“It's been great to see Wireguard mature over the years”
I did a vuejs&#x2F;html5 web interface for wireguard recently and found it delightful to work with.<p>There was a few pain points on the way, if anyone is interested in learning from my mistakes.<p>- there is no option to specify listener ip+port tuples<p>- logical sub-interfaces work fine, unless they happen to emit a vlan tag, then wireguard drops the traffic:<p>ping: sendmsg: Protocol not supported<p>- almost every virtual ethernet device in the kernel calls eth_hw_addr_random(dev); to ensure a proper link-layer address, seems to be missing in wg<p>- &quot;allowed-ips&quot; cannot be turned off; when a routing table entry with a gateway address is used to specify exactly which peer some subnet should be routed to, then one has to also manually maintain an &quot;allowed-ips&quot; setting that contains a duplicate of the information in the routing table<p>- when one &quot;allowed-ips&quot; setting is added to a peer, wg may silently remove &quot;allowed-ips&quot; on another, unrelated peer.  this caught me by surprise while trying to connect 2 VRFs from site A to site B and C over a common tunnel infrastructure, which may have been stretching things a bit<p>Enjoy wireguard!