START sys/net/wg 2025-03-17T16:03:24Z
==== ifconfig ====
openssl rand -base64 32 -out 11.key
rm -f 11.pub.tmp
ifconfig wg11 create || true
ifconfig wg11 wgkey "`cat 11.key`"
ifconfig wg11 | awk '/wgpubkey/{print $2}' >11.pub.tmp
mv 11.pub.tmp 11.pub
openssl rand -base64 32 -out 12.key
rm -f 12.pub.tmp
ifconfig wg12 create || true
ifconfig wg12 wgkey "`cat 12.key`"
ifconfig wg12 | awk '/wgpubkey/{print $2}' >12.pub.tmp
mv 12.pub.tmp 12.pub
openssl rand -base64 32 -out 13.key
rm -f 13.pub.tmp
ifconfig wg13 create || true
ifconfig wg13 wgkey "`cat 13.key`"
ifconfig wg13 | awk '/wgpubkey/{print $2}' >13.pub.tmp
mv 13.pub.tmp 13.pub
openssl rand -base64 32 -out 14.key
rm -f 14.pub.tmp
ifconfig wg14 create || true
ifconfig wg14 wgkey "`cat 14.key`"
ifconfig wg14 | awk '/wgpubkey/{print $2}' >14.pub.tmp
mv 14.pub.tmp 14.pub
# destroy WireGuard and routing domain loopback interfaces
ifconfig wg11 destroy
ifconfig lo11 destroy
ifconfig: lo11: SIOCIFDESTROY: Device not configured
*** Error 1 in target 'unconfig' (ignored)
ifconfig wg12 destroy
ifconfig lo12 destroy
ifconfig: lo12: SIOCIFDESTROY: Device not configured
*** Error 1 in target 'unconfig' (ignored)
ifconfig wg13 destroy
ifconfig lo13 destroy
ifconfig: lo13: SIOCIFDESTROY: Device not configured
*** Error 1 in target 'unconfig' (ignored)
ifconfig wg14 destroy
ifconfig lo14 destroy
ifconfig: lo14: SIOCIFDESTROY: Device not configured
*** Error 1 in target 'unconfig' (ignored)
# create and configure WireGuard interfaces
ifconfig wg11 create wgport 211 wgkey "`cat 11.key`" rdomain 11
ifconfig wg12 create wgport 212 wgkey "`cat 12.key`" rdomain 12
ifconfig wg13 create wgport 213 wgkey "`cat 13.key`" rdomain 13
ifconfig wg14 create wgport 214 wgkey "`cat 14.key`" rdomain 14
# local SRC, foreign DST, tunnel 4
ifconfig wg11 wgpeer "`cat 12.pub`" wgendpoint 127.0.0.1 212 wgaip 10.188.44.2/32 wgaip fdd7:e83e:66bc:46::2/128
# local SRC, foreign DST, tunnel 6
ifconfig wg13 wgpeer "`cat 14.pub`" wgendpoint ::1 214 wgaip 10.188.64.2/32 wgaip fdd7:e83e:66bc:66::2/128
# local SRC, foreign DST, tunnel 4
ifconfig wg11 inet 10.188.44.1/24 alias
ifconfig wg11 inet6 fdd7:e83e:66bc:46::1/64 alias
# local SRC, foreign DST, tunnel 6
ifconfig wg13 inet 10.188.64.1/24 alias
ifconfig wg13 inet6 fdd7:e83e:66bc:66::1/64 alias
# local DST, foreign SRC, tunnel 4
ifconfig wg12 wgpeer "`cat 11.pub`" wgendpoint 127.0.0.1 211 wgaip 10.188.44.1/32 wgaip fdd7:e83e:66bc:46::1/128
# local DST, foreign SRC, tunnel 6
ifconfig wg14 wgpeer "`cat 13.pub`" wgendpoint ::1 213 wgaip 10.188.64.1/32 wgaip fdd7:e83e:66bc:66::1/128
# local DST, foreign SRC, tunnel 4
ifconfig wg12 inet 10.188.44.2/24 alias
ifconfig wg12 inet6 fdd7:e83e:66bc:46::2/64 alias
# local DST, foreign SRC, tunnel 6
ifconfig wg14 inet 10.188.64.2/24 alias
ifconfig wg14 inet6 fdd7:e83e:66bc:66::2/64 alias
sleep 1 # Wait until DAD for inet6 tunnel addresses has finished.
==== run-route-tunnel4-addr4-src-dst ====
# Get route to local address.
/sbin/route -n -T 11 get 10.188.44.1 | grep 'interface: wg11$'
interface: wg11
/sbin/route -n -T 11 get 10.188.44.1 | grep 'flags: .*,LOCAL'
flags: <UP,HOST,DONE,LLINFO,LOCAL>
# Get route to foreign address.
/sbin/route -n -T 11 get 10.188.44.2 | grep 'interface: wg11$'
interface: wg11
/sbin/route -n -T 11 get 10.188.44.2 | grep 'flags: .*,CLON'
flags: <UP,DONE,CLONING,CONNECTED>
==== run-ping-tunnel4-addr4-src-dst ====
# Ping local address.
/sbin/ping -n -w 1 -c 1 -V 11 10.188.44.1
PING 10.188.44.1 (10.188.44.1): 56 data bytes
64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=0.029 ms
--- 10.188.44.1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.029/0.029/0.029/0.000 ms
# Ping foreign address.
tcpdump -ni lo0 -w wg.pcap ip and udp port 211 or 212 or 213 or 214 or 0 &
sleep 1 # Wait until tcpdump is up.
tcpdump: listening on lo0, link-type LOOP
/sbin/ping -n -w 1 -c 1 -V 11 10.188.44.2
PING 10.188.44.2 (10.188.44.2): 56 data bytes
64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=1.159 ms
--- 10.188.44.2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.159/1.159/1.159/0.000 ms
sleep 1 # Wait until tcpdump has captured traffic.
pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*'
5 packets received by filter
0 packets dropped by kernel
# Check WireGuard encrypted traffic
/usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data '
17:03:27.595424 127.0.0.1.211 > 127.0.0.1.212: [wg] data length 96 to 0x94ea106b nonce 0
17:03:27.595514 127.0.0.1.212 > 127.0.0.1.211: [wg] data length 96 to 0x2179db10 nonce 1
==== run-badkey-tunnel4-addr4-src-dst ====
openssl rand -base64 32 -out bad.key
# Ping foreign address with bad key.
ifconfig wg11 wgkey "`cat bad.key`"
! /sbin/ping -n -w 1 -c 1 -V 11 10.188.44.2
PING 10.188.44.2 (10.188.44.2): 56 data bytes
--- 10.188.44.2 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
# Restore key and test it.
ifconfig wg11 wgkey "`cat 11.key`"
/sbin/ping -n -w 1 -c 1 -V 11 10.188.44.2
PING 10.188.44.2 (10.188.44.2): 56 data bytes
64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=0.978 ms
--- 10.188.44.2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.978/0.978/0.978/0.000 ms
==== run-route-tunnel4-addr4-dst-src ====
# Get route to local address.
/sbin/route -n -T 12 get 10.188.44.2 | grep 'interface: wg12$'
interface: wg12
/sbin/route -n -T 12 get 10.188.44.2 | grep 'flags: .*,LOCAL'
flags: <UP,HOST,DONE,LLINFO,LOCAL>
# Get route to foreign address.
/sbin/route -n -T 12 get 10.188.44.1 | grep 'interface: wg12$'
interface: wg12
/sbin/route -n -T 12 get 10.188.44.1 | grep 'flags: .*,CLON'
flags: <UP,HOST,DONE,CLONED>
==== run-ping-tunnel4-addr4-dst-src ====
# Ping local address.
/sbin/ping -n -w 1 -c 1 -V 12 10.188.44.2
PING 10.188.44.2 (10.188.44.2): 56 data bytes
64 bytes from 10.188.44.2: icmp_seq=0 ttl=255 time=0.053 ms
--- 10.188.44.2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.053/0.053/0.053/0.000 ms
# Ping foreign address.
tcpdump -ni lo0 -w wg.pcap ip and udp port 211 or 212 or 213 or 214 or 0 &
sleep 1 # Wait until tcpdump is up.
tcpdump: listening on lo0, link-type LOOP
/sbin/ping -n -w 1 -c 1 -V 12 10.188.44.1
PING 10.188.44.1 (10.188.44.1): 56 data bytes
64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=0.194 ms
--- 10.188.44.1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.194/0.194/0.194/0.000 ms
sleep 1 # Wait until tcpdump has captured traffic.
pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*'
2 packets received by filter
0 packets dropped by kernel
# Check WireGuard encrypted traffic
/usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data '
17:03:31.744420 127.0.0.1.212 > 127.0.0.1.211: [wg] data length 96 to 0xd7dc4e27 nonce 3
17:03:31.744509 127.0.0.1.211 > 127.0.0.1.212: [wg] data length 96 to 0xc081b0b8 nonce 2
==== run-badkey-tunnel4-addr4-dst-src ====
# Ping foreign address with bad key.
ifconfig wg12 wgkey "`cat bad.key`"
! /sbin/ping -n -w 1 -c 1 -V 12 10.188.44.1
PING 10.188.44.1 (10.188.44.1): 56 data bytes
--- 10.188.44.1 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
# Restore key and test it.
ifconfig wg12 wgkey "`cat 12.key`"
/sbin/ping -n -w 1 -c 1 -V 12 10.188.44.1
PING 10.188.44.1 (10.188.44.1): 56 data bytes
64 bytes from 10.188.44.1: icmp_seq=0 ttl=255 time=0.975 ms
--- 10.188.44.1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.975/0.975/0.975/0.000 ms
==== run-route-tunnel4-addr6-src-dst ====
# Get route to local address.
/sbin/route -n -T 11 get fdd7:e83e:66bc:46::1 | grep 'interface: wg11$'
interface: wg11
/sbin/route -n -T 11 get fdd7:e83e:66bc:46::1 | grep 'flags: .*,LOCAL'
flags: <UP,HOST,DONE,LLINFO,LOCAL>
# Get route to foreign address.
/sbin/route -n -T 11 get fdd7:e83e:66bc:46::2 | grep 'interface: wg11$'
interface: wg11
/sbin/route -n -T 11 get fdd7:e83e:66bc:46::2 | grep 'flags: .*,CLON'
flags: <UP,DONE,CLONING,CONNECTED>
==== run-ping-tunnel4-addr6-src-dst ====
# Ping local address.
/sbin/ping6 -n -w 1 -c 1 -V 11 fdd7:e83e:66bc:46::1
PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes
64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=0.032 ms
--- fdd7:e83e:66bc:46::1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.032/0.032/0.032/0.000 ms
# Ping foreign address.
tcpdump -ni lo0 -w wg.pcap ip and udp port 211 or 212 or 213 or 214 or 0 &
sleep 1 # Wait until tcpdump is up.
tcpdump: listening on lo0, link-type LOOP
/sbin/ping6 -n -w 1 -c 1 -V 11 fdd7:e83e:66bc:46::2
PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes
64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=0.116 ms
--- fdd7:e83e:66bc:46::2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.116/0.116/0.116/0.000 ms
sleep 1 # Wait until tcpdump has captured traffic.
pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*'
2 packets received by filter
0 packets dropped by kernel
# Check WireGuard encrypted traffic
/usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data '
17:03:35.885631 127.0.0.1.211 > 127.0.0.1.212: [wg] data length 112 to 0x4eb93131 nonce 3
17:03:35.885677 127.0.0.1.212 > 127.0.0.1.211: [wg] data length 112 to 0xb9c141c8 nonce 2
==== run-badkey-tunnel4-addr6-src-dst ====
# Ping foreign address with bad key.
ifconfig wg11 wgkey "`cat bad.key`"
! /sbin/ping6 -n -w 1 -c 1 -V 11 fdd7:e83e:66bc:46::2
PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes
--- fdd7:e83e:66bc:46::2 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
# Restore key and test it.
ifconfig wg11 wgkey "`cat 11.key`"
/sbin/ping6 -n -w 1 -c 1 -V 11 fdd7:e83e:66bc:46::2
PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes
64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=0.990 ms
--- fdd7:e83e:66bc:46::2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.990/0.990/0.990/0.000 ms
==== run-route-tunnel4-addr6-dst-src ====
# Get route to local address.
/sbin/route -n -T 12 get fdd7:e83e:66bc:46::2 | grep 'interface: wg12$'
interface: wg12
/sbin/route -n -T 12 get fdd7:e83e:66bc:46::2 | grep 'flags: .*,LOCAL'
flags: <UP,HOST,DONE,LLINFO,LOCAL>
# Get route to foreign address.
/sbin/route -n -T 12 get fdd7:e83e:66bc:46::1 | grep 'interface: wg12$'
interface: wg12
/sbin/route -n -T 12 get fdd7:e83e:66bc:46::1 | grep 'flags: .*,CLON'
flags: <UP,HOST,DONE,CLONED>
==== run-ping-tunnel4-addr6-dst-src ====
# Ping local address.
/sbin/ping6 -n -w 1 -c 1 -V 12 fdd7:e83e:66bc:46::2
PING fdd7:e83e:66bc:46::2 (fdd7:e83e:66bc:46::2): 56 data bytes
64 bytes from fdd7:e83e:66bc:46::2: icmp_seq=0 hlim=64 time=0.030 ms
--- fdd7:e83e:66bc:46::2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.030/0.030/0.030/0.000 ms
# Ping foreign address.
tcpdump -ni lo0 -w wg.pcap ip and udp port 211 or 212 or 213 or 214 or 0 &
sleep 1 # Wait until tcpdump is up.
tcpdump: listening on lo0, link-type LOOP
/sbin/ping6 -n -w 1 -c 1 -V 12 fdd7:e83e:66bc:46::1
PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes
64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=0.134 ms
--- fdd7:e83e:66bc:46::1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.134/0.134/0.134/0.000 ms
sleep 1 # Wait until tcpdump has captured traffic.
pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*'
2 packets received by filter
0 packets dropped by kernel
# Check WireGuard encrypted traffic
/usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data '
17:03:40.015885 127.0.0.1.212 > 127.0.0.1.211: [wg] data length 112 to 0x93a272c2 nonce 3
17:03:40.015933 127.0.0.1.211 > 127.0.0.1.212: [wg] data length 112 to 0xf5353728 nonce 2
==== run-badkey-tunnel4-addr6-dst-src ====
# Ping foreign address with bad key.
ifconfig wg12 wgkey "`cat bad.key`"
! /sbin/ping6 -n -w 1 -c 1 -V 12 fdd7:e83e:66bc:46::1
PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes
--- fdd7:e83e:66bc:46::1 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
# Restore key and test it.
ifconfig wg12 wgkey "`cat 12.key`"
/sbin/ping6 -n -w 1 -c 1 -V 12 fdd7:e83e:66bc:46::1
PING fdd7:e83e:66bc:46::1 (fdd7:e83e:66bc:46::1): 56 data bytes
64 bytes from fdd7:e83e:66bc:46::1: icmp_seq=0 hlim=64 time=0.999 ms
--- fdd7:e83e:66bc:46::1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.999/0.999/0.999/0.000 ms
==== run-route-tunnel6-addr4-src-dst ====
# Get route to local address.
/sbin/route -n -T 13 get 10.188.64.1 | grep 'interface: wg13$'
interface: wg13
/sbin/route -n -T 13 get 10.188.64.1 | grep 'flags: .*,LOCAL'
flags: <UP,HOST,DONE,LLINFO,LOCAL>
# Get route to foreign address.
/sbin/route -n -T 13 get 10.188.64.2 | grep 'interface: wg13$'
interface: wg13
/sbin/route -n -T 13 get 10.188.64.2 | grep 'flags: .*,CLON'
flags: <UP,DONE,CLONING,CONNECTED>
==== run-ping-tunnel6-addr4-src-dst ====
# Ping local address.
/sbin/ping -n -w 1 -c 1 -V 13 10.188.64.1
PING 10.188.64.1 (10.188.64.1): 56 data bytes
64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=0.025 ms
--- 10.188.64.1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.025/0.025/0.025/0.000 ms
# Ping foreign address.
tcpdump -ni lo0 -w wg.pcap ip6 and udp port 211 or 212 or 213 or 214 or 0 &
sleep 1 # Wait until tcpdump is up.
tcpdump: listening on lo0, link-type LOOP
/sbin/ping -n -w 1 -c 1 -V 13 10.188.64.2
PING 10.188.64.2 (10.188.64.2): 56 data bytes
64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=1.105 ms
--- 10.188.64.2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 1.105/1.105/1.105/0.000 ms
sleep 1 # Wait until tcpdump has captured traffic.
pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*'
5 packets received by filter
0 packets dropped by kernel
# Check WireGuard encrypted traffic
/usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data '
17:03:44.155040 ::1.213 > ::1.214: [wg] data length 96 to 0x8d214ec6 nonce 0
17:03:44.155123 ::1.214 > ::1.213: [wg] data length 96 to 0xbf27470d nonce 1
==== run-badkey-tunnel6-addr4-src-dst ====
# Ping foreign address with bad key.
ifconfig wg13 wgkey "`cat bad.key`"
! /sbin/ping -n -w 1 -c 1 -V 13 10.188.64.2
PING 10.188.64.2 (10.188.64.2): 56 data bytes
--- 10.188.64.2 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
# Restore key and test it.
ifconfig wg13 wgkey "`cat 13.key`"
/sbin/ping -n -w 1 -c 1 -V 13 10.188.64.2
PING 10.188.64.2 (10.188.64.2): 56 data bytes
64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=0.988 ms
--- 10.188.64.2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.988/0.988/0.988/0.000 ms
==== run-route-tunnel6-addr4-dst-src ====
# Get route to local address.
/sbin/route -n -T 14 get 10.188.64.2 | grep 'interface: wg14$'
interface: wg14
/sbin/route -n -T 14 get 10.188.64.2 | grep 'flags: .*,LOCAL'
flags: <UP,HOST,DONE,LLINFO,LOCAL>
# Get route to foreign address.
/sbin/route -n -T 14 get 10.188.64.1 | grep 'interface: wg14$'
interface: wg14
/sbin/route -n -T 14 get 10.188.64.1 | grep 'flags: .*,CLON'
flags: <UP,HOST,DONE,CLONED>
==== run-ping-tunnel6-addr4-dst-src ====
# Ping local address.
/sbin/ping -n -w 1 -c 1 -V 14 10.188.64.2
PING 10.188.64.2 (10.188.64.2): 56 data bytes
64 bytes from 10.188.64.2: icmp_seq=0 ttl=255 time=0.025 ms
--- 10.188.64.2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.025/0.025/0.025/0.000 ms
# Ping foreign address.
tcpdump -ni lo0 -w wg.pcap ip6 and udp port 211 or 212 or 213 or 214 or 0 &
sleep 1 # Wait until tcpdump is up.
tcpdump: listening on lo0, link-type LOOP
/sbin/ping -n -w 1 -c 1 -V 14 10.188.64.1
PING 10.188.64.1 (10.188.64.1): 56 data bytes
64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=0.128 ms
--- 10.188.64.1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.128/0.128/0.128/0.000 ms
sleep 1 # Wait until tcpdump has captured traffic.
pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*'
2 packets received by filter
0 packets dropped by kernel
# Check WireGuard encrypted traffic
/usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data '
17:03:48.294080 ::1.214 > ::1.213: [wg] data length 96 to 0x608458cd nonce 3
17:03:48.294136 ::1.213 > ::1.214: [wg] data length 96 to 0xaaf23436 nonce 2
==== run-badkey-tunnel6-addr4-dst-src ====
# Ping foreign address with bad key.
ifconfig wg14 wgkey "`cat bad.key`"
! /sbin/ping -n -w 1 -c 1 -V 14 10.188.64.1
PING 10.188.64.1 (10.188.64.1): 56 data bytes
--- 10.188.64.1 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
# Restore key and test it.
ifconfig wg14 wgkey "`cat 14.key`"
/sbin/ping -n -w 1 -c 1 -V 14 10.188.64.1
PING 10.188.64.1 (10.188.64.1): 56 data bytes
64 bytes from 10.188.64.1: icmp_seq=0 ttl=255 time=0.979 ms
--- 10.188.64.1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.979/0.979/0.979/0.000 ms
==== run-route-tunnel6-addr6-src-dst ====
# Get route to local address.
/sbin/route -n -T 13 get fdd7:e83e:66bc:66::1 | grep 'interface: wg13$'
interface: wg13
/sbin/route -n -T 13 get fdd7:e83e:66bc:66::1 | grep 'flags: .*,LOCAL'
flags: <UP,HOST,DONE,LLINFO,LOCAL>
# Get route to foreign address.
/sbin/route -n -T 13 get fdd7:e83e:66bc:66::2 | grep 'interface: wg13$'
interface: wg13
/sbin/route -n -T 13 get fdd7:e83e:66bc:66::2 | grep 'flags: .*,CLON'
flags: <UP,DONE,CLONING,CONNECTED>
==== run-ping-tunnel6-addr6-src-dst ====
# Ping local address.
/sbin/ping6 -n -w 1 -c 1 -V 13 fdd7:e83e:66bc:66::1
PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes
64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=0.032 ms
--- fdd7:e83e:66bc:66::1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.032/0.032/0.032/0.000 ms
# Ping foreign address.
tcpdump -ni lo0 -w wg.pcap ip6 and udp port 211 or 212 or 213 or 214 or 0 &
sleep 1 # Wait until tcpdump is up.
tcpdump: listening on lo0, link-type LOOP
/sbin/ping6 -n -w 1 -c 1 -V 13 fdd7:e83e:66bc:66::2
PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes
64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=0.247 ms
--- fdd7:e83e:66bc:66::2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.247/0.247/0.247/0.000 ms
sleep 1 # Wait until tcpdump has captured traffic.
pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*'
3 packets received by filter
0 packets dropped by kernel
# Check WireGuard encrypted traffic
/usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data '
17:03:52.435761 ::1.213 > ::1.214: [wg] data length 112 to 0xe3311ae9 nonce 3
17:03:52.435857 ::1.214 > ::1.213: [wg] data length 112 to 0x10df7e79 nonce 2
==== run-badkey-tunnel6-addr6-src-dst ====
# Ping foreign address with bad key.
ifconfig wg13 wgkey "`cat bad.key`"
! /sbin/ping6 -n -w 1 -c 1 -V 13 fdd7:e83e:66bc:66::2
PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes
--- fdd7:e83e:66bc:66::2 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
# Restore key and test it.
ifconfig wg13 wgkey "`cat 13.key`"
/sbin/ping6 -n -w 1 -c 1 -V 13 fdd7:e83e:66bc:66::2
PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes
64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=0.997 ms
--- fdd7:e83e:66bc:66::2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.997/0.997/0.997/0.000 ms
==== run-route-tunnel6-addr6-dst-src ====
# Get route to local address.
/sbin/route -n -T 14 get fdd7:e83e:66bc:66::2 | grep 'interface: wg14$'
interface: wg14
/sbin/route -n -T 14 get fdd7:e83e:66bc:66::2 | grep 'flags: .*,LOCAL'
flags: <UP,HOST,DONE,LLINFO,LOCAL>
# Get route to foreign address.
/sbin/route -n -T 14 get fdd7:e83e:66bc:66::1 | grep 'interface: wg14$'
interface: wg14
/sbin/route -n -T 14 get fdd7:e83e:66bc:66::1 | grep 'flags: .*,CLON'
flags: <UP,HOST,DONE,CLONED>
==== run-ping-tunnel6-addr6-dst-src ====
# Ping local address.
/sbin/ping6 -n -w 1 -c 1 -V 14 fdd7:e83e:66bc:66::2
PING fdd7:e83e:66bc:66::2 (fdd7:e83e:66bc:66::2): 56 data bytes
64 bytes from fdd7:e83e:66bc:66::2: icmp_seq=0 hlim=64 time=0.030 ms
--- fdd7:e83e:66bc:66::2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.030/0.030/0.030/0.000 ms
# Ping foreign address.
tcpdump -ni lo0 -w wg.pcap ip6 and udp port 211 or 212 or 213 or 214 or 0 &
sleep 1 # Wait until tcpdump is up.
tcpdump: listening on lo0, link-type LOOP
/sbin/ping6 -n -w 1 -c 1 -V 14 fdd7:e83e:66bc:66::1
PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes
64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=0.136 ms
--- fdd7:e83e:66bc:66::1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.136/0.136/0.136/0.000 ms
sleep 1 # Wait until tcpdump has captured traffic.
pkill -xf 'tcpdump -ni lo0 -w wg.pcap .*'
2 packets received by filter
0 packets dropped by kernel
# Check WireGuard encrypted traffic
/usr/sbin/tcpdump -n -r wg.pcap | fgrep ': [wg] data '
17:03:56.575733 ::1.214 > ::1.213: [wg] data length 112 to 0x3e97bfd0 nonce 3
17:03:56.575784 ::1.213 > ::1.214: [wg] data length 112 to 0x5a9a173b nonce 2
==== run-badkey-tunnel6-addr6-dst-src ====
# Ping foreign address with bad key.
ifconfig wg14 wgkey "`cat bad.key`"
! /sbin/ping6 -n -w 1 -c 1 -V 14 fdd7:e83e:66bc:66::1
PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes
--- fdd7:e83e:66bc:66::1 ping statistics ---
1 packets transmitted, 0 packets received, 100.0% packet loss
# Restore key and test it.
ifconfig wg14 wgkey "`cat 14.key`"
/sbin/ping6 -n -w 1 -c 1 -V 14 fdd7:e83e:66bc:66::1
PING fdd7:e83e:66bc:66::1 (fdd7:e83e:66bc:66::1): 56 data bytes
64 bytes from fdd7:e83e:66bc:66::1: icmp_seq=0 hlim=64 time=0.993 ms
--- fdd7:e83e:66bc:66::1 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.993/0.993/0.993/0.000 ms
==== unconfig ====
# destroy WireGuard and routing domain loopback interfaces
ifconfig wg11 destroy
ifconfig lo11 destroy
ifconfig wg12 destroy
ifconfig lo12 destroy
ifconfig wg13 destroy
ifconfig lo13 destroy
ifconfig wg14 destroy
ifconfig lo14 destroy
PASS sys/net/wg Duration 0m35.51s