![Wireguard“wg0:数据包具有不允许的源 IP”](https://linux22.com/image/188037/Wireguard%E2%80%9Cwg0%EF%BC%9A%E6%95%B0%E6%8D%AE%E5%8C%85%E5%85%B7%E6%9C%89%E4%B8%8D%E5%85%81%E8%AE%B8%E7%9A%84%E6%BA%90%20IP%E2%80%9D.png)
使用https://github.com/angristan/wireguard-install项目我配置了一个服务器。它在以下位置生成了以下服务器配置文件/etc/wireguard/wg0.conf
:
[Interface]
Address = 10.66.66.1/24,fd42:42:42::1/64
ListenPort = 51202
PrivateKey = ***************
PostUp = iptables -A FORWARD -i ens3 -o wg0 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i ens3 -o wg0 -j ACCEPT; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o ens3 -j MASQUERADE
### Client chris
[Peer]
PublicKey = ***************
PresharedKey = ****************
AllowedIPs = 10.66.66.2/32,fd42:42:42::2/128,209.250.230.114/32
以及以下客户端文件:
[Interface]
PrivateKey = ******************
Address = 10.66.66.2/32,fd42:42:42::2/128
DNS = 94.140.14.14,94.140.15.15
[Peer]
PublicKey = 8ZF6U0mHKvMtVw2A4jha4mZR+a0GP5W85unV05zJIyw=
PresharedKey = **************************
Endpoint = 192.248.162.216:51202
AllowedIPs = 0.0.0.0/0,::/0
这是我在客户端中的文件。在客户端上运行wg-quick up server
会导致:
root@vultr:~# wg-quick up server
[#] ip link add server type wireguard
[#] wg setconf server /dev/fd/63
[#] ip -4 address add 10.66.66.2/32 dev server
[#] ip -6 address add fd42:42:42::2/128 dev server
[#] ip link set mtu 1420 up dev server
[#] resolvconf -a tun.server -m 0 -x
[#] wg set server fwmark 51820
[#] ip -6 route add ::/0 dev server table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip6tables-restore -n
[#] ip -4 route add 0.0.0.0/0 dev server table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
之后我失去了与客户端的网络连接(我指的是我之前的 SSH 连接)。
在服务器上我看到以下调试日志:
Feb 14 18:14:21 car kernel: wireguard: wg0: Packet has unallowed src IP (209.250.230.114) from peer 1 (209.250.230.114:56584)
Feb 14 18:14:22 car kernel: wireguard: wg0: Sending keepalive packet to peer 1 (209.250.230.114:56584)
Feb 14 18:14:23 car kernel: wireguard: wg0: Packet has unallowed src IP (209.250.230.114) from peer 1 (209.250.230.114:56584)
Feb 14 18:14:26 car kernel: wireguard: wg0: Packet has unallowed src IP (209.250.230.114) from peer 1 (209.250.230.114:56584)
Feb 14 18:14:33 car kernel: wireguard: wg0: Sending keepalive packet to peer 1 (209.250.230.114:56584)
肯定AllowedIPs = 0.0.0.0/0,::/0
允许任何ip吗?为什么我会收到有关 IP 不被允许的错误?
我尝试将客户端 ip ( 209.250.230.114
) 添加到服务器配置的AllowedIps
下面+重新启动wireguard systemd服务-现在行为略有变化-似乎继续重新创建密钥对+发送握手:[Peer]
/etc/wireguard/wg0.conf
Feb 14 18:27:15 car kernel: wireguard: wg0: Sending handshake response to peer 2 (209.250.230.114:46777)
Feb 14 18:27:15 car kernel: wireguard: wg0: Keypair 40 destroyed for peer 2
Feb 14 18:27:15 car kernel: wireguard: wg0: Keypair 41 created for peer 2
Feb 14 18:27:20 car kernel: wireguard: wg0: Receiving handshake initiation from peer 2 (209.250.230.114:46777)
Feb 14 18:27:20 car kernel: wireguard: wg0: Sending handshake response to peer 2 (209.250.230.114:46777)
Feb 14 18:27:20 car kernel: wireguard: wg0: Keypair 41 destroyed for peer 2
Feb 14 18:27:20 car kernel: wireguard: wg0: Keypair 42 created for peer 2
Feb 14 18:27:25 car kernel: wireguard: wg0: Receiving handshake initiation from peer 2 (209.250.230.114:46777)
Feb 14 18:27:25 car kernel: wireguard: wg0: Sending handshake response to peer 2 (209.250.230.114:46777)
Feb 14 18:27:25 car kernel: wireguard: wg0: Keypair 42 destroyed for peer 2
Feb 14 18:27:25 car kernel: wireguard: wg0: Keypair 43 created for peer 2
这是tshark -i any
运行后客户端输出的一些数据包日志wg-quick up...
。请注意,现在的 IP 与我之前问题中的不同(尝试再次从头开始设置 - 因此是新的 ip)。
80 30.827763166 87.246.7.226 <E2><86><92> 192.248.154.136 TCP 76 [TCP Retransmission] 57034 <E2><86><92> 25 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=342868104 TSecr=0 WS=128
81 30.827859690 192.248.154.136 <E2><86><92> 87.246.7.226 TCP 56 25 <E2><86><92> 57034 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
82 33.439281276 192.248.154.136 <E2><86><92> 192.248.152.91 UDP 192 59054 <E2><86><92> 58338 Len=148
83 36.811164287 192.248.154.136 <E2><86><92> 108.61.73.244 NTP 92 NTP Version 4, client
84 38.146118476 87.246.7.243 <E2><86><92> 192.248.154.136 TCP 76 6076 <E2><86><92> 25 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=211747651 TSecr=0 WS=1024
85 38.146182173 192.248.154.136 <E2><86><92> 87.246.7.243 TCP 56 25 <E2><86><92> 6076 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
86 38.559280480 192.248.154.136 <E2><86><92> 192.248.152.91 UDP 192 59054 <E2><86><92> 58338 Len=148
87 38.852121979 87.246.7.226 <E2><86><92> 192.248.154.136 TCP 76 [TCP Retransmission] 57034 <E2><86><92> 25 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=342876128 TSecr=0 WS=128
88 38.852220458 192.248.154.136 <E2><86><92> 87.246.7.226 TCP 56 25 <E2><86><92> 57034 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
89 39.146306580 87.246.7.243 <E2><86><92> 192.248.154.136 TCP 76 [TCP Retransmission] 6076 <E2><86><92> 25 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=211748652 TSecr=0 WS=1024
90 39.146388276 192.248.154.136 <E2><86><92> 87.246.7.243 TCP 56 25 <E2><86><92> 6076 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
91 41.150763667 87.246.7.243 <E2><86><92> 192.248.154.136 TCP 76 [TCP Retransmission] 6076 <E2><86><92> 25 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=211750656 TSecr=0 WS=1024
92 41.150880444 192.248.154.136 <E2><86><92> 87.246.7.243 TCP 56 25 <E2><86><92> 6076 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
93 41.630158997 212.70.149.54 <E2><86><92> 192.248.154.136 TCP 76 46658 <E2><86><92> 25 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=42893859 TSecr=0 WS=1024
94 41.630236617 192.248.154.136 <E2><86><92> 212.70.149.54 TCP 56 25 <E2><86><92> 46658 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
95 41.811177910 192.248.154.136 <E2><86><92> 108.61.73.243 NTP 92 NTP Version 4, client
96 42.630885040 212.70.149.54 <E2><86><92> 192.248.154.136 TCP 76 [TCP Retransmission] 46658 <E2><86><92> 25 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=42894860 TSecr=0 WS=1024
97 42.630953128 192.248.154.136 <E2><86><92> 212.70.149.54 TCP 56 25 <E2><86><92> 46658 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0
98 43.353963530 fe:00:03:35:d7:65 <E2><86><92> ARP 44 Who has 192.248.154.136? Tell 104.238.168.72
99 43.354021247 56:00:03:35:d7:65 <E2><86><92> ARP 44 192.248.154.136 is at 56:00:03:35:d7:65
100 43.679313102 192.248.154.136 <E2><86><92> 192.248.152.91 UDP 192 59054 <E2><86><92> 58338 Len=148
101 44.634917692 212.70.149.54 <E2><86><92> 192.248.154.136 TCP 76 [TCP Retransmission] 46658 <E2><86><92> 25 [SYN] Seq=0 Win=29200 Len
答案1
就我而言,问题Packet has unallowed src IP"
是因为云提供商的防火墙未完全配置,可能是由于重新启动所致。执行wg-quick down
和wg-quick up
脚本添加了所需的防火墙规则。希望这对某人有帮助。