original packet with private source and dest.

This is the principle for any encrypted tunnel based protocol.

Answer 2

Again, you seem to be confusing the outer tunnel packet and the inner original packet.

The source host of the original packet is 192.168.43.89, but the sourcing tunnel endpoint address is 98.139.183.24.

The outer tunnel packets will have the addresses of the tunnel endpoints as the source and destination IP addresses. The outer tunnel packets are what get routed across the intervening network(s), e.g. the public Internet.

The inner original packets will have the original source and destination hosts as the IP addresses in the packet headers. These packets will be encapsulated in the tunnel packets that have the source and destination tunnel endpoints as the source and destination IP addresses.