☰

Wireguard 客户端未在 nixos 上完成握手

tag-icon • tag-icon nixos nix wireguard
Wireguard 客户端未在 nixos 上完成握手 
Mar 07 12:10:16 nixos kernel: wireguard: wg0: Handshake for peer 1 (192.248.152.91:58338) did not complete after 5 seconds, retrying (try 3)
Mar 07 12:10:16 nixos kernel: wireguard: wg0: Sending handshake initiation to peer 1 (192.248.152.91:58338)

如果我将允许的 IP 设置为其他内容，这似乎可以正常工作0.0.0.0- 我的理解是它只会通过wireguard VPN 发送到这些 ip 的连接。

  networking.firewall = {
      enable = false;
    };

  # Enable Wireguard
  networking.wireguard.interfaces = {
    wg0 = {
      ips = [ "10.66.66.2/32" ];
      listenPort = 58338; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
      privateKey= "************************";

      peers = [

        {
          publicKey = "***************";
          presharedKey = "*****************";

          allowedIPs = [ "0.0.0.0/0" ];
          #allowedIPs = [ "10.66.66.1" "94.130.178.87" ];

          endpoint = "192.248.152.91:58338"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577

          # Send keepalives every 25 seconds. Important to keep NAT tables alive.
          persistentKeepalive = 25;
        }
      ];
    };
  };

我已读完https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577/4然而，即使添加了 ip 路由后，ip route add 192.248.152.91 via 10.66.66.1 dev wg0它的行为似乎也没有任何变化。

root@nixos> ip route                                                                                                ~
default dev wg0 scope link 
default via 10.0.2.2 dev eth0 proto dhcp src 10.0.2.15 metric 202 
10.0.2.0/24 dev eth0 proto dhcp scope link src 10.0.2.15 metric 202 
192.248.152.91 via 10.66.66.1 dev wg0

答案1

我必须添加以下路线：

ip route add 192.248.152.91 via 10.0.2.2

这里有很多关于这个问题的讨论：https://github.com/NixOS/nixpkgs/issues/51258#issuecomment-673839893

相关内容