From 7d8892b8c4356f94301e7273924f5aee8b551740 Mon Sep 17 00:00:00 2001 From: Slawomir Koszewski Date: Mon, 26 Oct 2026 02:59:56 +0100 Subject: [PATCH] fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart. --- README.md | 2 +- debian-package/debian/changelog | 10 ++++++++++ debian-package/src/usr/lib/vpn-router/vpnrouter.py | 8 +++++++- 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 76bccb5..d164439 100644 --- a/README.md +++ b/README.md @@ -114,7 +114,7 @@ must have the type shown below; an unknown section or setting is an error. | `p2s` | `enabled` | boolean | `false` | Road-warrior access | | `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients | | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint | -| `wireguard` | `address` | string | | Address and prefix for `wg0`, for example `192.168.200.1/24` | +| `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused | | `wireguard` | `listen_port` | integer | `51820` | UDP port | | `openvpn` | `enabled` | boolean | `false` | OpenVPN access for users | | `openvpn` | `address_pool` | string | | IPv4 CIDR assigned to OpenVPN clients | diff --git a/debian-package/debian/changelog b/debian-package/debian/changelog index ef559c1..312b2a5 100644 --- a/debian-package/debian/changelog +++ b/debian-package/debian/changelog @@ -1,3 +1,13 @@ +vpn-router (0.25.2-1) unstable; urgency=medium + + fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart. + + * A wireguard.address that is the network or the broadcast address of a + network larger than /31, such as 192.168.232.0/24, is refused with the + first address of the network as the example. + + -- Slawomir Koszewski Tue, 03 Nov 2026 02:30:00 +0100 + vpn-router (0.25.1-1) unstable; urgency=medium fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs. diff --git a/debian-package/src/usr/lib/vpn-router/vpnrouter.py b/debian-package/src/usr/lib/vpn-router/vpnrouter.py index bdb78ee..6e09fd2 100644 --- a/debian-package/src/usr/lib/vpn-router/vpnrouter.py +++ b/debian-package/src/usr/lib/vpn-router/vpnrouter.py @@ -458,10 +458,16 @@ def validate(cfg): wg_address = _get(cfg, 'wireguard', 'address') if wg_address: try: - ipaddress.ip_interface(wg_address) + interface = ipaddress.ip_interface(wg_address) except ValueError: raise ConfigError( f'wireguard.address: {wg_address!r} is not an address with prefix') + # The router's own address on wg0, from which the peers' addresses of the same network are told apart. + network = interface.network + if network.num_addresses > 2 and interface.ip in (network.network_address, network.broadcast_address): + raise ConfigError( + f'wireguard.address: {wg_address} is the network or broadcast address of {network}; give the ' + f'router\'s own address in it, such as {next(network.hosts())}/{network.prefixlen}') port = _get(cfg, 'wireguard', 'listen_port') if not 1 <= port <= 65535: