WireGuard Client & WireGuard Server/InstantGuard at the same time?

[privacyguy123]

When sharing the phones connection using tethering on the laptop then connecting into the router through the WireGuard tunnel shows the Tidal Connect receiver but not the SkyQ boxes ...

Not sure if it might just be some entry served from a cache somewhere though. With mDNS repeater turned off the entry in Tidal does disappear however. Cannot make sense of this at all.

 

[privacyguy123]

@ZebMcKayhan another Reddit post suggest using this got their setup working. https://github.com/sleinen/samplicator

I've got the code to compile on the router but the syntax for the cli/config file is way over my head, I'm not even sure what it's asking me for?

 

[ZebMcKayhan]

@ZebMcKayhan another Reddit post suggest using this got their setup working. https://github.com/sleinen/samplicator

I've got the code to compile on the router but the syntax for the cli/config file is way over my head, I'm not even sure what it's asking me for?

Looks like it needs an interface/port to listen to and a set of destinations/ports to resend to. It makes little sense if you dont know which packets to replicate (direction and port)

 

[privacyguy123]

Looks like it needs an interface/port to listen to and a set of destinations/ports to resend to. It makes little sense if you dont know which packets to replicate (direction and port)

From what I gather upnp/multicast/unicast has standardized ports - which ones should I feed this program to test if it works?

 

[ZebMcKayhan]

From what I gather upnp/multicast/unicast has standardized ports - which ones should I feed this program to test if it works?

Upnp has a standardized port over multicast (1900) https://en.m.wikipedia.org/wiki/Simple_Service_Discovery_Protocol

But mdns have another port... and all other multicasts have their own addressing and ports: https://en.m.wikipedia.org/wiki/Multicast_address

Replies to your muticast could be a unicast or multicast depending on command used and if its unicast you need to make sure its addressed to your wg client (so, I guess you need to preserve source addressing). If replies are multicast you need to setup replicator for this as well. Just adding something you think may fail as it may just be followed by another multicast or reply fails to find its way back aso. It will take time to sniff and work out packet by packet and make sure both delivery and reply is working.

 

[privacyguy123]

@ZebMcKayhan is there any way this was ever just down to some iptables MASQERADE rule or something like that? I don't have any special rules set for WGS1 at all - surely this means nothing will forward or work out of the box?

 

[ZebMcKayhan]

@ZebMcKayhan is there any way this was ever just down to some iptables MASQERADE rule or something like that? I don't have any special rules set for WGS1 at all - surely this means nothing will forward or work out of the box?

Routes are always setup to server in the main routing table. So it will be accessable to everyone (exception is if you also use a vpn client and redirect some lan ips to policy table via vpndirector, then a special rule is needed to force them to use WAN (main route table) for wgs destinations).

Not sure the firewall can do anything about this. Not sure if it would be possible to dnat multicast into unicast... the reciever end would probably disregard them...

 

[privacyguy123]

Routes are always setup to server in the main routing table. So it will be accessable to everyone (exception is if you also use a vpn client and redirect some lan ips to policy table via vpndirector, then a special rule is needed to force them to use WAN (main route table) for wgs destinations).

Not sure the firewall can do anything about this. Not sure if it would be possible to dnat multicast into unicast... the reciever end would probably disregard them...

Are you referring to this one or is there some extra scripts that need to go in nat-start or firewall-start?

 

[ZebMcKayhan]

Are you referring to this one

View attachment 53726

Yep, thats the one!