https://netmaker.org logo
Powered by
A mobile phone using cellular data is not routed t...
# client
c
A mobile phone using cellular data is not routed through an egress gateway. I would like to build a NAT gateway that routes traffic from portable devices such a phones through an egress gateway. When I add a phone as an external client of a Netmaker client that is both an ingress and an egress gateway, I find that traffic from the phone is routed through the egress gateway if the phone is using WiFi but not if the phone is using (T-Mobile) cellular data.
j
@echoing-controller-96073 could this be related to the issue you saw on iPhone? Might explain it...
What is the range of addresses for the egress gateway?
e
0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4
j
sorry, asking @clean-yak-4502 what his range is
c
I am testing using the mask 104.18.114.0/23, which just enough to let me use http://ipv4.icanhazip.com to return the egress address. I am testing with an iPhone.
e
oh. oops. I am getting the same behavior on my pixel. with wifi on dnsleaktest.com shows the egress server, but with wifi off, it goes back to my phone. on my iphone, I get no connection at all. that one is just wifi. there is no cellular network on that one.
j
very strange...I wonder if the issue is with the wireguard app itself
have either of you tried switching off/on the wireguard interface after changing from wifi to cellular?
the source IP should make no difference
c
That does not seem to help.
j
hmmm, is the egress node still reachable after switching?
this has to be the routing rules on the wireguard app
c
I have a standard WireGuard implementation comparable to an egress gateway that works with both WiFi and cellular data, so I am suspicious that the problem with Netmaker.
j
can you ping the egress gateway after switching?
c
Ping from where?
j
the phone
I use iSH to test
e
do you have udp hole punching on?
c
I can ping the egress gateway when connected using both WiFI and cellular.
No udp hole punching.
j
man that is so strange...so it can't be an issue with the wireguard connection...it has to be the routing rules. I can't see why it would be any different between cellular and wifi for that
is the egress gateway deployed in an environment that supports ipv6?
for instance, apparently lightsail does not support ipv6
looks like algo users encountered a similar issue: https://github.com/trailofbits/algo/issues/1385
c
The egress gateway has no public IPv6 addresses.
For my testing, I used a single client that is both an ingress and an egress gateway. Is that a supported configuration? It looks like the WireGuard configuration file that is generated for that client has two set of iptables masquerade rules, one targeted at the ingress interface and one targeted at the egress interface. That seems suspicious to me.
I performed another test using separate Netmaker clients for the ingress and egress gateways. Traffic from my iPhone was routed through the gateway if the phone used Wi-Fi but not if the phone used cellular data. Installing https://1.1.1.1 on the phone routed both Wi-Fi and cellular traffic through that VPN, so the expected behavior is possible.
6 Views
PreviousNext
Powered by