diff options
| author | Paul Buetow <paul@buetow.org> | 2026-06-29 11:14:13 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-06-29 11:14:13 +0300 |
| commit | a8057647167e943e3f3b1f68a2db94a158d80d68 (patch) | |
| tree | 1780a95d1c2b24779d99908a830558604775603a /.gitignore | |
| parent | 70acbd00e0f235d8f257a1f23a558a66ece55e9c (diff) | |
Fix roaming clients getting duplicate 0.0.0.0/0 on both gateway peers
wg-quick can only install one default route; giving AllowedIPs=0.0.0.0/0
to both blowfish and fishfinger caused the second peer to silently end up
with allowed-ips:(none) in the running WireGuard config. This made blowfish
a dead peer on earth/pixel7pro/uranus despite active keepalives.
Fix: introduce primary_gateway:true on fishfinger in YAML. In
compute_allowed_ips, only the peer flagged primary_gateway gets 0.0.0.0/0
for roaming+gateway:true clients; all other peers (secondary gateways and
infra) receive their specific /32+/128 IPs only.
Also document in extra_ips_via_gateway why reachable_via must name only
one gateway — WireGuard enforces each AllowedIPs prefix belongs to exactly
one peer, so duplicating earth's IPs across both gateways would cause the
same silent conflict problem.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to '.gitignore')
0 files changed, 0 insertions, 0 deletions