node subnets are not included in "allowed ips"?

[bmullan]

I have wesher creating my mesh using wireguard ok. But I'm finding that subnets on various nodes are not reachable.

On some of my NODEs I have created bridged subnets.

With regular WireGuard I could normally include those Subnets (example 192.168.75.0/24) as an "allowed ips"

But running Wesher if I check /var/lib/wesher/state.json the IP subnets are not included !

Is there a command line option not documented for how someone can specifically identify subnets they want included in the WireGuard config?

thanks

[costela]

Is there a way with Wesher to include other/additional subnets in the "allowed ips" ?

Currently no.
It's a bit trickier to implement than one might think at first. But it is something I'm considering. PR always welcome if someone beats me to it!

[bmullan]

@costela

Thanks for adding it as a milestone as I think many of the container technologies will be better enabled to be used with Wesher.

[kaiyou]

I plan on working on something a bit different, but I might end up supporting both. First my use case in a sentence (I'll develop in another issue): multiple k8s CNI set routes directly to other nodes and expect them to be honored, so I need to reflect routes added manually on the wg devices to be reflected in allowed IPs on other nodes.

Regarding this issue, it seems like a nice complement to my use case. It would probably need an additionnal setting ROUTED_NETWORKS_FILTER that contains a list of CIDRs that is used to filter advertised networks, in order to avoid propagating unwanted networks, or even 127.0.0.1/8.

A sane default value would be the empty filter, which means no network is propagated, and would also avoid adding a setting for enabling/disabling this feature.

[kaiyou]

For implementation, I intend on using this : https://godoc.org/github.com/vishvananda/netlink#RouteSubscribe

I will implement a new loop, identical to the cluster loop, consuming events from netlink, filtering the routes using a configuration setting, and providing locla node route list on a channel. Then in the main loop, I will update the local node based on these routes.

Routes will be propagated using node meta, and the node parsing routine will handle extra allowed addresses and netlink routes on top of the node overlay address. The main catch at the moment is that we will need to add and delete routes, removing routes that are not annonuced anymore by a node. How do we handle routes that are set manually by the admin instead of wesher then?

I do not intend on handling conflicting routes in this first implementation. Does that sound ok? I think I will implement the code in the node package since those are properties of the local node.

[kaiyou]

Here is the current state of our work on the routing matter. It will undergo some tests in our use case in the next few days: https://github.com/kaiyou/wesher/tree/feature-routed-net

[kaiyou]

This is currently running on three different clusters of mine, properly propagating kubernetes routes. I will provide production feedback next week.

[arnarg]

@kaiyou @costela Any updates on this?

This functionality would be great as adding a routing protocol on top of a wesher cluster would still leave the destinations out of allowed-ips on the peers.

[costela]

@arnarg unfortunately not from my side. I've been swamped and haven't been able to give wesher the attention it deserves :unamused:

@kaiyou I just noticed I didn't react to your comment. Sorry about that! This definitely sounds like a solid approach :+1:

[bmullan]

I'm not sure what the status of Issue#28 currently is: node subnets are not included in "allowed ips"? #28 from reading the comments in this Issue Thread? Does/Will Wesher support Subnets?

[costela]

@bmullan probably yes, but unfortunately no time-frame yet.

[bmullan]

Thanks. Brian

On Thu, Mar 11, 2021, 1:04 PM Leo Antunes @.***> wrote:

@bmullan https://github.com/bmullan probably yes, but unfortunately no time-frame yet.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/costela/wesher/issues/28#issuecomment-796931817, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAM23J7KIMEFQUYMT2GIC3LTDEA4BANCNFSM4KQO3Y6A .

[bmullan]

Is there a way with Wesher to include other/additional subnets in the "allowed ips" ?

Currently no. It's a bit trickier to implement than one might think at first. But it is something I'm considering. PR always welcome if someone beats me to it!

@costela I saw one entry above that said: @costela costela added this to the v0.3.0 milestone on Feb 10, 2020

Just curious if you made any progress implementing support for routing "subnets" on a Mesh VPN Node?

Thanks Brian

[bmullan]

@kaiyou

Earlier in this thread you said...

Here is the current state of our work on the routing matter. It will undergo some tests in our use case in the next few days: https://github.com/kaiyou/wesher/tree/feature-routed-net
This is currently running on three different clusters of mine, properly propagating kubernetes routes. I will provide production feedback next week.

I went to that link but I'm not sure what's different, fixed, added?? What is "running on 3 different clusters" ?

Sorry I'm missing something :-)

Brian

[bmullan]

bump