Forcing innernet to use a particular interface when multiple exist

[gk1]

I have innernet client running on multiple desktops, and each also have zerotier and other vpn type interfaces. Sometimes the wg tunnel comes up and uses one of the other vpn tunnels to send traffic. Is there a way i can tell innernet/wg to only use a particular interface? I tried setting bindaddress in the client config file, but it didnt have any effect.

Please advise, as the documentation doesnt specify

[mbernat]

I believe wireguard doesn't handle routing (including interface selection) at all, it just encrypts the packets and lets the standard routing mechanisms select the interface for the given endpoint. So, without innernet you should be able to configure your own routing for all of your endpoints.

Innernet complicates the picture by making the endpoints dynamic, which would seemingly also require some dynamic routing rules to enable the interface selection. But this feels a bit out of scope of the innernet project, which is a relatively thin peer management layer over the wireguard.

[strohel]

Hi @gk1, this seems to be more a question about wireguard rather than innernet (which is just a thin layer that sets up wireguard endpoint and peers).

You didn't mention the OS, but it that's Linux and you're using the kernel driver, then it looks like it doesn't allow specifying the listen/bind interface/address: https://unix.stackexchange.com/questions/727166/wireguard-specify-listen-address

You may still be able to use an userspace wireguard implementation (even on Linux), which may allow specifying the listen port (I haven't checked). You can use innernet --backend userspace ... to use the userspace backend. It tries to use wireguard-go binary, but WG_USERSPACE_IMPLEMENTATION env variable can be set to force a different binary.

[gk1]

Sorry, yes i have it running on both macos and linux. the innernet client has a command set-listen-port which seems to imply that you could set the interface IP upon which to bind, but without chasing code for all the command-line options doesnt seem to do anything client side. It could be that that command is only for the server side, which i guess as you are saying would make sense. I was looking at the fact that innernet installs wireguard during its install process, but it seems that it dynamically controls the wg interface, and doesnt rely on a configuration file that i can modify or maintain directly to potentially solve my issue.

Its funny, as when i was doing some speed tests, even though innernet/wg chose to use a zerotier tunnel instead of the main internet interface, it was still faster than a direct test of the base zt tunnel. so thats good at least but still there should be a way to solve this you would think.

If you all need more information let me know, i would really like to solve this issue.

[bschwind]

the innernet client has a command set-listen-port which seems to imply that you could set the interface IP upon which to bind, but without chasing code for all the command-line options doesnt seem to do anything client side. It could be that that command is only for the server side

This sets the listen port for wireguard running on the client. You can run sudo wg to view the current listen port.

I do see this answer which may have some clues on what you want to do. I haven't done this personally so I don't have much advice here, sorry.

[bschwind]

Our code already supports setting fwmark (firewall mark) on the wireguard device, so we could expose that as a CLI command like set-fwmark or unset-fwmark, and then you can set up a routing table and rule that all packets with a particular fwmark use that routing table (which will go through the network interface you specify when setting up the table)

Copied from the link above:

3. Route certain traffic through the other network interface
   If you change the metric values of eth0 and/or wlan0 on Host L to use wlan0 by default for outbound connections, then you need to make some routing changes if you want to ensure Host L will route outbound WireGuard connections through eth0.

If Host R has a static IP address, you can just add a simple route for it to Host L's main routing table. Say Host R has a static IP address of 198.51.100.1. You could then just add this route on Host L:

ip route add 198.51.100.1/32 via 192.168.0.1 dev eth0

However, if Host R doesn't have a fixed IP address (or fixed pool or range of addresses), you'll have to set up some policy routing for it. First add a custom routing table on Host L (number 123, or some other table number not in use) with the default route set for eth0:

ip route add default via 192.168.0.1 dev eth0 table 123

Then add a policy rule to use this new table for any packets marked 0x7b (or some other mark value you want to use instead):

ip rule add fwmark 0x7b table 123

Finally, configure WireGuard on Host L to mark packets emitted by WireGuard with 0x7b (or whatever mark value you used for the above policy rule):

# wg0 on Host L
[Interface]
PrivateKey = ABBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBFA=
Address = 10.68.9.2/32
ListenPort = 51820
FwMark = 0x7b

[Peer]
PublicKey = /TOE4TKtAqVsePRVR+5AA43HkAK5DSntkOCO7nYq5xU=
AllowedIPs = 10.68.9.1/32

Restart WireGuard. Host L will now always send WireGuard traffic through its eth0 interface.