1

I have an EC2 instance with Ubuntu 22.04. I am trying to create a tunnel between the EC2 instance to my PC. On my PC I have a VirtualBox VM with Ubuntu 22.04 as well (Bridged Network) The EC2 instance acts as the server that exposes its IP.

This is the wg0.conf on the EC2 instance:

[Interface]
Address = 10.8.0.11/24
Address = fc1d:86gb:c3bc::1/64
SaveConfig = true
ListenPort = 51820
PrivateKey = <ec2_private_key>

[Peer]
PublicKey = <my_local_pc_public_key>
AllowedIPs = 10.8.0.22/32, fd0d:86gb:c3bc::2/128

This is the wg0.conf on my local PC VM:

[Interface]
PrivateKey = <my_local_pc_private_key>
Address = 10.8.0.22/24
Address = fc1d:86gb:c3bc::2/64

[Peer]
PublicKey = <ec2_public_key>
AllowedIPs = 10.8.0.0/24, fc1d:86gb:c3bc::/64
Endpoint = <ec2_public_IPv4_address>

In my EC2 inbound rules I allowed UDP port 51820 from all IPv4 and IPv6 addresses.

On the server I started the wg service. Although it doesn't show active(running), it shows active(exited):

ubuntu@ip:~$ sudo systemctl status [email protected]
● [email protected] - WireGuard via wg-quick(8) for wg0
     Loaded: loaded (/lib/systemd/system/[email protected]; enabled; vendor pre>
     Active: active (exited) since Mon 2022-11-07 05:17:24 UTC; 10h ago

Then I type on my local pc the wg-quick command: sudo wg-quick up wg0 But I don't see handshake between the two machines How can I further debug it?

Improve this question
1
  • For me it seems to be a DNS issue. When i used IP address of the server, it worked fine.
    – wolfram77
    Jul 29, 2023 at 18:23

1 Answer 1

Reset to default
3

A handshake will only occur if there's some data that needs to be sent (or if "persistent keepalive" was enabled for that peer). Otherwise the tunnel stays quiet. Try to ping the peer interface's IP address to generate some traffic.

If you try to ping something but you see in tcpdump that no packets are being sent regardless, try to enable the WireGuard kernel module's "dynamic debugging" so that dmesg will log why the packets were ignored:

# echo "module wireguard +p" > /sys/kernel/debug/dynamic_debug/control
# dmesg -ew

If you see that the handshake starts from one end but doesn't reach the other (e.g. if if you saw the handshake UDP packets leave the one peer's eth0 interface, but they never showed up at the other peer) – this might be caused by network-level blocking (e.g. AWS security rules, or VirtualBox NAT being weird).

If you see that the handshake packets are being sent and received (i.e. they show up on tcpdump on both ends) but ignored by the other end, it could be either a host-level firewall (iptables/nftables) or WireGuard itself:

  • Enable kernel module debugging as above; if WireGuard itself ignores a handshake packet it'll be mentioned in dmesg. If the packet is in tcpdump but there's no mention of it in dmesg – it was likely dropped by the firewall instead.
  • If the target runs iptables, add some -p udp --dport 51820 -j LOG rules to various places in your iptables ruleset to see if the packets reach them (the log events will also be in dmesg).
  • If you're using nftables on the target host, add a udp dport 51820 meta nftrace set 1 rule, then run nft monitor trace to see how the packets are processed.
Improve this answer
7
  • The commands on EC2 shows me Permission denied even with sudo. I believe I am using iptables. I am sorry but I followed the simple guide on how to set WireGuard :digitalocean.com/community/tutorials/… , and I don't know how to do the second part of adding logging to iptables (my networking knowledge/experience is limited). do you have maybe a link that shows how to do that where I can learn more? Btw, when I ping from EC2 to the local pc, it shows me sendmsg: Destination address required and Destination Host Unreachable
    – Stackerito
    Nov 7, 2022 at 17:47
  • > doesn't work with sudo – run the commands from a root shell instead (or use the other tricks listed there). "Destination address required" is likely WireGuard's way of saying that EC2 doesn't have your PC's endpoint address yet – which it won't until a handshake. The PC needs to start first.
    – u1686_grawity
    Nov 7, 2022 at 17:51
  • Oh thanks for the explanation, makes sense now. So what I did was to simply use sudo su to run these commands and now they logged out a lot of stuff. What should I do with all the output now? (And should I undo these commands later?)
    – Stackerito
    Nov 7, 2022 at 17:56
  • Update: Alright, I got the dynamic output: I get wireguard: wg0: No valid endpoint has been configured or discovered for peer 4
    – Stackerito
    Nov 7, 2022 at 18:02
  • 1
    Write a module wireguard -p to the same /sys "file" if you want to disable the messages.
    – u1686_grawity
    Nov 7, 2022 at 18:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .