Cannot made connection to WireGuard

[jiuntian]

How should I config it to use in IPv4-only environment?

[database64128]

There's nothing special about it. Just configure it like you normally would.

[jiuntian]

Hi, I think I have just configured the server with IPv4 correctly, thanks. But, I am now currently unable to connect to the server from client (Mac with apple silicon). I have tried to use netcat to test the connection to the server, and it shows that the connection is right, which the server will log error when I send invalid message through netcat from my laptop, so I suppose that the server is working. Do you have any ways to share on how to debug such issue? I have followed the config you provided in #11.

[database64128]

Maybe use netcat to send packets to wgListen and see if the server prints New UDP session?

[jiuntian]

I found the cause why it don't work initially on my computer. I am sharing here with hope that it can help other who might have this problem in the future.

Problem description:
When both client and server is properly configured, and it is sure that both are working, e.g. when using nc -u <server_ip> <server_port> with same random input, we can see some error messages on server log which indicate that the server should working properly. But the WireGuard connection cannot been made between server and client when trying to initiate an UDP session from wireguard. To find of the cause, I use Wireshark to check on the packets send from swgp-go to server and I realised, the UDP packets after handshake are send through WireGuard IP (e.g. 10.10.10.2) to <server_ip>, which is not reachable.

Solution:
It is easy to solve, just exclude the <server_ip>, use the WireGuard AllowedIPs calculators (at https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/), enter the initial values in your WireGuard configs for AllowedIPs, as well as your <server_ip>, then replace the AllowedIPs in the WireGuard config and here you go.
You should get like this if your <server_ip> is 123.123.123.123:

Disadvantage:
You might not accessible to services in <server_ip> through WireGuard, but nevertheless, you still can use WireGuard internal IP to access if it is open to the particular services.

[database64128]

the UDP packets after handshake are send through WireGuard IP (e.g. 10.10.10.2) to <server_ip>, which is not reachable.

On Linux you should set proxyFwmark to the same fwmark in your wg config. On Windows you can add a separate route to the remote server via your physical interface.

[jiuntian]

the UDP packets after handshake are send through WireGuard IP (e.g. 10.10.10.2) to <server_ip>, which is not reachable.

On Linux you should set proxyFwmark to the same fwmark in your wg config. On Windows you can add a separate route to the remote server via your physical interface.

Thanks, this is very informative, do you know about the similar method in macOS?

[database64128]

No, I have never used macOS. 😄