Net_gateway routes are ignored in WG mode

Pritunl Pritunl VPN
1

Hi!

I have a WG server that announces both default GW routes for both AFIs (IPv4 0.0.0.0/0 + IPv6 ::/0) and it also sends a few routes. IPv4 is fine because we push only RFC1918 routes. But for IPv6 I need to push route that contains the VPN server IP.

I.e. I am pushing 2001:db8::/32 and the VPN server is 2001:db8::1. I also added route 2001:db8::1/128 with “Block Route and Net Gateway” in GUI, which generates net_gateway OpenVPN routes.

When the clients accept the default GW from the server everything works fine. When the client has “Disable Default Gateway” option enabled the WG mode does not work over IPv6 and it simply fails with Handshake Timeout.

Apparently the 2001:db8::1/128 with “Block Route and Net Gateway” is ignored in WG mode. I guess it is in fact ignored here: pritunl-client-electron/service/profile/profile.go at master · pritunl/pritunl-client-electron · GitHub

Is there any way to work this around or are there any plans to implement net_gateway functionality in WG mode?

2

From what I understand it should put ! in front of the subnets that are net gateway. I have added this to the code but it may also require modifying the routing table.

3

Yes, I think we need PriTunl client should create routes “ via <original_host_default_gw>”, which is what OpenVPN does for the “net_gateway” routes in fact.

I guess you already have some code for that, because you inject the route for the tunnel endpoint via host’s original default GW when the new default GW over the tunnel is injected (and it works in WG mode).